Disabling Docker ICC still allows raw ethernet communication between containers

Re:Disabling Docker ICC still allows raw ethernet communicat... by iforgotpassword on Wednesday February 21, 2018 @01:56AM (#16427445)

Why not just put each docker container in its own VM? Problem solved without any ugly hacks, clean and elegant.

[ Parent | on HN ]

Re:Disabling Docker ICC still allows raw ethernet communicat... by bringtheaction on Wednesday February 21, 2018 @05:04AM (#16428311)

What do you need docker for if you put each container in a VM of its own?

[ Parent | on HN ]

Re:Disabling Docker ICC still allows raw ethernet communicat... by chatmasta on Wednesday February 21, 2018 @07:58AM (#16429074)

Once use case is if you're running a multi-tenant service, where customers can deploy their own docker containers. In terms of developer usability, it's way easier to have them push containers to a registry than it is to ask them to package a custom ISO for upload into a VM. To your customers, it appears you are just running docker, but on the backend you isolate each container in a VM for OS-level security isolation.

The Intel Clear Containers project [0] is working on this.

[0] https://github.com/clearcontainers

[ Parent | on HN ]

Re:Disabling Docker ICC still allows raw ethernet communicat... by bthornbury on Wednesday February 21, 2018 @02:21AM (#16427561)

I guess the same reason I get a better computer every few years.

[ Parent | on HN ]