Rebuilding My Personal Infrastructure With Alpine Linux and Docker

Re:Rebuilding My Personal Infrastructure With Alpine Linux a... by tannhaeuser on Wednesday March 13, 2019 @05:42AM (#19377115)

But he had to migrate away from FreeBSD to use Docker, so that doesn't sound like a portability advantage at all, in the usual sense of the word "portability". "Improved security" is also a red herring. You can't make something more secure by adding an additional layer of abstraction. He even mentions that he found it problematic that inside the Docker container, everything runs as root by default. Plus the dicker daemon must needlessly run as root on the host.

[ Parent | on HN ]

Re:Rebuilding My Personal Infrastructure With Alpine Linux a... by viraptor on Wednesday March 13, 2019 @06:58AM (#19377520)

> he found it problematic that inside the Docker container, everything runs as root by default

That's technically right, but not what you'd expect. Docker runs root in a few restricted namespaces and behind seccomp by default. The syscall exploits people are worried about are often simply not available. Even then it's easy to take it another step and create new users. You could even have root mapped to a different user on the outside if you prefer that.

That shouldn't be an issue if you're coming from FreeBSD - https://www.freebsd.org/doc/en/articles/new-users/adding-a-u...

> If you did not create any users when you installed the system and are thus logged in as root, you should probably create a user now with ...

[ Parent | on HN ]

Re:Rebuilding My Personal Infrastructure With Alpine Linux a... by rsync on Wednesday March 13, 2019 @11:13AM (#19379439)

""Improved security" is also a red herring. You can't make something more secure by adding an additional layer of abstraction."

I have not used docker. However, I have been putting things in containers with FreeBSD 'jail' since 2001 ...

If I jail my httpd and there is a vuln in the httpd, the attacker gets the jail (and the httpd, etc.) but not the underlying system.

That's a huge win, in my mind - is that not how it works in dockerland ?

[ Parent | on HN ]

Re:Rebuilding My Personal Infrastructure With Alpine Linux a... by weberc2 on Wednesday March 13, 2019 @12:23PM (#19380229)

Last I checked, Docker containers are not hard to break out of unless you go to extra lengths (SELinux, AppArmor, etc--not entirely sure; I'm not an expert). Most people use Docker as a way to avoid their programs accessing the wrong version of a shared dependency or similar. I believe there may be other container runtimes with stronger guarantees or better defaults, some of which are even suitable for running untrusted code (or so they advertise).

[ Parent | on HN ]

Re:Rebuilding My Personal Infrastructure With Alpine Linux a... by rsync on Wednesday March 13, 2019 @01:10PM (#19380888)

Thanks - good to know.

jail is pretty tremendous - a real win in many areas.

[ Parent | on HN ]