News for hackers. Stuff that matters.
Re:Dockerfile Security Best Practices by kspacewalk2 on Wednesday October 14, 2020 @12:48PM (#24778724)
>Aside from LXD and that family of technologies, which are criminally underused.

Criminally underused indeed. I have no idea why it's not more popular for 'average' users/orgs. I don't know what issues may come up with scaling this up, but in our small org we've been running 20-30 (mostly unprivileged) LXD containers in production for several years now for all sorts of intranet and external-facing services (auth, DB, web, etc). Sure, it requires a bit more thought to set up than Docker, but it's well-documented (for most people's uses at least), secure, stable and lightweight.

Re:Dockerfile Security Best Practices by scns on Wednesday October 14, 2020 @03:34PM (#24780591)
>I have no idea why it's not more popular for 'average' users/orgs.

Maybe because many devs use Macs / Windows? Maybe WSL may tilt the balance in LXDs favour, but on OSX? Run it a VM yourself without the conveniences of docker-compose up?

As a Linuxuser myself, i looked at the competing solutions (podman, LXD, and the one by Canonical whose name i forgot) and thought: "Ain't gonna fly in a mixed environment."

They may be technologically superior, worse is better once again i guess. Would prefer them to Docker too.

Re:Dockerfile Security Best Practices by krimeo on Thursday October 15, 2020 @12:57AM (#24785089)
Isn't docker running on OS X in VM anyway?
Re:Dockerfile Security Best Practices by bruce_one on Thursday October 15, 2020 @01:44AM (#24785272)
Yes it does, but it's very transparent - until you run into a few things that make it obvious, eg if you disk-image size limits, or memory limits.

I work with a few people who believed it was native, and used it for quite a while, until things started going wrong and we logged in to the vm to fix them.

Re:Dockerfile Security Best Practices by krimeo on Thursday October 15, 2020 @09:37AM (#24788507)
Kinda my point. The reason docker is popular is simply that most of the devs are lazy, not very knowledgeable in the actual underlying technology and very short-sighted.

And docker marketing has very effectively used that to their advantage.

Re:Dockerfile Security Best Practices by scns on Thursday October 15, 2020 @02:23AM (#24785460)
Yes it is, but docker for desktop runs it for you. You could use LXD etc by running Linux yourself in a virtualisation solution of your choice like VirtualBox or VMWare.
Re:Dockerfile Security Best Practices by krimeo on Thursday October 15, 2020 @09:35AM (#24788488)
Yeah, that's my point.

On Linux you are going to run docker in VM anyway if you care a bit about security, but I know that almost all devs run docker directly on their laptops and with the user's full access to docker - ie. their user effectively becomes user. Without second thought ...

Re:Dockerfile Security Best Practices by krimeo on Thursday October 15, 2020 @09:38AM (#24788518)
* becomes root, of course
Re:Dockerfile Security Best Practices by krimeo on Thursday October 15, 2020 @12:57AM (#24785088)
> I have no idea why it's not more popular for 'average' users/orgs.

https://news.ycombinator.com/item?id=24782999 tongue in cheeck indeed, but better marketing it is, of course