Show HN: Bunkerized-Nginx – Nginx Docker image secure by default

Re:Show HN: Bunkerized-Nginx – Nginx Docker image secure by ... by diarrhea on Wednesday October 21, 2020 @02:43AM (#24845321)

That is pretty much what Docker enforces,too (so it's baked in, not just happens to be best practice). You can run multiple processes in a container, e.g. using `&`, but that gets ugly so fast you'll notice you're trying to square the circle.

[ Parent | on HN ]

Re:Show HN: Bunkerized-Nginx – Nginx Docker image secure by ... by TheDong on Wednesday October 21, 2020 @02:30PM (#24850657)

No, it is not baked in.

Did you know the linux kernel requires you to set an init? If you check what you were booted with (/proc/cmdline), it probably includes something like `init=/usr/lib/systemd/systemd`.

Docker requires you to set a single entrypoint not because it's "baked in", but because that's the way linux works: when you create a new namespace, you run a single program as its pid1, just like when you boot linux, a single program is pid1.

It's very easy to set pid1 of a docker container to runit or various other process runners to run multiple processes.

Arguing otherwise is no different than arguing that linux only supports running one process because if you set "init=/bin/bash" at the cmdline, it gets ugly real fast to run a multi-process system off it.

[ Parent | on HN ]

Re:Show HN: Bunkerized-Nginx – Nginx Docker image secure by ... by GoblinSlayer on Wednesday October 21, 2020 @12:58PM (#24849717)

Bash is a user interface, not a service runner. If tini could run several processes, what can possibly go wrong?

[ Parent | on HN ]