News for hackers. Stuff that matters.
Re:Kata Containers: The speed of containers, the security of... by lijok on Wednesday October 04, 2023 @07:24AM (#37763592)
I find this take so interesting. Here's a tool so faultless your biggest gripe with it is some obscure interaction 99.99% of people wont even be aware of, and you want to replace the tool because of it.

This would be the equivalent of me buying a great car and disliking the fact that when you pull the carpets up there's a hard to reach clip that needs to be undone, so I decide to sell it and get a different car.

I see this happen with all great tools. It irons out all the important kinks, and people still find some obscure reason to fault the tool enough to switch.

(To be clear, I am aware Docker has issues beyond what GP is dealing with)

(Apologies for the strong tone of the comment, it's not intended, but could not find a better way to word it)

Re:Kata Containers: The speed of containers, the security of... by NhanH on Wednesday October 04, 2023 @07:35AM (#37763683)
That is not an obscure issue. The common manifestation is breaking iptables rule (with expose port) and messing up software firewall has caused a lot of wasted hours and security issues.
Re:Kata Containers: The speed of containers, the security of... by insanitybit on Wednesday October 04, 2023 @08:38AM (#37764209)
And yet the example they chose was "It broke wifi on a train's shitty network"
Re:Kata Containers: The speed of containers, the security of... by codetrotter on Wednesday October 04, 2023 @09:54AM (#37765212)
Docker uses 172.17.0.0/16 subnet range by default.

There is nothing shitty about the network on the train for also using this same IP address range.

https://en.wikipedia.org/wiki/Private_network

10.0.0.0/8

172.16.0.0/12

192.168.0.0/16

You might be used to seeing addresses from 192.168.0.0/24 and 192.168.1.0/24 in home networks, and addresses from 10.x.y.0/24 in corporate internal networks.

But all of 172.16.0.0/12 has exactly the same kind of purpose as do 10.0.0.0/8 and 192.168.0.0/16.

The people that set up the network on the train did nothing wrong for using a subnet of 172.16.0.0/12.

Re:Kata Containers: The speed of containers, the security of... by justin_oaks on Wednesday October 04, 2023 @11:07AM (#37766275)
Does anyone configure other IP ranges in Docker? I know there are other reserved IP ranges you might get away with. There's the CGNAT IP range 100.64.0.0/10, and there's the link-local IP range 169.254.0.0/16. These are unused in most situations and may work fine for Docker networks.
Re:Kata Containers: The speed of containers, the security of... by doubled112 on Wednesday October 04, 2023 @01:56PM (#37769086)
I do. I have a few VLANs and subnets at home.

Docker Compose creates a new network for every project, and eventually overlaps with something important. They are fairly large ranges by default, so you end up taking up a lot of address space fast if you're not careful. This is especially wasteful because some of the Docker networks only contain two hosts, but are (from memory) a /24 or maybe even a /20.

Easier to handle it manually.

Re:Kata Containers: The speed of containers, the security of... by adammarples on Wednesday October 04, 2023 @07:37AM (#37763696)
Surely the exact equivalent issue would be that the car is always running and sometimes blocks your WiFi when it's in the garage
Re:Kata Containers: The speed of containers, the security of... by lijok on Wednesday October 04, 2023 @07:38AM (#37763711)
Very different implication there, so I would say it's not equivalent