Re:AWS EC2 Container Service
by joshpadnick on Thursday November 13, 2014 @08:25PM
(#8605307)
I'm here at AWS reinvent and just saw the EC2 Container Service presentation. They specifically targeted security as part of their design.
Basically, you launch a cluster of EC2 instances that are "available" for containers to launch into. So these are your instances, running in your VPCs. It's really the same security profile as the standard VPCs plus any other security issues your particular docker containers expose.
These are also properties of Google Container Engine. Which other container service offerings were you thinking of?
Digital Ocean has something called "Private Networking" that's internal to the data center but shared with all other customers. It's not obvious from reading the website that this is the case.
I actually think they're almost intentionally a touch deceptive. "Private" is a really loaded term to use there.
Re:AWS EC2 Container Service
by inopinatus on Thursday November 13, 2014 @08:23PM
(#8605299)
When a door is marked "Private", then the room beyond is generally a shared space for all those authorized to access.
Not really, common to refer to Private IP's as "private IP address space" as per RFC 1918(IPv4)/RFC 4193(IPv6).
If a user of the service is wanting to get on board, it is their responsibility to ensure what they think is accurate or not.
Linode's is the same. I agree that it's annoying and that the terminology is slightly deceptive.
Any of these "datacenter LANs", though, tend to be fast and free (in terms of bandwidth). We just use a VPN overlay and call it a day.
1. The containers live on "your" VMs so you get the isolation of a virtual machine and do not worry about the other tenants' containers.
2. The VMs are part of a "private cloud", i.e., the internal network is not accessible by other tenants' VMs and containers.
#2 is what worried me the most in other container service offerings. It's easy to overlook protecting your internal ip when you manage VMs, it's even easier (and expected) when you deploy containers.