+bonifartius 𒂼𒄄
@mk @theorytoe you missed the point. containers just make things harder. they are nice rube goldberg machines for shit languages like python which are hell to deploy.
when just installing everything from packages, things will receive timely security patches of the distribution.
when using VMs, one has to upgrade a few VMs for this. not great, not terrible.
with containers one has to hope that some image down the stack will be upgraded to include the fix, while the whole setup provides worse isolation than VMs (which already is prone to leakage). with containers the isolation is essentially the same as for plain linux users and chroot. no improvement. cgroups limiting resource usage can be set by the init system, i think systemd does this already.
containers sure have their use case, but mostly they are a crappy solution waiting for problems.
in the end the image is a meme which makes the point that ftp-ing a directory full of php scripts worked better than all the modern shit.
im running a proxmox server with 2 virtual machines (pfsense and docker).
my docker vm hosts these services:
openldap
nextcloud
peertube 1
peertube 2
mastodon
hedgedoc
gogs
excalidraw
elk_cluster
searx
lightning network daemon (testnet)
lightning network daemon (mainnet)
bitcoin fullnode
bitcoin mempool stats
wordpress
mailcow emailserver
your solution is to..what?
run everything in their own VM? -> ressource nightmare
run everything on one host (without container)? -> security nightmare
bro..you're retarded.
@mk @theorytoe
- vms can use dynamic allocation for years now.
- containers provide absolutely no additional security.
running on the host is perfectly fine. it only requires one to know what one is doing, of course.
lastly, i'd be careful to calling other people retard when using "bro".
"containers provide absolutely no additional security"
then it would be pretty easy for you to proof your statement? i'm waiting.
@mk @theorytoe
pretty easy, they can't be more safe than the technologies they are composed of. in practice they are more insecure because of the bullshit update mechanisms.
@mk @theorytoe sorry, the relevant articles aren't available in simple english :)
dann gibt mir die deutschen versionen
"in practice they are more insecure because of the bullshit update mechanisms."
your argument is bullshit.
90% of the webservices i run do maintain their own Dockerfile and/or docker images on hub.docker.com
peertube updated their development images 3hours ago.
"Last pushed 3 hours ago"
https://hub.docker.com/r/chocobozzz/peertube/tags
---
peertube uses the latest official debian image. they get updates as soon as new versions release.
@bonifartius @theorytoe
stop talking, start linking