[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kde-community
Subject:    Re: Discourse
From:       Michael Reeves <reeves.87 () gmail ! com>
Date:       2018-10-30 13:43:19
Message-ID: CANp6eRnRTVQWRENWuUoSRdijQ208SeiDptE+6k1aQqgg=7aGEw () mail ! gmail ! com
[Download RAW message or body]

On Tue, Oct 30, 2018, 6:50 AM Paul Adams <paul.adams@kde.org> wrote:

> On Tue, 30 Oct 2018 at 11:42, Ben Cooksley <bcooksley@kde.org> wrote:
> > If you're running 10,000+ microservice instances, then you can have
> > the teams of people needed to maintain the necessary overhead
>
> This is true. Also not your original point: you claimed that Docker
> containers were generally unsuitable for production
> The overhead is generally not that huge: you build, sign and upload
> your images to registry you run. This is no different than when you
> build, sign and upload your custom-built distro packages.
>
> Yes, running something like Openstack cause some additional overhead.
>
> > We delegate management of sites to people who look after them (where
> > it makes sense) as it helps people get things done.
> > They are essentially the "admin" of that specific site/service, but
> > won't have root on the actual server that runs it.
>
> Good approach. It is by no means incompatible with running services in
> a container.
> You can give specific system users membership of a docker group,
> allowing them to start/stop/deploy etc. You then control which
> containers the user is actually allowed to manipulate in registry
> config.
>
> Perhaps I am missing something?
>

Care would have to taken to insure such users can only use specific pre
defined option sets. Otherwise the ability to run docker is equivalent to
root access to the real file system via. --mount or --volumes. Probably
other routes as well. Not hard to mitigate with the right setup.

>
> --
> Paul J. Adams
>   PhD MIEEE MBCS CITP
>
> GPG: 07DD 0812 Paul James Adams
>

[Attachment #3 (text/html)]

<div dir="auto"><div><br><br><div class="gmail_quote"><div dir="ltr">On Tue, Oct 30, \
2018, 6:50 AM Paul Adams &lt;<a href="mailto:paul.adams@kde.org" target="_blank" \
rel="noreferrer">paul.adams@kde.org</a>&gt; wrote:<br></div><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex">On Tue, 30 Oct 2018 at 11:42, Ben Cooksley &lt;<a \
href="mailto:bcooksley@kde.org" rel="noreferrer noreferrer" \
target="_blank">bcooksley@kde.org</a>&gt; wrote:<br> &gt; If you&#39;re running \
10,000+ microservice instances, then you can have<br> &gt; the teams of people needed \
to maintain the necessary overhead<br> <br>
This is true. Also not your original point: you claimed that Docker<br>
containers were generally unsuitable for production<br>
The overhead is generally not that huge: you build, sign and upload<br>
your images to registry you run. This is no different than when you<br>
build, sign and upload your custom-built distro packages.<br>
<br>
Yes, running something like Openstack cause some additional overhead.<br>
<br>
&gt; We delegate management of sites to people who look after them (where<br>
&gt; it makes sense) as it helps people get things done.<br>
&gt; They are essentially the &quot;admin&quot; of that specific site/service, \
but<br> &gt; won&#39;t have root on the actual server that runs it.<br>
<br>
Good approach. It is by no means incompatible with running services in<br>
a container.<br>
You can give specific system users membership of a docker group,<br>
allowing them to start/stop/deploy etc. You then control which<br>
containers the user is actually allowed to manipulate in registry<br>
config.<br>
<br>
Perhaps I am missing something?<br></blockquote></div></div><div \
dir="auto"><br></div><div dir="auto">Care would have to taken to insure such users \
can only use specific pre defined option sets. Otherwise the ability to run docker is \
equivalent to root access to the real file system via. --mount or --volumes. Probably \
other routes as well. Not hard to mitigate with the right setup.</div><div \
dir="auto"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 \
0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <br>
-- <br>
Paul J. Adams<br>
   PhD MIEEE MBCS CITP<br>
<br>
GPG: 07DD 0812 Paul James Adams<br>
</blockquote></div></div></div>



[prev in list] [next in list] [prev in thread] [next in thread]