Slashdot Mirror
New Hack Shrinks Docker Containers (www.iron.io)
destinyland writes: Promising "uber tiny Docker images for all the things," Iron.io has released a new library of base images for every major language optimized to be as small as possible by using only the required OS libraries and language dependencies. "By streamlining the cruft that is attached to the node images and installing only the essentials, they reduced the image from 644 MB to 29MB,"explains one technology reporter, noting this makes it quicker to download and distribute the image, and also more secure. "Less code/less programs in the container means less attack surface..." writes Travis Reeder, the co-founder of Iron.io, in a post on the company's blog. "Most people who start using Docker will use Docker's official repositories for their language of choice, but unfortunately if you use them, you'll end up with images the size of the Empire State Building..."
What are they talking about, and why do I care about the size of the container Levi's ships my Docker khakis in?
"National Security is the chief cause of national insecurity." - Celine's First Law
Wasn't a common library the entire point of Docker? Packaging the libs with the app, etc, to reduce dependence on the host OS?
It's a small thermal exhaust port, right below the main port.
>> Isn't the attack surface governed by the ports you open up on the Docker containers?
I believe they are talking about the ease with which someone could slip malware into a large container image vs. a small container image and have it go undetected.
iocage create -c
Congratulations, you've just (almost) caught up to decade old technology.
http://phk.freebsd.dk/pubs/san...
If these are so much better, why aren't they just the official repos?
-SaNo
Will it make using Docker any easier on OSX? Why o why does it need to install an Ubuntu VM guest and run Docker inside that??
It's worse than that. It's Docker on Ubuntu on OSX on Turtles all the way down.
Trolling is a art,
Their github lists Perl but not C++?????
Unless things have changed, Docker makes use of a feature of the Linux that allows creating processes that are in their own namespace. This feature requires the Linux kernel something that Mac OS X with its BSD kernel does not possess. It might be possible to do something analogous in a BSD kernel, but I don't know about it. Maybe someone else could comment on it?
That should be the new vulnerability metric. Womp rats.
"A new vulnerability was found in the D-Star app this week, rating at 3.8 womp rats. CEO Tarkin downplayed the severity of the vulnerability and promised the D-Star app will continue to enhance system stability without interference from any rogue squadrons of hackers."
I don't suffer from insanity, I enjoy every minute of it!
FreeBSD got jails some years ago for the same purpose, and IIRC that was one of the inspirations for the linux version. (Both inspired by containers in Solaris, and earlier iterations of the idea in other OSes).
Not that that matters on the MacOS side; the OS X kernel is a weird hybrid thing with a BSD kernel hanging off a Mach microkernel. The BSD parts aren't exactly a full and current FreeBSD, either; IIRC they grabbed a subset they found useful a bunch of years ago. At a guess the jail support didn't make it.
> "Less code/less programs in the container means less attack surface..."
*fewer
Disk space is incredibly cheap compared to the standard size of a docker image and your "attack surface" is going to be limited in a docker image anyway. Sure, your application loaded in your docker image might add to that surface, but that's going to happen if you use the big image or the small one. The only real reason to do this is so you can run docker images on smaller embedded devices where resources are limited (Not that I see much of that yet).
IMHO, this development is meaningless to me. Thanks for the disk space back, but I didn't really need it...
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Most people who start using Docker will use Docker's official repositories for their language of choice, but unfortunately if you use them, you'll end up with images the size of the Empire State Building...
What's that in Libraries of Congress?
"FreeBSD got jails some years ago for the same purpose, and IIRC that was one of the inspirations for the linux version. (Both inspired by containers in Solaris, and earlier iterations of the idea in other OSes)."
Actually, I believe Jails were first. In order:
1- UNIX chroot
2- FreeBSD jails
3- Solaris Zones
4- Linux Containers
Although you describe a common case, it's not the general one. In principle the size of a software attack surface is given by the amount of code which is reachable through an attack conduit like a network, not by the "width" of the conduit.
For example, a given network service could be bound to just one IP address or to two, but its attack surface would remain the same despite double the size of the attack conduit. Likewise, a given service could be available on only one port or on N ports, yet its attack surface would not change despite any increases in the size of the conduit through which it can be reached.
(The attack surface is primarily a function of the amount of externally reachable code because the number of exploitable weaknesses is relatively constant per unit of code. Making the same code reachable through a wider conduit does not generally change its set of exploitable weaknesses.)
This assumes that the same code is being exposed regardless of the number of different IP address or port bindings of course. If this is not true because different functionality is offered on different ports then of course the size of the attack surface is no longer invariant.
Your observation is accurate in practice because the special case of "one port per service" is a very common one. It's worth recognizing that the general case is different though.
"The question of whether machines can think is no more interesting than [] whether submarines can swim" - Dijkstra
The best part is you get the same compression ratio improvement at each stage.
Inheritance is the sincerest form of nepotism.
So at this rate, Hurd which is also "hanging off a Mach microkernel" is more likely to have native Docker supporter before OS X. :)
As far as I figured out, they use a very stripped down Linux distro called Alpine Linux as the base and then build a Docker image on top of that. How is this a hack? This just means you are now running Alpine Linux in your containers instead of your distro of choice which nobody really wants.
Why the heck did you name them butt kernels?
Yeah, except that FreeBSD has had 'jails' for over a decade, which are far more secure than anything Docker brings to bear.
Linux has had jails for over a decade. I image that FreeBSD actually goes back further than that.
Docker has jails plus virtual networks plus various other isolation mechanisms, so I cannot credit your assertion that a jail-only mechanism is more secure.
https://www.youtube.com/watch?...
"Linux has had jails for over a decade. I image that FreeBSD actually goes back further than that."
Yep, jails appeared in FreeBSD 4.0-RELEASE around 1999-2000 if I recall correctly.
"Docker has jails plus virtual networks plus various other isolation mechanisms, so I cannot credit your assertion that a jail-only mechanism is more secure."
To be fair, FreeBSD also has virtual networks so each jail can also run a complete virtualized network.
As for a comparison in security, I'm unable to make an informed comment.
Too lazy to read their FAQ?
" Why the name?
If you look up "rump" in a dictionary, you'll find a definition which involves the group that is left over after a portion of the contents of a larger group have been removed -- the classic example is a rump parliament. The attribute "rump" therefore establishes the relationship between just a kernel and a rump kernel."
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Cool story, but why did they name them butt kernels? There isn't anyone who hears "rump" and thinks "ah yes; the smaller portion left behind after the majority has been removed."
I read this yesterday and I found it slightly annoying in the tone. Alpine has been around for awhile, and I don't think anyone using docker for more than experimentation will be happy with massive Ubuntu based images. But would you really use these minimal images packaged by an unknown entity when you can make your own with one line in the dockerfile?
Because it makes heavy use of features inside the Linux kernel which isolate applications from the rest of the operating system. To make Docker work on OSX, you'd have to modify the OS kernel to dramatically change the way it handles system calls and application spaces. Essentially, it groups processes together as if they're running on different kernels, but runs them all in the same kernel.
Run a docker container that only runs the command 'ps -e' and it will tell you 'ps' is PID 1. The nginx container has nginx as pid 1, and 'kill -9 1' kills nginx; if you do 'ps -e' on the host, it tells you nginx is process 3719, and killing that process ends the same program. This is not standard behavior.
Support my political activism on Patreon.
You can run Docker on FreeBSD thanks to the 64-bit Linux compatibility layer that was added last year.
FreeBSD Jails and Linux Containers are really different beasts. Jails are great if security is your primary consideration. Hence the name: Jails effectively isolate processes and go to great lengths to prevent them from accessing anything outside the jail. Containers use separate kernel namespaces to give groups of processes separate views of kernel global variables. Security (especially with user namespaces) is a bonus, but the primary goal is efficient os-level virtualization and isolation of resources. A more apt comparison is with the BSD VPS project rather than Jails.
At a guess the jail support didn't make it.
Correct. XNU does not have support for Jails, and it likely won't because it requires some pretty severe changes to kernel data structures to make them work.