Hacker News Reader

Comment by Nux | Hacker News Reader

Indeed. I'm still holding off, in the hope it will go away (like Openstack), but it does seem like it has some more stamina as a project.

View on HN

OpenStack didn't go away for large users who need to run IaaS/*aaS. OpenStack codebase is/was a giant, warm pile, but honestly k8s isn't all that either. I've heard and seen tons of k8s horror stories, I won't touch it. Give me Xen/KVM/ESXi to chop up a large box into a virtual lab and then Docker inside that on a custom Docker VM. These giant, support everything (poorly) "solutions" aren't all that helpful.

The problem of hype is that it's usually to evangelize marginal projects while better ones march along in obscurity.

Kubernetes is a nice choice for specific usecases (like, well, battle-tested container orchestrating & scheduling), but overhyping it with references like "Kubernetes is a data center operating system" is absolute mess, IMO. You can't put everything in Kubernetes.

And it's also applies to OpenStack which is more than alive. While its ecosystem consists of horde of different solutions, plain nova/neutron/cinder are matured and efficient solutions to roll your own private IaaS.

Sticking to Docker for local projects for now

No thanks. It's a huge security dumpster fire as well.

Well if you're uncomfortable with its priviged daemon, you can always switch to CRI-O with Red Hat tooling for it. But for all my years with Docker as the container runtime, all security related problems have occured within the backend code, not Docker, not Linux cgroups, not Linux itself.

I've worked with some big customers in the financial industry, and this is exactly what we do. Podman implements the same CLI as docker, so you can basically just `s/docker/podman/g` (as long as you don't use docker-compose).

It's also a lot easier to debug and see what's happening without that daemon sitting in the middle of all the traditional linux tools.

Could you elaborate please and what approach do you recommend?

containers in general are horrible wrt security because they are architecturally flawed - they pretend to have some sort of 'isolation' but that was crap docker marketing people just made up - there is no isolation - k8s pushes this agenda further by declaring that multi-tenant workloads are perfectly normal and ok for containers which they absolutely are not

just look at the CVEs from recent years:

* docker doomsday * escaping like a rkt * cryptojacking? - that didn't even exist until containers were here!

Reply on news.ycombinator.com