Hacker News Reader

Comment by dec0dedab0de | Hacker News Reader

It becomes a pain point when the IT team never heard of docker, all new licenses need to be approved by the legal department, and your manager is afraid to ask for any extra budget.

Also, I don't want to have to troubleshoot why the docker daemon isn't running every time I need it

View on HN

I'll see your "IT team never heard of docker" and raise you "security want to ban local containers because they allow uncontrolled binaries onto corporate hardware.". But that's not something podman solves...

Every single developer is running 'uncontrolled source code' on corporate hardware every single day.

The defence isn't against malicious developers writing evil code, but some random third party container launched via a curl | bash which mounts ~/ into it and posts all your ssh keys to some server in china... Or whatever.

Or so I was told when I made the monumental mistake of trying to fight such a policy once.

So now we just have a don't ask don't tell kind of gig going on.

I don't really know what the solution is, but dev laptops are goldmines for haxxors, and locking them down stops them from really being dev machines. shrug

> some random third party container launched via a curl | bash which mounts ~/ into it and posts all your ssh keys to some server in china

it's pretty stupid because the same curl | bash that could have done that could have just posted the same contents directly to the internet without the container. The best chance you actually have is to do as much development as possible inside a sealed environment like ... a container where at least you have some way to limit visibility of partially trusted code of your file system.

And this is regarded as an existential problem which cannot be permitted to persist by some in the security space.

It becomes a pain point when the IT team never heard of docker

Or when your IT department is prohibited from purchasing anything that doesn't come from Microsoft or CDW.

I have personally given up trying to get a $25 product purchased through official channels. The process can make everything painful.

Congrats, the process fulfilled it's purpose. Another small cost saved :)

Trust me, the thought crossed my mind. They definitely beat me.

It can be easier to spend £100K than £100.

>It becomes a pain point when the IT team never heard of docker

Where do you work ? Is that even possible in 2025?

Apparently they work in the past...

'corp IT' in a huge org typically all outsourced MCSEs who are seemingly ignorant of every piece of technology outside of azure.

Or so it seems to me whenever I have to deal with them. We ended up with Microsoft defender on our corp Macs even.. :|

Its absolutely possible. Weve also had them unaware of github, and had them label Amazon S3 as a risk since it specifically wasn't Microsoft.

There is no bottom to the barrel, and incompetence and insensitivity can rise quite high in some cases.

I work at a cool place now that is well aware of it, but in 2023 I worked at a very large insurance company with over a thousand people in IT. Some of the gatekeepers were not aware of docker. Luckily another team had set up Openshift, but then the approval process for using it was a nightmare.

Reply on news.ycombinator.com