<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Sep 18, 2017, at 9:39 AM, DJ-Pfulio <<a href="mailto:DJPfulio@jdpfu.com" class="">DJPfulio@jdpfu.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Jerald, I bet a presentation on your docker deployment techniques would<br class="">have a full house of interested ALEer.<br class=""> Oct or Nov meetings need a topic. ;)<br class=""><br class=""></div></div></blockquote><div><br class=""></div><div>Unfortunately, I can share with you guys in a semi-private forum. I cannot share publicly nor can I speak publicly. </div><div><br class=""></div><div>I’ve got the lawyers working on my approval just to present on Puppet at a local users group without my employer’s name attached. It’s a nightmare.</div><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class="">On 09/18/2017 09:18 AM, Jerald Sheets wrote:<br class=""><blockquote type="cite" class=""><br class="">FUD doesn’t play well here, and this smacks of FUD to me. <br class=""></blockquote><br class="">Some things require time to be proven. Old guys have learned that hype<br class="">is seldom true. We've been burned before. Things need time to mature<br class="">if you don't want to be bleeding edge, spinning with constant updates.</div></div></blockquote><blockquote type="cite" class=""><div class=""><div class=""><br class="">When I was 25, bleeding edge seemed like the best place. Around 45 ...<br class="">not so much. We had systems that worked, where predictable, and met the<br class="">requirements better than previously deployed stuff.<br class=""><br class=""></div></div></blockquote><div><br class=""></div><div>I’m 50. I’ve been doing this since CP/M was my primary desktop and Vax/VMS was my playground. I’m not new to this.</div><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div class="">From the outside, there are some technologies that have great hype and<br class="">may prove to be great - someday - after they mature a little.<br class=""><br class="">Remember when openstack was all the rage? How many years did it take to<br class="">NOT need a fork-lift upgrade between versions?<br class=""></div></div></blockquote><div><br class=""></div><div>I implemented that for AMEX. They did upgrades atomically over time. Not an issue. The problem was that no one at OpenStack (whoever the heck’s implementation you chose) could tell you the proper foundation for a smooth architecture. If you happened to stumble over it, good on you. We didn’t until we had someone who <i class="">had </i>show us what to do. Everything there forward was cake.</div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class="">Docker/Containers seem very useful, but it wasn't that long ago that<br class="">root escalation break-outs were being found every few months, regardless<br class="">of the claims from the container people. I think the docker container<br class="">format has "won the war", but the requirement for docker to run as root<br class="">on the docker-host is still troubling. Just a little more maturity is<br class="">needed.<br class=""><br class=""></div></div></blockquote><div><br class=""></div><div><br class=""></div><div>Eh?</div><div><br class=""></div><div>containerd definitely runs as root (like Apache, NginX, et al.) because daemon. However, root is not needed to work with the container. I just had this grippiest with a guy internally here. Everything was done post-install by just adding individual users to the docker group. No sudo necessary, and no root access required. After all, if daemon control is the only thing requiring root interaction (by the sysadmin), I don’t see a problem there.</div><div><br class=""></div><div>Second, the people who were ding root escalations had intimate knowledge of cgroups. Once the vendors realized they couldn’t get away with “we’ll just leave that for now to make a ship date” any more, things started to clean up nicely.</div><div><br class=""></div><div>There are also several security methodologies out there… we’ve built our own proprietary ones involving chrooting, zoned access, ingress/egress rules, and quite a bit of tomfoolery, honestly, but the product is mostly secure OOTB and is securable with an easily automatable process. Time to secure? About one Puppet run.</div><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div class="">Is that FUD?<br class=""><br class="">And for about 6 videos from Redhat reps for container best practices,<br class="">look on youtube for the SELF 2016 conference. Some more details provided<br class="">beyond what Jerald is saying here with a little more depth in those.<br class=""></div></div></blockquote></div><br class=""><div class=""><br class=""></div><div class="">That’s good fodder there, but always remember that those guys are extremely myopic in their views, statements, and architectures. YMMV when trying to apply the principles to a self-rolled environment.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">—jms</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>