<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>To the best of my knowledge, this IS best practices. <br>
</p>
<p><br>
</p>
<p>Damon<br>
</p>
<br>
<div class="moz-cite-prefix">On 01/08/2018 12:38 PM, Jerald Sheets
via Ale wrote:<br>
</div>
<blockquote type="cite"
cite="mid:6889C3D3-607A-4E68-8AF9-BB8D06FBC740@gmail.com">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div class="">You solve this by only allowing an internal “hub”
where you place “blessed” container images. Done.</div>
<div class=""><br class="">
</div>
<div class="">We blackhole docker hub internally, and there is no
ingress to serving nodes from the outside. In short, if you
want something inside, it has to go through a vetting process,
and then I have to put it onto the internal hub. Outside of
that, nothing goes on a serving node that isn’t explicitly
blessed on an almost file-by-file basis.</div>
<div class=""><br class="">
</div>
<div class="">Docker is and can be secure. The problem is that
most Systems folks are too lazy to build the infrastructure to
make it so.</div>
<div class=""><br class="">
</div>
<div class="">—j</div>
<div class=""><br class="">
</div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Jan 8, 2018, at 12:05 PM, Jim Kinney via Ale
<<a href="mailto:ale@ale.org" class=""
moz-do-not-send="true">ale@ale.org</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">Devs LOVE containers. SysAdmins hate them.
They are difficult to manage for updates (toss and
rebuild) and most devs pull latest-greatest libs even
though they are all right from git repo and not checked
for problems. None of the security checks that exist for
vm control work for containers and they leak like screen
door on a submarine. <br class="">
<br class="">
Good for development. Should be barred from production
use.<br class="">
<br class="">
<div class="gmail_quote">On January 8, 2018 11:34:07 AM
EST, DJ-Pfulio via Ale <<a href="mailto:ale@ale.org"
class="" moz-do-not-send="true">ale@ale.org</a>>
wrote:
<blockquote class="gmail_quote" style="margin: 0pt 0pt
0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204);
padding-left: 1ex;">
<pre class="k9mail">From the article, seems most enterprises still use VMs and real hardware
for their production loads. Containers are mostly used for development
needs, not production.
<a href="https://www.theregister.co.uk/2018/01/08/container_shock_not_everybody_is_doing_it/" class="" moz-do-not-send="true">https://www.theregister.co.uk/2018/01/08/container_shock_not_everybody_is_doing_it/</a>
<hr class="">
Ale mailing list
<a href="mailto:Ale@ale.org" class="" moz-do-not-send="true">Ale@ale.org</a>
<a href="http://mail.ale.org/mailman/listinfo/ale" class="" moz-do-not-send="true">http://mail.ale.org/mailman/listinfo/ale</a>
See JOBS, ANNOUNCE and SCHOOLS lists at
<a href="http://mail.ale.org/mailman/listinfo" class="" moz-do-not-send="true">http://mail.ale.org/mailman/listinfo</a>
</pre>
</blockquote>
</div>
<br class="">
-- <br class="">
Sent from my Android device with K-9 Mail. All tyopes are
thumb related and reflect authenticity.</div>
_______________________________________________<br class="">
Ale mailing list<br class="">
<a href="mailto:Ale@ale.org" class="" moz-do-not-send="true">Ale@ale.org</a><br
class="">
<a class="moz-txt-link-freetext" href="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</a><br class="">
See JOBS, ANNOUNCE and SCHOOLS lists at<br class="">
<a class="moz-txt-link-freetext" href="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</a><br class="">
</div>
</blockquote>
</div>
<br class="">
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Ale mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Ale@ale.org">Ale@ale.org</a>
<a class="moz-txt-link-freetext" href="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</a>
See JOBS, ANNOUNCE and SCHOOLS lists at
<a class="moz-txt-link-freetext" href="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</a>
</pre>
</blockquote>
<br>
</body>
</html>