Hacker News new | past | comments | ask | show | jobs | submit login

I'm sorry, if you cannot see the benefits to running programs inside a container, then you have been reading the wrong article. I have been using FreeBSD jails for years, and now on Linux deployments, docker as well.

Lets say you have a server, it runs a mail server, database server, web server (proxy) and application server.

If they all run without containers, if one service gets compromised, and a root exploit is found, that's it game over.

If you have a service that starts eating up memory, with proper configuration, it can't overload the root server. Basically each jail/container can only see itself and any exploits cannot effect the host system, or other jails/containers (when configured correctly).

It also allows for easy expansion, when one jailed/containered service gets to large for the server, just move it to another server easily and quickly.

It also allows for speedy deployment, with docker you can bundle everything on your laptop, create an image, then ship this straight to an external host like EC2/Goole Cloud (for example), with the addition of pre built containers for Django/Rails/Postgres/MySQL etc, it creates a ready working environment for developers who might not be to hot on configuring systems. The "shipping" ability to docker is a by product of the container which is another added benefit. There are loads more features than what I have stated here, this is just a very brief summary.




If they all run without containers, if one service gets compromised, and a root exploit is found, that's it game over.

To be fair, if a kernel-level root exploit is found, it's probably also game over for containers. It's possible to have root exploits that cannot escape containers due to UID virtualization or whatever, but typically(?) root exploits are based on being able to mess with kernel memory, in which case escaping a container should also be possible.


> if one service gets compromised, and a root exploit is found, that's it game over.

For root exploits isn't Docker toast as well? I haven't followed Docker in much details, but does Docker actually promise that commands run as root will be contained?


There is a certain level of isolation for root even inside containers, but in the case of a privilege escalation exploit you would most probably achieve "real" root even if inside a container.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: