Hacker News Reader

Comment by lima | Hacker News Reader

This makes me feel good about going with CentOS for Docker. Red Hat has a custom, stable Docker version which is rock-solid (albeit somewhat old, 1.10).

View on HN

Center for Internet Security Docker Benchmark, rule 1.5: Keep Docker up to date [1]

[1] https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1...

"Keep a tab on these product updates and upgrade as frequently as when new security vulnerabilities are fixed."

https://www.docker.com/docker-cve-database

Backports. I saw Docker break more than once after supposedly stable releases with security fixes.

Do not use Docker distributed by Red Hat, full stop. It has been irresponsibly patched to be insecure. They disable important seccomp filters.

Instead, install using instructions here: https://docs.docker.com/engine/installation/linux/centos/#/i...

Depending on your use case, that may not be such a great idea. Unless Red Hat have back-ported it, 1.10 misses several important security advances that have come into Docker in recent versions...

Redhat also has a lot of security features not in upstream docker due to docker, inc not accepting them:

Source: https://github.com/projectatomic/docker/tree/410e23a7eeb52d4...

That seccomp patch reduces rather than increases security. None of the others, other than back ports, are security features.

Disabling the docker hub certainly is.

In what way? It changes a default, but it only changes namespaces, not security.

Red Hat has a vested interest in the failure of Docker. So... It's up to you if you want to continue using (or trusting!) any "Docker" software released by Red Hat.

Somewhat old? That's basically ancient.

Technically runc and the Kernel are setting up/providing your containers. Docker Engine is a platform for managing containers/images.

docker-engine is the name of the package.

When going CS Docker Engine you also have the latest (CS) Engine: https://docs.docker.com/cs-engine/install/

docker - rock-solid - v1.10 there is something odd in that sentence.

Reply on news.ycombinator.com