Hacker News Reader

Comment by BossingAround | Hacker News Reader

At this point, it seems simpler to run OpenShift, which is essentially Kubernetes + extra stuff you don't have to use + nicer console. If you go with Red Hat, you get a number of benefits, such as not being affected by the recent 'Doomsday bug' in docker that wasn't really that doomsday-ish.

Does Google actually support self-hosted Kubernetes?

View on HN

How are you not affected?

https://access.redhat.com/security/vulnerabilities/runcescap...

Check out [1], more specifically: "For many Red Hat end users, it’s unlikely that this flaw gets that far. IT organizations using Red Hat Enterprise Linux to underpin their Linux container and cloud-native deployments are likely protected, thanks to SELinux."

[1] https://www.redhat.com/en/blog/it-starts-linux-how-red-hat-h...

SELinux exists in other distros.

It does, but is it a first-class citizen as it is in RHEL and CentOS? Also OpenShift is finely tuned to run with SELinux. This is something you would have to do yourself on another platform with, say, Kubernetes and SELinux.

I was just saying that instead of all the hassle of going into production with self-supported, on-prem Kubernetes on top of some new-ish distro, the sane way seems to go with Red Hat's Kubernetes on top of a battle-tested distro with extra security features that is all supported.

If you want to run your prod workloads on self-supported Kubernetes with SELinux and similar features yourself, sure you could do that. Is that sane? I'll leave that as an exercise for the reader. What do I know, maybe it is.

Because "This vulnerability is mitigated on Red Hat Enterprise Linux 7 if SELinux is in enforcing mode." Which is the default when you install OpenShift - opposed to a gazillion of server software packages that advise you to deactivate SELinux.

They're going to, it's in private beta apparently https://cloud.google.com/gke-on-prem/

Reply on news.ycombinator.com