Hacker News Reader

Comment by verdverm | Hacker News Reader

How do you view all the VMs in a project across the globe at the same time?

Do you need to manage keys when ssh'n into a VM?

Do you know what the purpose of all the products are? If you don't know one, are you able to at least have an idea what it's for without going to documentation?

The have also directly opposed many efforts for Kubernetes, even to their own customers, until they realized they couldn't win. Only then did they cave, and they are really doing the bare minimum. The most significant contribution to OSS they have made was a big middle finger to Elastic search...

View on HN

Of course everyone's experience is different, but in my case...

> How do you view all the VMs in a project across the globe at the same time?

I'm not sure what it's got to do with k8s? I can't see jobs that belong to different k8s clusters at the same time, either.

> Do you need to manage keys when ssh'n into a VM?

Well, in k8s everybody who has access to the cluster can "ssh" into each pod as root and do whatever they want, or at least that's how I've seen it, but I'm not sure it's an improvement.

> Do you know what the purpose of all the products are? If you don't know one, are you able to at least have an idea what it's for without going to documentation?

Man, if I got a dime every time someone asked "Does anyone know who owns this kubernetes job?", I'll have... hmm maybe a dollar or two...

Of course k8s can be properly managed, but IMHO, whether it is properly managed is orthogonal to whether it's k8s or vanilla AWS.

Beleive they were referring to AWS not k8

If you're running pods as root, you're doing it wrong. That was a no-no with docker, and it's still a no-no for kubernetes. People still run non-containerized services as root too...

This is getting off-topic, but I didn't understand the rationale behind that. Processes running inside docker/k8s are already isolated, so unless you're running something potentially malicious, why would it matter if it's root or not?

(Of course, if you're running untrusted user code, then you'll need every protection you can muster, but I'm talking about running an internally developed application. If you can't trust that, you already have a bigger problem.)

If the container is running as root, and you escape the container, you are root on the host.

Containers share the kernel with the host, and are only as isolated as the uid the process in the container runs as and the privileges you grant that container.

He doesn't seem to understand the new landscape well enough to make his comparisons.

The point about AWS was not a Kubernetes comparison. It was a GCP one, because you asked what was wrong with the God aweful AWS

Docker won't run on my local machine as non root. And all the stuff I have seen so far has been run as root.

Reply on news.ycombinator.com