Hacker News Reader

Comment by KaiserPro | Hacker News Reader

And a massive pain for security.

Assuming you are arguing in favour of VMs, the benefits of Docker stand, and you can perfectly run Docker containers within a VMs.

The feature sets/usage sweet points of OS-level package managers, language-specific package managers, VMs, containers, distinct/same hosts, ... are both overlapping and different enough that you need judgement to choose which one you want, but they are certainly not exclusive.

If your use case means you prefer VMs over containers and you don't need to combine them, fine, but every situation is different.

There are valid concerns.

Someone with access to the docker control socket effectively has root on your machine: e.g. `docker run -v /etc:/external_etc ubuntu visudo -f /external_etc/sudoers`.

Don't let untrusted users (or scripts) run docker.

Which is exactly what the Docker docs say: "First of all, only trusted users should be allowed to control your Docker daemon."

http://docs.docker.io/articles/security/#docker-daemon-attac...

This is a good point but applies to other tech that seeks some of the same ends. And if an attack is penetrated that deep then you would be screwed anyway. What's nice from a security perspective is Docker actually lowers the attack surface and shrinks the access that any potential outside attack can have.

Depends on the use cases.

Your sweeping statement applies to a minority of them.

Reply on news.ycombinator.com