The logging drivers reduce a major production pain point - standardized centralized logging that doesn't require modifying the underlying image.
Docker has a bad security reputation; this is one more step in the right direction.
Docker has a bad security reputation; this is one more step in the right direction.
Other people were attempting to solve this problem too - https://registry.hub.docker.com/u/kiyoto/docker-fluentd/
Ecept for ulimit, there is literally NO security improvement in this release.
Logging merely gives you a visibility - right, you get hacked but at least it's not painful to look for information, but I would really rather prefer not to get hacked due to the existing insecurities...
Yes, outright prevention is important. Yet proper centralized log collection and intelligence helps with all three missions, including prevention.
Proper logging allows you to identify known-good behavior patterns and outlying anomalies. With profiles in place, one can automate blocking of reconnaissance and probes, not just blocking known vulnerabilities.