[ale] [barely OT] Containerization

[Jeff Hubbs]

OK, everyone -

I've seen a lot of talk about Docker go by. I am needing to look at
engineering some "distributed modular containerization" of apps and
perhaps whole OS instances. I just had a situation develop on the job
where a MongoDB instance needed to be available for casual use (i.e.,
for education purposes) on Windows laptops. I was able to generate a
tiny Linux VM to do that; set up for use in VirtualBox using a host-only
adapter, the instance was nice and contained (by default MongoDB goes in
with no authentication set up at all - it's just *there*). But
trafficking in whole VMs seems like a lot of weight to throw around,
even though I managed to get this particular VM's export file down to 1
gig, There are also lots of guardrails to smack into, like the limited
size of the virtual disk, and other things like making sure the "guest
addition" daemon that makes sure the clock stays synced and so forth
that I would just as soon not have to deal with.

What I envision is something where MongoDB lives in one container and,
say, another container with RStudio with all the needed packages,
extensions, etc. and yet another with such-and-such Python version and
all its intended packages preloaded can be flown into a relatively
unmodified OS instance (assume Windows or OS X) and networked together
so that the apps in the containers can see each other; perhaps just one
needs to be able to reach out to the host machine's network or possibly
other machines on the host machine's network needs to able to see one or
more of the containers. Is Docker a fit for what I'm thinking of, or
would something else be, or do I need to modify my thinking?

- Jeff

_______________________________________________
Ale mailing list
***@ale.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

[DJ-Pfulio]

Think services for a container. MongoDB is good. MongoDB with any GUI tool
inside the container is bad.

Have you looked at vagrant for virtualbox automation?

Or just have a development server farm that devs remote into for GUI work.
Deployed that for a very large customer years ago.

I looked up RStudio - it can be controlled by a web browser interface. I'd use
that. "in a browser connected to RStudio Server"
https://www.rstudio.com/products/RStudio/#Server

On 10/20/2017 04:27 PM, Jeff Hubbs wrote:
> OK, everyone -
>
> I've seen a lot of talk about Docker go by. I am needing to look at engineering
> some "distributed modular containerization" of apps and perhaps whole OS
> instances. I just had a situation develop on the job where a MongoDB instance
> needed to be available for casual use (i.e., for education purposes) on Windows
> laptops. I was able to generate a tiny Linux VM to do that; set up for use in
> VirtualBox using a host-only adapter, the instance was nice and contained (by
> default MongoDB goes in with no authentication set up at all - it's just
> *there*). But trafficking in whole VMs seems like a lot of weight to throw
> around, even though I managed to get this particular VM's export file down to 1
> gig, There are also lots of guardrails to smack into, like the limited size of
> the virtual disk, and other things like making sure the "guest addition" daemon
> that makes sure the clock stays synced and so forth that I would just as soon
> not have to deal with.
>
> What I envision is something where MongoDB lives in one container and, say,
> another container with RStudio with all the needed packages, extensions, etc.
> and yet another with such-and-such Python version and all its intended packages
> preloaded can be flown into a relatively unmodified OS instance (assume Windows
> or OS X) and networked together so that the apps in the containers can see each
> other; perhaps just one needs to be able to reach out to the host machine's
> network or possibly other machines on the host machine's network needs to able
> to see one or more of the containers. Is Docker a fit for what I'm thinking of,
> or would something else be, or do I need to modify my thinking?
>
> - Jeff
>
> _______________________________________________
> Ale mailing list
> ***@ale.org
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo

_______________________________________________
Ale mailing list
***@ale.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

[Michael H. Warfield]

On Sat, 2017-10-21 at 06:03 -0400, DJ-Pfulio wrote:
> Think services for a container. MongoDB is good. MongoDB with any
> GUI tool
> inside the container is bad.

No it's not. I use containers with NX remote desktops and GUI
connections there run like a top. Why is MongoDB with a GUI tool
inside of a container bad?

Mike

> Have you looked at vagrant for virtualbox automation?

> Or just have a development server farm that devs remote into for GUI
> work.
> Deployed that for a very large customer years ago.
>
> I looked up RStudio - it can be controlled by a web browser
> interface. I'd use
> that. "in a browser connected to RStudio Server"
> https://www.rstudio.com/products/RStudio/#Server
>
> On 10/20/2017 04:27 PM, Jeff Hubbs wrote:
> > OK, everyone -
> >
> > I've seen a lot of talk about Docker go by. I am needing to look at
> > engineering
> > some "distributed modular containerization" of apps and perhaps
> > whole OS
> > instances. I just had a situation develop on the job where a
> > MongoDB instance
> > needed to be available for casual use (i.e., for education
> > purposes) on Windows
> > laptops. I was able to generate a tiny Linux VM to do that; set up
> > for use in
> > VirtualBox using a host-only adapter, the instance was nice and
> > contained (by
> > default MongoDB goes in with no authentication set up at all - it's
> > just
> > *there*). But trafficking in whole VMs seems like a lot of weight
> > to throw
> > around, even though I managed to get this particular VM's export
> > file down to 1
> > gig, There are also lots of guardrails to smack into, like the
> > limited size of
> > the virtual disk, and other things like making sure the "guest
> > addition" daemon
> > that makes sure the clock stays synced and so forth that I would
> > just as soon
> > not have to deal with.
> >
> > What I envision is something where MongoDB lives in one container
> > and, say,
> > another container with RStudio with all the needed packages,
> > extensions, etc.
> > and yet another with such-and-such Python version and all its
> > intended packages
> > preloaded can be flown into a relatively unmodified OS instance
> > (assume Windows
> > or OS X) and networked together so that the apps in the containers
> > can see each
> > other; perhaps just one needs to be able to reach out to the host
> > machine's
> > network or possibly other machines on the host machine's network
> > needs to able
> > to see one or more of the containers. Is Docker a fit for what I'm
> > thinking of,
> > or would something else be, or do I need to modify my thinking?
> >
> > - Jeff
> >
> > _______________________________________________
> > Ale mailing list
> > ***@ale.org
> > http://mail.ale.org/mailman/listinfo/ale
> > See JOBS, ANNOUNCE and SCHOOLS lists at
> > http://mail.ale.org/mailman/listinfo
>
> _______________________________________________
> Ale mailing list
> ***@ale.org
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo
>
--
Michael H. Warfield (AI4NB) | (o) [phone] | ***@WittsEnd.com
/\/\|=mhw=|\/\/ | (c) [phone] | http://www.wittsend.com/mhw/
ARIN whois: ARIN-MHW9 | An optimist believes we live in the best of all
PGP Key: 0xC0EB9675674627FF | possible worlds. A pessimist is sure of it!

[DJ-Pfulio]

On 10/24/2017 10:03 AM, Michael H. Warfield wrote:
> On Sat, 2017-10-21 at 06:03 -0400, DJ-Pfulio wrote:
>> Think services for a container. MongoDB is good. MongoDB with any
>> GUI tool
>> inside the container is bad.
> No it's not. I use containers with NX remote desktops and GUI
> connections there run like a top. Why is MongoDB with a GUI tool
> inside of a container bad?

Been awhile since you posted. ...

Ok - "bad" is a little simplistic in the same way that saying "never do X"
really doesn't always, 100.0000%, apply.

The terms "new" and "shiny" get the attention of humans more than perhaps they
should.

IMHO, container security is still a huge trap. Breaking out of a container to
the parent process/host happened all the time just last year. I have doubts
that container security has come THAT far in such a short time period.

I recall seeing where networking from 1 container could be access by another
container. Don't recall when or where or which specific container "type" had
that issue.

Containers have generally been pushed for the "cat video" people - those running
non-mission critical services with non-critical data just because the security
questions still remain.

As you know, claims about security mean nothing. Only time, which constant
attacks and surviving those attacked means anything. In 2015, I thought
container security needed until 2021 to get some real-world use and "shelf life"
before it would be ready for general use.

I do appreciate people who like/need to be on the bleeding edge of these things
taking the hit for the rest of us.

Lots of technologies have had great advertising that didn't pan out just a few
years later. I'm hopeful that containers prove to be fine for general purpose
use and certainly can see a use-case today for cat-video-like needs. I wouldn't
put my daily desktop into one or provide a remote desktop for someone needing
access to brokerage tools without hosting it in a well-understood, single
user-VM above it.

So for someone really new to containers, following the "best practice path"
traveled by others is (usually) a smart idea. That means limiting the container
to the single service it should provide. Not having generic dev and hacking
tools inside the container and most often, not having even ssh available.

For now.

I do like container-like solutions for single applications on a normal desktop
or inside a normal VM. Firejail is one of those. Flatpacks and other
all-inclusive package delivery solutions are others.

Linux container technology is changing very fast, so it is very possible that
the newest versions, leveraging the newest kernels, have solved every security
problem. I doubt it, but it could/may have already happened.

Didn't realize I'd written so much. sorry.
_______________________________________________
Ale mailing list
***@ale.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

[Steve Litt]

On Thu, 26 Oct 2017 17:05:32 -0400
DJ-Pfulio <***@jdpfu.com> wrote:

> On 10/24/2017 10:03 AM, Michael H. Warfield wrote:
> > On Sat, 2017-10-21 at 06:03 -0400, DJ-Pfulio wrote:
> >> Think services for a container. MongoDB is good. MongoDB with any
> >> GUI tool
> >> inside the container is bad.
> > No it's not. I use containers with NX remote desktops and GUI
> > connections there run like a top. Why is MongoDB with a GUI tool
> > inside of a container bad?
>
> Been awhile since you posted. ...
>
> Ok - "bad" is a little simplistic in the same way that saying "never
> do X" really doesn't always, 100.0000%, apply.
>
> The terms "new" and "shiny" get the attention of humans more than
> perhaps they should.

[snip]

>
> I do like container-like solutions for single applications on a
> normal desktop or inside a normal VM. Firejail is one of those.
> Flatpacks and other all-inclusive package delivery solutions are
> others.

Do you have an opinion on Vagrant, and if so, what is it?


SteveT

Steve Litt
October 2017 featured book: Rapid Learning for the 21st Century
http://www.troubleshooters.com/rl21
_______________________________________________
Ale mailing list
***@ale.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

[Putnam, James M.]

From: Steve Litt [***@troubleshooters.com]
Sent: Friday, October 27, 2017 1:55 AM

[big snip]

> Do you have an opinion on Vagrant, and if so, what is it?

While not to whom the question was addressed, this

https://news.ycombinator.com/item?id=15567063

coincidentally popped up on Y Combinator this
morning.

--
James M. Putnam
Visiting Professor of Computer Science

The air was soft, the stars so fine,
the promise of every cobbled alley so great,
that I thought I was in a dream.
_______________________________________________
Ale mailing list
***@ale.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo