<div dir="ltr">Thanks Eric for the detailed explanation, clear. Will check more for related links, thanks!<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">2014-08-19 7:09 GMT+08:00 Eric Windisch <span dir="ltr"><<a href="mailto:ewindisch@docker.com" target="_blank">ewindisch@docker.com</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">
<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote"><div>On Mon, Aug 18, 2014 at 8:49 AM, Jyoti Ranjan <span dir="ltr"><<a href="mailto:jranjan@gmail.com" target="_blank">jranjan@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">I believe that everything can not go as a dock container. For e.g. <div>
<br></div><div>
1. compute nodes</div>
<div>2. baremetal provisioning</div><div>3. L3 router etc</div></div></blockquote><div><br></div></div><div>Containers are a good solution for all of the above, for some value of container. There is some terminology overloading here, however.</div>
</div></div></div></blockquote></div><div><br>Hi Eric, one more question, not quite understand what you mean for "Containers are a good solution for all of the above", you mean docker container can manage all of three above? How? Can you please show more details? Thanks!</div>
</div></div></div></blockquote><div><br></div></div><div>I'm not sure this is the right forum for a nuanced explanation of every use-case and every available option, but I can give some examples. Keep in mind, again, that even in absence of security constraints offered by Docker, that Docker provides imaging facilities and server management solutions that are highly useful. For instance, there are use-cases of Docker that might leverage it simply for attestation or runtime artifact management.</div>
<div><br></div><div>First, one could in the case of an L3 router or baremetal provisioning where host networking is required, one might specify 'docker run -net host' to allow the process(es) running inside of the container to operate as if running on the host, but only as it pertains to networking. Essentially, it would "uncontain" the networking aspect of the process(es).</div>
<div><br></div><div>As of Docker 1.2, to be released this week, one may also specify "docker run --cap-add" to provide granular control of the addition of Linux capabilities that might be needed by processes (see <a href="http://linux.die.net/man/7/capabilities" target="_blank">http://linux.die.net/man/7/capabilities</a>). This allows granular loosing of restrictions which might allow container-breakout, without fully opening the gates. From a security perspective, I'd rather provide some restrictions than none at all.</div>
</div><div class="gmail_extra"><br></div>On compute nodes, it should be possible to run qemu/kvm inside of a container. The nova-compute program does many things on a host and it may be difficult to provide a simplified set of restrictions for it without running a privileged container (or one with many --cap-add statements, --net host, etc). Again, while containment might be minimized, the deployment facilities of Docker are still very useful. That said, all of the really "interesting" things done by Nova that require privileges are done by rootwrap... a rootwrap which leveraged Docker would make containerization of Nova more meaningful and would be a boon for Nova security overall.<span class="HOEnZb"><font color="#888888"><br clear="all">
<div><br></div>-- <br><div dir="ltr">Regards,<div>Eric Windisch</div></div>
</font></span></div></div>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br><div dir="ltr"><div>Thanks,<br><br></div>Jay<br></div>
</div>