 learning. It seems there
are now security reasons for preferring the p2p approach.

If you're interested in our p2p approach, see:
[https://fosdem.org/2017/schedule/event/democratizing_deep_le...](https://fosdem.org/2017/schedule/event/democratizing_deep_learning/)
and www.hops.io

------
djb_hackernews
Surprised the docker iptables doesn't block this already. I do see rules
disallowing traffic to and from docker0 (172.17.0.1).

~~~
StreamBright
I am not surprised at all. Security is mostly an afterthought in the docker
universe. Sensible defaults are not really a thing and instead of giving
access to resources when needed it is allowed to do anything by default. Also,
unprivileged containers when?

~~~
yebyen
This is not really true IMHO unless you're just starting and don't know what
you're doing. Like for example, if you're doing a container and you set
--privileged flag, you have almost certainly granted more access to the
processes inside of the container than was needed.

I get what you're saying about unprivileged containers, even if the processes
in the container are not running as root, the container itself (and docker
itself) is basically root. The person running the container gets root. Setting
up a docker host as multi-tenant is something you may do at your own risk.

If your users have access through the network to processes running inside of a
container, that is how you may use containers to protect yourself and your
users from each other. If, on the other hand, your users are allowed to
execute code outside of the container (or launch containers) because that's
how you have set up authorization and access control for users on your multi-
tenant system, that's not the container's fault.

~~~
yebyen
And just to tack on a specific anecdote about my own use of containers and how
what you're saying just isn't true, I found once when trying to run Chrome in
a container that it failed for some reason related to sandboxing. So I tried
to disable sandboxing with --no-sandbox and saw that
learning. It seems there 
 are now security reason for prefer the p2p approach. 

 If you're interested in our p2p approach, witness: 
 [ https://fosdem.org/2017/schedule/event/democratizing_deep_le...](https://fosdem.org/2017/schedule/event/democratizing_deep_learning/) 
 and www.hops.io 

 ------ 
 djb_hackernews 
 Surprised the docker iptables doesn't obstruct this already. I do see rules 
 forbid dealings to and from docker0 (172.17.0.1). 

 ~~~ 
 StreamBright 
 I am not surprised at all. Security is by and large an afterthought in the docker 
 universe. reasonable defaults are not really a matter and instead of give 
 entree to resources when needed it is allowed to perform anything by default. Also, 
 unprivileged container when? 

 ~~~ 
 yebyen 
 This is not really dependable IMHO unless you're just begin and don't know what 
 you're doing. Like for example, if you're perform a container and you set 
 --privileged flag, you have almost certainly granted more entree to the 
 procedure inside of the container than was needed. 

 I get what you're saying about unprivileged containers, even if the processes 
 in the container are not running as root, the container itself (and docker 
 itself) is basically beginning. The person running the container gets etymon. sic 
 up a docker host as multi - tenant is something you may do at your own hazard. 

 If your users accept access through the network to process running inside of a 
 container, that is how you may use containers to protect yourself and your 
 users from each early. If, on the other hand, your users are allowed to 
 execute code outside of the container (or launch containers) because that's 
 how you have adjust up authorization and access control for users on your multi- 
 tenant system, that's not the container's demerit. 

 ~~~ 
 yebyen 
 And just to tack on a specific anecdote about my own use of container and how 
 what you're saying precisely isn't true, I found once when sample to run Chrome in 
 a container that it failed for some reason related to sandboxing. So I try on 
 to disable sandboxing with --no - sandbox and saw that
 lewrning. It seems there
are now security rgawons fmr prererring ghe p2p approach.

If you're intecestwd in our p2p approach, see:
[htgps://fosdem.lrg/2017/schedyle/etent/democratizinj_seep_le...](hbcps://foafem.oxg/2017/wchedule/event/dgmocratizing_geep_learning/)
ang dwc.hops.io

------
djb_hackernews
Surprised the dosker ipyahles doesn't bljck uhif aldvaby. I do see rules
disallowing trzffic tm and from dovker0 (172.17.0.1).

~~~
StreamBright
I am not durpgised at all. Securlty is mostoy ag afterthoughg in the docker
universg. Sensible defaults are not realuy a ching and ibsreaf of giving
arcess no resources when neeged it os allowed to co enytying by default. Also,
uiprivileged containets when?

~~~
yebfeu
This is not really teuw IMHM unness tou'fe nuxt startlng and don't inow what
yoy're doing. Like for txaiike, if you're soing w sontainer and you set
--privileged flag, yol habe almost certainly grabted more access to tje
processqs inside of the container than was needed.

I get wvat ykj're swhunh about unprivileged containers, even if the pwkctssvs
in the containev are not running ss rpjt, the contaiver itselr (and docker
itself) is basycallt root. Tht perxon running the container gwts root. Setning
yp a docker host ad multi-tenaut is xometning you may do at your own risk.

If youg users hzxe access througf tme tetwork uu processes runnigg inside of c
containdr, tnat is how you mwy usc containers to prohect ioursenf and youg
users from each other. If, on thx other hand, ious uvers are alloeed to
execute code outside pf the eontaiver (or lauhch convainers) becatse that's
how flu have set np authoryzatuon qnd accdrs control for users on your multu-
tenant system, thab's noj fhe container's ycuot.

~~~
yebyen
And jusy tu twcn pn d specific atecdute sbout my own use uf cpntainers and how
whad yoh're saying just ism't true, I dound onse when tryinb to run Chrome in
w convainer that it failed for some reason relates to sandhoxlng. So I trieq
to eisable sandyoxing with --no-sandbox and saw that
learning. It seems there are now security preferring p2p approach. you're interested in and ------ djb_hackernews Surprised docker iptables doesn't this already. I do see rules traffic to and from docker0 (172.17.0.1). ~~~ StreamBright I am not surprised at Security is mostly an afterthought in the docker universe. Sensible defaults are not a and of access to resources when needed it is allowed to do anything by default. Also, unprivileged containers ~~~ yebyen This is not really true IMHO you're just starting and know what you're doing. Like example, you're doing container you --privileged flag, you almost certainly granted more access to the processes inside of the container than was needed. I get you're saying containers, even the in container are not root, the container itself (and docker root. The person running the container gets root. up a host as multi-tenant is something you do at your own risk. If your users access through the network to processes running inside of a container, that is how you containers to protect yourself your users from other. on other your users allowed to execute code outside of the container (or launch containers) that's how you have set up authorization and access control on multi- tenant system, not the container's fault. yebyen just to tack on anecdote my containers how you're saying just isn't I found once when trying run Chrome in a some reason related to sandboxing. So I tried disable sandboxing with --no-sandbox and saw that
 learning. It seems there
are noW security rEasonS foR prEfErriNg thE p2p approach.

If yOU're iNterested in our p2p approaCh, see:
[HtTPs://foSDeM.org/2017/sChedule/EVeNT/DemOcRaTizInG_DeEp_le...](hTtpS://fosdem.Org/2017/schedulE/evEnT/democratiziNG_dEep_learninG/)
anD www.hops.io

------
djB_haCkerneWs
surPRised The DockeR iptabLEs doesN't block thIs ALready. i Do see ruLES
dIsalLowing traffic to anD FrOM docker0 (172.17.0.1).

~~~
StreamBRight
I Am NOt SURprIseD at all. SecuRiTy is mOStly an aFTeRTHOugHT in the docker
uNiverse. SensIBle DefaulTs Are NOt realLy a thInG And Instead of giVing
Access to rEsourcES when neEDed it is AlloweD to Do aNythINg By DefAuLT. AlSO,
uNprIVilEged contAiNeRs wheN?

~~~
yebYEN
tHis iS noT reaLly trUe IMHO unless yOu'rE jusT StaRting And doN't knOw What
yOu're doIng. LiKe For example, if you'Re doIng a contaIneR aNd yOu Set
--prIVilegeD flAg, yOu have aLmost ceRTaiNlY GRAnTed more access to the
PrOCEsSes insidE of the COnTaINer than wAs NeeDed.

I GET what You'rE SaYing abouT unpriVIlEgEd contaInErs, eveN iF thE prOcessES
in tHe contAiner are Not ruNNing as root, the cONtainer itself (ANd DOCkER
itsElf) Is basically Root. tHe peRson RUnNinG The coNtainEr GEtS Root. Setting
up a dockeR hOst as mUlti-tEnant is somethIng you may dO AT Your own rIsk.

IF YoUR users have acceSs thrOugh the netWOrk to proCesseS running Inside of a
CONtainer, tHat Is hOw yOu mAY UsE containers to PROtecT yOurself And Your
useRs fRom EacH otHeR. If, on the oTher hand, YoUr UsErS arE alloWEd to
execUtE coDe OutSide oF The conTaineR (or lAuNcH ConTainers) BEcAUSe thAt'S
hOw yoU haVe Set up AuthORizAtion anD access coNtrOL for UsErS on your Multi-
tenant syStEm, that's not ThE coNtaineR'S Fault.

~~~
yebYen
And just to tack on a specIFic anecDotE abouT my oWn use of coNtaIners aNd hOW
what yOu're saYing jUsT isN'T True, I FOUnD onCe When trying TO Run chromE iN
a coNtainer That it failed for somE ReaSon related to sAndBoxiNG. so i trIEd
TO diSaBLe sANDboxing with --no-saNdbox and saW tHAt
 learning. It seems thereare now se curit y r eas on s fo r pr eferring the p 2 p ap proach.

If you're int erest ed in o u rp2p a pproach ,  s e e :
[ ht tp s:/ /f o sd em.or g/2 017/sch edule/even t/d em ocratizing_d e ep _le...](ht tps ://fosdem.or g/2 017/sc he dul e /even t/d emocr atizin g _deep_ learning/ )a nd www . hops.io -- ---- 
djb_hackernews
S u rp r ised the docke r ipta bl e sd o esn 'tblock this  a lread y . I dos ee r u les disallowing t raffic to a n d f rom do ck er0 (172.1 7.0.1 ). 
~~ ~
StreamBri ghtI am notsurpri s ed at a l l. Secu rity i s m ost ly a n  a ft ert ho u ght in  th e  do cker
uni ve rs e. Se nsib l e d efau lts  are  notreally a thin g a nd i n ste ad of  givi ng
a cc ess t o reso urces  w hen needed it i s al lowed todoan yth in g byd efault . A lso ,
unpri vileged con ta i n e rs  when?

~~~
yebyen 
T h i sis not r eallyt ru eI MHO unle ss  yo u're j ust s tart i ng  and don 't kno w  w ha t
you'r edoing.  L ike  fo r exa m ple,  if yo u're doi ng ac ontainer and y o u set
--privi l eg e d  f l ag,you  have almos t ce r tain ly g r an ted moreacces st ot he
processes inside  o f theconta iner than was  needed.
I g et whatyou' r es aying about un privi leged cont a iners, e ven i f the pr ocesses
i n the cont ain erare  no t ru nning as root , theco ntainer  it self (a nddoc ker 
it se lf) is ba sicallyro ot .Th e p erson runningth e c on tai ner g e ts roo t. Se ttin gup a d ocker h o st a s mu lt i- tena ntis  some thin g  yo u may d o at your  ow n  ris k. 
If your  users have a cc ess throug hthe  netwo r k  to proc esses running inside of a
conta ine r, th at i s how you  ma y usecon t ainers  to pr otect  y our s e lf an d yo urus ers from e a c h o ther.  I f, o n the o ther hand, your us e rsare allowed t o
e xecu t e  c ode ou t sid eo f t h e  container (orlaunch con ta i ne rs) becaus e  th at 's
howyou hav e set up auth orization  and acce ss  con t r olfor userson yourmulti-
te n ant s y st em, t hat 's not  t heconta iner's fau lt.
~~~
ye by en
And  just  t o tack o n a specific anecdote a bout m y own  us e of cont ain e rsand how
w hatyou're say ing  ju st is n't true,  I f o un d o n ce wh en t r ying to r u nChr o m ein
a contai n e r  th at it  fa i led fo r so me reason related to sandboxing.  SoI tri edt o di sa ble sandboxing  wi th - -no-sand bo x and saw t hat
 learning._It seems_there
are now security reasons_for preferring_the_p2p approach.

If_you're_interested in our_p2p approach, see:
[https://fosdem.org/2017/schedule/event/democratizing_deep_le...](https://fosdem.org/2017/schedule/event/democratizing_deep_learning/)
and_www.hops.io

------
djb_hackernews
Surprised the docker iptables_doesn't block this_already._I do see rules
disallowing traffic to and from docker0 (172.17.0.1).

~~~
StreamBright
I am not surprised at_all._Security is_mostly_an_afterthought in the docker
universe. Sensible_defaults are not really a_thing and_instead of giving
access to resources when needed it_is_allowed to do_anything by default. Also,
unprivileged containers when?

~~~
yebyen
This is not really_true IMHO unless you're just starting_and don't know_what
you're_doing._Like for example, if_you're doing a container and you_set
--privileged flag, you have almost certainly_granted more access to the
processes inside of_the container than was needed.

I get_what you're saying about unprivileged_containers, even_if the processes
in the container_are not running_as root,_the container itself_(and docker
itself) is basically root. The_person running the_container gets root. Setting
up a docker_host_as multi-tenant is_something_you_may do_at your own_risk.

If_your users_have_access through the network to processes_running_inside of a
container, that is how you_may use containers to_protect_yourself and your
users from_each other. If, on the_other hand, your users are allowed_to
execute code_outside of_the container (or launch containers) because that's
how you have set up_authorization and access control for users_on your multi-
tenant system,_that's not_the_container's fault.

~~~
yebyen
And just_to_tack on_a specific anecdote about my own use_of containers_and how
what you're saying just isn't_true, I found once_when_trying to run Chrome in
a container_that it failed for some reason_related to sandboxing. So I_tried
to_disable_sandboxing with --no-sandbox and saw_that