TrendLabs: Why Running a Privileged Container in Docker Is a Bad Idea

Figure 1. Screen capture that shows that user namespaces are not used by default

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/why-running-a-privileged-container-in-docker-is-a-bad-idea/

ADMIN: Docker image security analysis

Figure 2: The innards of the very popular Nginx container image.
REF: http://www.admin-magazine.com/Articles/Docker-image-security-analysis

[USN-4103-2] Docker vulnerability

---------- Forwarded message ---------
From: Mike Salvatore
Date: Aug 20, 2019 1:46AM

Jasiel Spelman discovered that a double free existed in the docker-credential-
helpers dependency of Docker. A local attacker could use this to cause a denial
of service (crash) or possibly execute arbitrary code.

References:
  https://usn.ubuntu.com/4103-2
  https://usn.ubuntu.com/4103-1
  CVE-2019-1020014

Check_MK: Docker Monitoring

Package	docker
Version	1.2.4
Author	lars.getwan@metrosystems.net
Uploaded	2017-10-24 13:31:01
Description	Contains plugins and checks to monitor Docker Service, Containers and Images. Prerequisite: pip install docker (Version 2.5.1 or newer) 1.2.1: The package is now compatible with CMK 1.4.0, too. 1.2.2: The plugin can now handle images without RepoTags (which were used as item name before) 1.2.3: Now compatible with CRE versions & more fault tolerant, esp. on heavily loaded machines 1.2.4: Bugfixes
Website	https://www.metroag.de/marken/servicegesellschaften/metro-systems
Minimal Version	1.2.8
Packet with	1.2.8p22
Filesize	6.61k
Content	agents/bakery/check_docker agents/plugins/check_docker checkman/docker_containers checkman/docker_images checkman/docker_info checks/docker_containers checks/docker_images checks/docker_info web/plugins/metrics/docker_containers.py web/plugins/metrics/docker_images.py web/plugins/wato/agent_bakery_docker.py
Checksum (MD5)	790bd8571b0eedd4ddc97bbf6393b3c5
Downloads	845

REF: https://mathias-kettner.com/check_mk_exchange_file.php?HTML=yes&file=docker-1.2.4.mkp

PaaS: Docker support

這篇文章有提到 proxmox VE 上面也能跑 docker 再裝上個 docker GUI 界面 portainer 就更好用了。文章介紹的是 pve 5.0 它還是beta版。

REF: https://www.servethehome.com/creating-the-ultimate-virtualization-and-container-setup-with-management-guis/

docker in kvm

REF: https://forum.proxmox.com/threads/docker-support-in-proxmox.27474/

tomProxmox Staff Member

Staff Member

Joined:

Aug 29, 2006

Messages:

11,584

Likes Received:

112

docker runs perfectly as qemu guest, in the OS of your choice.

#2tom, May 19, 2016

docker issue when nested

Docker may encounter issues when running inside other container such as LXC. It's better to use full virtualization such as KVM instead.

REF: http://stackoverflow.com/questions/22085657/can-docker-run-inside-a-linux-container

VM / Compute instances backup / restore

雖說VM可以自在遷移，但根本上還是依賴於實體CPU與儲存空間，本體instance還是得生存於storage上啊。除了以regular cycling的方式勤奮migration或backup來避免single point failure之外，還有更有效率的辦法嗎？縮短downtime時間是最簡單的第一步吧。

• Compute-only. 無論KVM全虛擬或是LXC容器，只要沒存太多資料，instance不大，搬移backup都很快。
• Storage dependent. 目前想到的就是分離storage componet，獨立出Compute，就可以單獨把Compute SOP了。接下來就是用哪種SDS來保障Storage availability.