Marco d'Itri

Telecom Italia is well-known to manage noteworthy pilot projects.
But the company often fails in making these excellences the norm.

For the mobile network:

- the coverage of 4G is ... scarce

> In Italy, almost all of the population can benefit from mobile Internet connectivity services over the 2G network, namely Global System for Mobile Communications (GSM), GPRS (General Packet Radio Service) and EDGE (Enhanced Data rates For GSM Evolution). Next to the full coverage is HSPA (High Speed Packet Access) technology, while the implementation of HSPA + (HSPA Evolution) and 4G LTE (Long Term Evolution) solutions is still to be completed.
[https://www.sostariffe.it/news/copertura-rete-mobile-in-italia-140743/]

- the practice of trying to force users into accepting bundles that include online streaming of music and/or movies, subscriptions to the fixed network, newspapers, movie tickets, various amenities is hated by many. [https://www.tim.it]

- not having a internet-dedicated monthly fee is a lack, especially given the exaggerated costs in exchange for a low data threshold

For the fixed network:

- having a guaranteed minimum bandwidth is a utopia and the real upload bandwidth is around 20% of the declared

- the depeering has been dictated by anti-competitive strategies rather than technical reasons [http://blog.bofh.it/id_432]

LXC is not secure at the moment. root in a LXC container can lead to root on the host. There is unfortunately no good summary of the problems - here is my list (take it with a grain of salt - a lot of these problems are mitigated in docker.io and with AppArmor in Ubuntu):

- Without CONFIG_USER_NS and a newer kernel a lot of problematic things can happen. If /proc or /sysfs is mounted on the container DoS or escalation to root is possible: http://blog.bofh.it/debian/id_413 - At the moment no stock distro kernel has CONFIG_USER_NS enabled.

- There are some issues related to remounting filesystems rw and altering files

- Mounting cgroups in the container can also lead to problems - DoS and aquiring more ressources

- Capabilities. You stock Linux distribution won't boot without CAP_SYS_ADMIN (see man 7 capabilities) - there are a lot of other capabilities that could be troublesome.

- Not sure about this one: http://seclists.org/oss-sec/2011/q3/385

So for running services without CAP_SYS_ADMIN and with dropping a lot of other capabilities it can be considered somewhat safe. For everything else it's probably dangerous.

Not sure if all these issues are still a problem today but if you are running lxc on e.g. a current Debian Wheezy you have to know about all of them.

For your convenience here are the URLs from that broken document:

http://blog.bofh.it/debian/id_413
http://reventlov.com/advisories/using-the-docker-command-to-root-the-host
http://events.linuxfoundation.org/sites/events/files/slides/Containers,%20Docker,%20and%20Security_%20State%20of%20the%20Union.pdf
http://opensource.com/business/14/9/security-for-docker
https://zeltser.com/security-risks-and-benefits-of-docker-application/
https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1.6_Benchmark_v1.0.0.pdf
https://forums.grsecurity.net/viewtopic.php?f=7&t=2522
http://xebia.github.io/cd-with-docker/#/
http://www.schibsted.pl/2015/06/how-we-used-docker-to-deploy-schibsted-pl/
http://itrevolution.com/the-three-ways-principles-underpinning-devops/

Most of these will be already in your bookmarks, when you are following docker development.

Why was this talk is interesting? Is there a video that shows things that happened that are not reflected in the powerpoint pdf? What was new?

BTW the powerpoint document wins the "most annoying document of the week"- award. We have better ways to publish URLs in 2016 than powerpoint. Please use reveal or anything else next time, thanks!

My understanding is that recent (13.10+) Ubuntu ships with an AppArmor profile that blocks known ways of escalating out of the container. So, LXC under Ubuntu is in better shape than LXC on other distros, where you can use the uevent_helper trick[1] to easily escape the container.

It sounds like your use case could also use the new unprivileged containers[2] feature, which is going to be a dramatic increase in security (since even if you somehow get access to run a command on the host container, it would not be as root).

[1]: http://blog.bofh.it/debian/id_413

[2]: https://www.stgraber.org/2014/01/17/lxc-1-0-unprivileged-containers/

It's worrisome to me that one of the stated objections I've seen to Freenode's new owner is related to his personal politics: https://blog.bofh.it/debian/id_461

My own personal politics are probably very very similar to the above author who was complaining about the new owner being "Trumpian", but what will happen if/when we disagreed about something? Would I get the boot from Libera? I totally don't care about Orange Man's fans enough to leave a network over it.

e: You gotta appreciate the irony of which group is censoring me right here with downvote-as-disagree :)

Awesome product! I've squinted at lxc for a while now. This looks great!

But: What about this security issue regarding lxc? Does docker takes measures to prevent this?

http://blog.bofh.it/debian/id_413

The issue itself appears to be fixed if you use Linux 3.8 with compiled in namespace support (that breaks NFS and other filesystems at the moment)