The Cloud Foundry project blog covers the open source platform-as-a-service, its Kubernetes work, and its community and technology changes.
Commenters point to Cloud Foundry as an open source, multi-tenant PaaS used by big companies, and cite its buildpacks.
I can't say I've seen the same, so I dug into it. There's a good list from RedHat[1] on CVEs SELinux mitigated. I went through them:
- CVE-2016-9962 - Bypasses Apparmor [2], mitigated by SELinux
- CVE-2022-0492 - Apparmor and Seccomp also protect against
- CVE-2019-5736 - Mixed, blocked by the default SELinux policy in RHEL (not Fedora), not blocked by the default AppArmor policy[3]
- CVE-2021-3156 - This one is not a good one for RedHat to put on the list. SELinux by default doesn't protect against it, Debian 10 at the time had a Linux security feature enabled (fs.protected_symlinks) that helped mitigate it, and additionally CVE-2021-23240 came out which had similar effects but only occurred on SELinux systems.
- CVE-2019-9213 - Not mitigated by AppArmor, mitigated by SELinux
- CVE-2019-13272 - Not mitigated by AppArmor, not mitigated by default SELinux policy, but easy to mitigate by enabling boolean. I'd consider this a win for SELinux, but only just.
While digging into this more, I came across this BlackHat talk[4] which really quantifies how SELinux improves security (though doesn't contrast it with AppArmor). I also came across a paper on usability of SELinux and AppArmor[5] which brings up an interesting point: If the tool is too complex, even if it's more powerful, more often than not it won't end up having better results.
That's all to say, I think if you're willing to invest a lot of time into it (say you want to make security your niche in your development…
IBM Cloud Foundry Enterprise Edition [1] "IBM Cloud Foundry Enterprise Environment uniquely unites two powerhouse open-source projects: Cloud Foundry and Kubernetes. The enthusiastic adoption of Kubernetes in the cloud market merited a closer look at how customers could leverage both platforms (one focused on applications and the other focused on containers as the primary units of business function) to build coherent cloud solutions."
Eirini [2] "Run Cloud Foundry Applications in Kubernetes"
IBM Cloud Private (self-managed K8s) CFEE [3] "Cloud Foundry Enterprise Environment platform brings the same level of application capability that you experience in IBM Cloud and IBM Cloud Dedicated to your data center. It runs directly on IBM® Cloud Private by using Kubernetes containers."
[Disclosure: I'm an IBMer and CF Enthusiast]
[1] . https://www.ibm.com/blogs/bluemix/2018/10/ibm-cloud-foundry-enterprise-environment-ga/
[2] . https://www.cloudfoundry.org/project-eirini/
[3] . https://www.ibm.com/support/knowledgecenter/en/SSBS6K_3.1.2/cloud_foundry/tech_preview/cfee_overview.html
I've started to use PaaS (Platform as a service) because it's way more convenient and reduces the headache of getting a simple blog up and running. VPSes are often difficult to harden and many of the recipes online for spinning up servers are not tried and tested and often leave gaping security holes in the installation. At least with PaaS these holes are patched because they are widely deployed on many machines and have to be secure by design. Here's a few to get you started:
https://www.ctl.io/appfog/
https://bitnami.com/
https://www.cloudfoundry.org/
https://www.openshift.com/
I like the CloudFoundry report [1] better as a reflection of what businesses are actually using rather than search engine metrics (TIOBE) which are overly influenced by controversy and search engine methodologies than actual usage. However it's no prettier a picture, almost no functional languages in the list at all, only Scala making a significant dent (and you can debate whether that is functional or not). Other JVM languages like Groovy are significantly ahead of Clojure in all rankings.
[1] https://www.cloudfoundry.org/wp-content/uploads/Developer-Language-Report_FINAL.pdf
Yeah, I looked a bit now. It seems there are some serious attempts at this.
Like:
- https://www.cloudfoundry.org/technology/korifi/
- https://kubevela.io/
- https://www.crossplane.io/
Not sure if all of them are relevant and on first glance they all seem significantly harder to pick up than something like Heroku.
Found them through this reddit thread: https://www.reddit.com/r/kubernetes/comments/m8r5py/looking_for_micro_paas_like_rancherrio_that_is/
rancher is a bit different. It's based on lower-level APIs which allow your containers to hook into a certain cloud-provider features like Amazon's EBS, ELBs and VPCs. Deis uses the docker engine to ship and run applications, providing an easy developer workflow. We're similar to other PaaS solutions like Dokku[1], Flynn[2], and Cloud Foundry[3].
[1]: https://github.com/progrium/dokku
[2]: https://flynn.io/
[3]: http://cloudfoundry.org/