Sysdig Blog

No, I'm sorry, I seriously don't understand how that applies in this case. How is "trusting the content you get from `apt-get`/`dpkg`/`pacman`" safer than curling-to-bash? In both cases, you are downloading and installing content from a trusted source (assuming you are curling via https to avoid MITMs). In the curl-to-bash case, you have the _ability_ to at least inspect the code first before you install it (though, realistically, how many folks would really have the dedication and the ability to do so?), whereas with package managers you're installing "blind". Doesn't that make curling-to-bash the _safer_ option?

I clearly must be missing something, here, because everyone decries "curling-to-bash" as a bad security practice, but I haven't seen an explanation of _why_. I tried doing some research for myself - this page[1] suggests that package managers have built-in checksumming and signature verification, but then goes on to propose an attack vector where the load balancer is compromised, so (presumably?) those same checksums/signatures could also be intercepted and faked. This gist[2] has a lot of people speaking against it, but from following those links, the only downside I could see was here[3], pointing out that the shell will keep executing if a connection closes mid-stream - which, yes, is certainly a bad thing and a good argument to use package managers, but not what I would call a security concern (unless you don't trust the entity on the other end of the stream -…

(Same discussion as on lobste.rs)

Thank you for this link, I've only seen the initial CVE announcement.

> This is not FUD [...]

The site is practicing FUD, it accomplishes communicating a message in an untruthful fashion by mixing two different things into one. (Just check out their stack overflow links, it is not clear if they are talking about root or `--privileged`)

People are confused wether `docker root == host system root` and this site doesn't help them to get a better understanding whether or not it is the case. (It isn't) Plus it misses what its main goal should be, running a Secure Docker environment.

You are talking about a previous exploit, not a permanent issue. Keeping your host system up to date and additional hardenings is always going to be necessary in exposed environments.

> Use Docker containers with SELinux enabled (--selinux-enabled). This prevents processes inside the container from overwriting the host docker-runc binary.

Authors recommendation is also using SELinux, this also helped with outer Docker/Kernel related vulnerabilities in the past. Why isn't the page even mentioning this?

---

I think it is important to give a proper outlook on how problematic things are and not to confuse people with super high expectations. You often end up running containers that you have only little control about.

1. Avoiding root in self-built containers is definitively the way to go, since it reduces (unnecessary) attack surface, but

1. It requires some…

Sysdig | Dev, PM, Design, Technical Marketing, Technical Customer Success | Bay Area, London, & Remote | Full time | https://www.sysdig.com

Sysdig is the container intelligence company. We build monitoring, security, and troubleshooting tools for containerized and orchestrated environments. It's all based on our open source linux visibility project (www.sysdig.org).

As we're at the forefront of the next big platform shift, We're growing rapidly across the board. We operate a SaaS platform and sell software to large enterprises.

* Devs who understand analytics & underlying open source technology like cassandra and elastic search
* Front end engineers and visualization specialists familiar with javascript, ember, and D3
* Infrastructure engineers who understand how to effectively package up software for easy consumption and management
* Product Managers with monitoring, security, or analytics experience
* Product designers who love data, analytics, and devops
* Technical customer success managers who can learn and help customers learn "how-to". Act as their advocates within sysdig.
* A technical marketing manager who understands the competitive landscape, partnerships, and creating great content to enable the team.

Sysdig is a good place to work. It's made up of a lot of smart, honest people who are passionate about what they do. We've got full medical, dental, PTO as-you-need-it, and other great benefits like a monthly learning stipend and a monthly house cleaning…

> Why are the storage and networking implementations "out of tree" (CNI / CSI)? Given the above question, why is there explicit support for Cloud providers? eg: LoadBalancer supports AWS/GCP/Azure/..

Kubernetes has been pruning out vendor-specific code for a while now, moving it out of tree. The upcoming 1.31 release will drop a lot of existing, already deprecated support for AWS & others from Kubernetes proper. https://github.com/kubernetes/enhancements/blob/master/keps/sig-cloud-provider/2395-removing-in-tree-cloud-providers/README.md

There's some plan to make this non-dosruptive to users but I haven followed it closely (I don't use these providers anyhow).

> Why are we generating a structured language (YAML), with a computer, by manually adding spaces to make the syntax valid? There should be no intermediate text-template representation like this one.

Helm is indeed a wild world. It's also worth noting that Kubernetes is also pushing towards neutrality here; Helm has never been an official tool, but Kustomzie is builtin to kubectl & is being removed. https://github.com/orgs/kubernetes/projects/183/views/1?filterQuery=+sig%3A%22sig-cli%22&pane=issue&itemId=66600030

There's a variety of smart awesome options out there. First place I worked at that went to kube used jsonnet (which alas went unmaintained). Folks love CUE and Dhall and others. But to my knowledge there's no massive bases of packaged software like exists for Helm. Two examples,…

The article's "container lifespan" chart shows that 21% of containers live less than 10 seconds and 54% live <= 5 minutes. If the base data set has that many very-short-lived containers, it's probably not representative of containerized persistent services. How many services get CD updates every 10 seconds?

Indeed, the original Sysdig report that the chart comes from makes this case:

https://sysdig.com/blog/sysdig-2019-container-usage-report/

"Many containers need to only live long enough to execute a function and then terminate when it’s complete. Seconds may seem short, but for some processes, it’s all that is required. We believe the increased use of Kubernetes Jobs that run finite tasks like batch jobs contributed to this growth. In fact, we expect short lifespans to increase, especially on serverless platforms that are well-suited to running short term tasks."

> "This entirely separate attack exists therefor completely removing an entire attack primitive haves no value"

It has value, but it's also true that trusting cloud providers serveless infrastructure introduces additional sets of vulnerabilities due to various reasons.

eg: https://sysdig.com/blog/exploit-mitigate-aws-lambdas-mitre/

Reading your comments, I get the impression that you are used to dealing with clients whose infrastructure management skills are lacking, and they are making a mess of things.

While serverless infrastructures certainly eliminate a range of vulnerability classes, it is adoption is unlikely to be sufficient to secure platforms that are inadequate for the threats they face.

At the end of the day, someone has to put in the work to ensure that things are patched, safe, and secure, whether the computing model is serverless or not.