ditch sandboxes for docker

24
LESSONS IN HUBRIS

Upload: travis-thieman

Post on 08-May-2015

824 views

Category:

Technology


5 download

DESCRIPTION

Replace sandboxes with Docker, using expendable containers to let untrusted users execute whatever they want without putting anything at risk

TRANSCRIPT

Page 1: Ditch Sandboxes for Docker

LESSONS IN HUBRIS

Page 2: Ditch Sandboxes for Docker

WHAT IS DOCKER?

���2

Page 3: Ditch Sandboxes for Docker

WHAT IS DOCKER?

• That awesome-looking whale we just saw

���3

Page 4: Ditch Sandboxes for Docker

WHAT IS DOCKER?

• That awesome-looking whale we just saw

• The Linux container engine (lightweight VMs)

���4

Page 5: Ditch Sandboxes for Docker

WHAT IS DOCKER?

• That awesome-looking whale we just saw

• The Linux container engine (lightweight VMs)

• Git (and, sort of, GitHub) for deployment

���5

Page 6: Ditch Sandboxes for Docker

LIFE BEFORE DOCKER• Install the right version of Java after four tries

• Download the leiningen script, run it

• Remember that you forgot to chmod +x it

• Run the leiningen script again

• Clone the project repo

• Follow the README, apt-get some stuff, copy some things

• Run the program���6

Page 7: Ditch Sandboxes for Docker

LIFE WITH DOCKER

���7

Page 8: Ditch Sandboxes for Docker

DOCKER IMAGES

���8

Page 9: Ditch Sandboxes for Docker

DOCKER IMAGES

���9

Page 10: Ditch Sandboxes for Docker

BUILD ON EXISTING IMAGES

���10

Page 11: Ditch Sandboxes for Docker

BUT WHAT CAN IT DO?

���11

Page 12: Ditch Sandboxes for Docker

ENTER LAZUBOT

���12

Page 13: Ditch Sandboxes for Docker

SANDBOXED EXECUTION

���13

Page 14: Ditch Sandboxes for Docker

SANDBOXES ARE LAME

���14

Page 15: Ditch Sandboxes for Docker

SANDBOXES ARE LAME

���15

• Executor cannot break the Zulip bot or access our secret

• Executor cannot access the Internet

• File system changes to the executor container are fine

• If the executor gets out of control, the master kills it

Page 16: Ditch Sandboxes for Docker

I PROMISED YOU HUBRIS

���16

Page 17: Ditch Sandboxes for Docker

DOCKER IN YO DOCKER

• Host runs Ubuntu

���17

Host

Page 18: Ditch Sandboxes for Docker

DOCKER IN YO DOCKER

• Host runs Ubuntu

• Lazubot runs in a Docker container

���18

Host

Master

Page 19: Ditch Sandboxes for Docker

DOCKER IN YO DOCKER

• Host runs Ubuntu

• Lazubot runs in a Docker container

• Lazubot creates child containers that execute arbitrary Clojure code

���19

Host

Master

Exec Exec

Page 20: Ditch Sandboxes for Docker

DOCKER IN YO DOCKER

• Host runs Ubuntu

• Lazubot runs in a Docker container

• Lazubot creates child containers that execute arbitrary Clojure code

���20

Host

Master

Page 21: Ditch Sandboxes for Docker

REWARD!

���21

Page 22: Ditch Sandboxes for Docker

REWARD!

���22

Page 23: Ditch Sandboxes for Docker

REWARD!

���23

Page 24: Ditch Sandboxes for Docker

LESSONS IN HUBRIS