Download - Ditch Sandboxes for Docker
LESSONS IN HUBRIS
WHAT IS DOCKER?
���2
WHAT IS DOCKER?
• That awesome-looking whale we just saw
���3
WHAT IS DOCKER?
• That awesome-looking whale we just saw
• The Linux container engine (lightweight VMs)
���4
WHAT IS DOCKER?
• That awesome-looking whale we just saw
• The Linux container engine (lightweight VMs)
• Git (and, sort of, GitHub) for deployment
���5
LIFE BEFORE DOCKER• Install the right version of Java after four tries
• Download the leiningen script, run it
• Remember that you forgot to chmod +x it
• Run the leiningen script again
• Clone the project repo
• Follow the README, apt-get some stuff, copy some things
• Run the program���6
LIFE WITH DOCKER
���7
DOCKER IMAGES
���8
DOCKER IMAGES
���9
BUILD ON EXISTING IMAGES
���10
BUT WHAT CAN IT DO?
���11
ENTER LAZUBOT
���12
SANDBOXED EXECUTION
���13
SANDBOXES ARE LAME
���14
SANDBOXES ARE LAME
���15
• Executor cannot break the Zulip bot or access our secret
• Executor cannot access the Internet
• File system changes to the executor container are fine
• If the executor gets out of control, the master kills it
I PROMISED YOU HUBRIS
���16
DOCKER IN YO DOCKER
• Host runs Ubuntu
���17
Host
DOCKER IN YO DOCKER
• Host runs Ubuntu
• Lazubot runs in a Docker container
���18
Host
Master
DOCKER IN YO DOCKER
• Host runs Ubuntu
• Lazubot runs in a Docker container
• Lazubot creates child containers that execute arbitrary Clojure code
���19
Host
Master
Exec Exec
DOCKER IN YO DOCKER
• Host runs Ubuntu
• Lazubot runs in a Docker container
• Lazubot creates child containers that execute arbitrary Clojure code
���20
Host
Master
REWARD!
���21
REWARD!
���22
REWARD!
���23
LESSONS IN HUBRIS