[{"data":1,"prerenderedAt":278},["ShallowReactive",2],{"project-18050781":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":15,"tier":18,"category":19,"subcategory":20,"format":21,"keywords":22,"reception":27,"sentiment":28,"stance_mix":29,"scored_comments":34,"aspects":35,"strip":40,"post_text":42,"what":43,"said":76,"maker_in_thread":156,"shape":165,"grid":170,"attempts":233,"same_week":241,"maker_shows":37,"maker_hidden":270,"reader_version":271,"card":272},"18050781","Plash","Build and run containers","title","Show HN: Plash – Build and run containers","https:\u002F\u002Fgithub.com\u002Fihucos\u002Fplash","github.com","ihucos",1537705646,2018,66,30,642,2155,"notable","dev_tools","container tool","cli",[23,24,25,26],"containers","unprivileged containers","rootless containers","docker alternative","curious",-0.218,{"positive":30,"neutral":31,"mixed":32,"critical":33},1,7,0,4,12,{"docs":36,"idea":38,"execution":39},{"positive":30,"critical":37},3,{"positive":32,"critical":32},{"positive":32,"critical":32},[30,32,32,32,32,32,30,32,37,32,41,32,37,32,32,37,32,37,32,37,32,32,37,32,32,30,30,32,37,32],5,null,{"problem":44,"audience":42,"pricing":42,"motivation":54,"time_to_build":42,"stack":59,"openness":75,"stage":75,"team_size":75},{"value":45,"source":46,"evidence":47},"Running containers without root or a root daemon, with containers as normal processes","maker",[48,51],{"id":49,"by":11,"text":50},"18065092","> So does Docker now provide containers that can guarantee immunity from (certain) privilege escalation attacks? In my opinion the isolation mechanism of major container software…",{"id":52,"by":11,"text":53},"18067127","Yeah I don't know, the terms a a little mixed up. For me isolation and sandboxing is not the same. A function of a container is to provide a more well defined environment,…",{"value":55,"source":46,"evidence":56},"Avoid root daemons and Docker\u002FrunC isolation complexity; keep containers as normal processes",[57,58],{"id":49,"by":11,"text":50},{"id":52,"by":11,"text":53},[60,66],{"value":61,"source":46,"evidence":62},"Python",[63],{"id":64,"by":11,"text":65},"18064466","I think the simplest would be like this: ``` ihucos@macbook:~$ docker run --privileged --volume \u002Fvar\u002Flib\u002Fplash -ti python bash root@d2a59ae96bc2:\u002F# pip3 install plash Collecting…",{"value":67,"source":46,"evidence":68},"Linux namespaces, chroot, overlay\u002Funionfs-fuse",[69,72],{"id":70,"by":11,"text":71},"18065922","To continue the reply... plash uses along others linux namespaces and chroot. So inside a linux namespace you can actually use the vanilla chroot: ``` ihucos@macbook:~\u002Fplash$ #…",{"id":73,"by":11,"text":74},"18064534","Hey, Yeah, that should work. It usually uses linux namespaces\u002Foverlay\u002Funionfs\u002Fmount\u002Fchroot there are no dependencies on hyper-V. In the worst case scenario plash would also be…","unknown",{"praise":77,"objections":90,"requests":105,"questions":120,"alternatives":136},[78],{"value":79,"source":80,"evidence":81},"Unprivileged, no root daemon approach is appealing","commenter",[82,86],{"id":83,"by":84,"text":85},"18065396","miduil","Really cool, I like the documentation on the website - would be nice if the README was actual HTML though. Does that mean I can build container images within a running container…",{"id":87,"by":88,"text":89},"18062194","projectramo","Will this run alongside virtual box? (In other words, does it need hyper-V turned on on a windows box?",[91,98],{"value":92,"source":80,"evidence":93},"Name collides with existing Plash project",[94],{"id":95,"by":96,"text":97},"18065640","naasking","Unfortunate name choice. There's already a Plash [1,2] project for the Principle Least Authority Shell. [1] http:\u002F\u002Fwww.cs.jhu.edu\u002F~seaborn\u002Fplash\u002Fhtml\u002F [2]…",{"value":99,"source":80,"evidence":100},"README wording about security is misleading; no isolation",[101],{"id":102,"by":103,"text":104},"18062566","anarcat","I find the first item in the README a bit misleading: ``` Security: plash containers run completely unprivileged. ``` What this actually means is that plash containers run as the…",[106,113],{"value":107,"source":80,"evidence":108},"Comparison with Docker CLI commands",[109],{"id":110,"by":111,"text":112},"18062497","bthornbury","Some comparisons between the cli of plash and equivalent commands in docker (only because I'm already familiar with it) would be pretty helpful.",{"value":114,"source":80,"evidence":115},"Dockerfile compatibility",[116],{"id":117,"by":118,"text":119},"18062495","axtn","Are there any plans to be backwards-compatible with Dockerfiles and ‘docker-build’?",[121,128],{"value":122,"source":80,"evidence":123},"How does it compare to gVisor",[124],{"id":125,"by":126,"text":127},"18062809","etaioinshrdlu","How is this different from gVisor? Not complaining, this looks very awesome. I am just interested. This is going to be a great world when we have arbitrary nesting of containers,…",{"value":129,"source":80,"evidence":130},"Can it build Docker images inside CI containers",[131,135],{"id":132,"by":133,"text":134},"18061873","gravypod","How would you use this to build a docker container within a docker container? This would be an interesting use case for continuous integration where you might have ephemeral…",{"id":83,"by":84,"text":85},[137,143,150],{"value":138,"source":80,"evidence":139},"bubblewrap",[140],{"id":141,"by":111,"text":142},"18062623","https:\u002F\u002Fgithub.com\u002Fprojectatomic\u002Fbubblewrap This is the most promising one I've seen.",{"value":144,"source":80,"evidence":145},"kaniko",[146],{"id":147,"by":148,"text":149},"18063217","dlor","Check out kaniko, we built it for that exact use case: github.com\u002FGoogleContainerTools\u002Fkaniko",{"value":151,"source":80,"evidence":152},"gVisor",[153],{"id":154,"by":11,"text":155},"18064645","gVisor is primarly focused on isolation, plash actually only wants to containerize processes and leaves optional isolation to other tools if required (potentially gVisor). To…",{"comments":157,"answered":158,"key":159},14,10,[160,161,164],{"id":49,"text":50},{"id":162,"text":163},"18064903","Oh boy, I am since one hour thinking about how to formulate it so its really crystal clear, maybe someone have a suggestion. In my head isolation and containerization are two…",{"id":52,"text":53},{"commenters":166,"max_depth":167,"maker_replies":157,"first_comment_mins":168,"lifespan_hours":169},15,6,2017,130,[171,173,175,178,180,183,185,188,190,193,196,198,201,204,207,208,210,211,212,213,214,215,216,217,220,222,224,227,229,231],[102,32,30,172,103,32],"project\u002Fcritical\u002Fdocs",[141,32,32,174,111,32],"other\u002Fneutral\u002Fnone",[176,32,32,174,177,32],"18064390","austinjp",[49,32,32,179,11,30],"project\u002Fneutral\u002Fprivacy",[181,32,32,174,182,32],"18064684","jquery_dev",[162,32,32,184,11,30],"project\u002Fneutral\u002Fdocs",[186,32,30,172,187,32],"18066500","ofrzeta",[52,32,32,189,11,30],"project\u002Fneutral\u002Fidea",[191,32,37,189,192,32],"18068372","mbreese",[194,32,32,195,11,30],"18071088","project\u002Fpositive\u002Fprivacy",[83,30,41,197,84,32],"project\u002Fpositive\u002Fdocs",[199,30,32,200,11,30],"18065507","project\u002Fpositive\u002Fexecution",[202,30,37,203,84,32],"18065815","project\u002Fneutral\u002Fexecution",[205,30,32,206,11,30],"18066018","project\u002Fmixed\u002Fexecution",[70,30,32,200,11,30],[125,209,37,189,126,32],2,[154,209,32,189,11,30],[87,37,37,203,88,32],[73,37,32,203,11,30],[132,33,37,189,133,32],[147,33,32,174,148,32],[64,33,32,203,11,30],[110,41,37,184,111,32],[218,41,32,219,11,30],"18064498","maker\u002Fneutral\u002Fdocs",[221,41,32,197,11,30],"18097423",[95,167,30,223,96,32],"project\u002Fcritical\u002Fnone",[225,31,30,172,226,32],"18067072","0n34n7",[228,31,32,184,11,30],"18067263",[117,230,37,203,118,32],8,[232,230,32,203,11,30],"18064423",[234,237,240],{"id":235,"t":236,"points":37,"comments":32},"14341942",1494859468,{"id":238,"t":239,"points":30,"comments":32},"16332422",1518102307,{"id":4,"t":12,"points":14,"comments":15},[242,246,251,256,261,266],{"id":243,"name":244,"points":245,"category":19},"18030446","Sublime Merge",935,{"id":247,"name":248,"points":249,"category":250},"18035283","Hacking slot machines",421,"other",{"id":252,"name":253,"points":254,"category":255},"18077446","You Don't Need WordPress",257,"web_saas",{"id":257,"name":258,"points":259,"category":260},"18058031","Chattervox",224,"infrastructure",{"id":262,"name":263,"points":264,"category":265},"18076566","You Need Feeds",205,"learning_science",{"id":267,"name":268,"points":269,"category":19},"18051037","Thi.ng\u002Fhdom",180,false,"v2",{"id":273,"name":5,"line":6,"ai":270,"cat":19,"year":13,"points":14,"comments":15,"rec":27,"s":274,"top":15,"kw":275,"maker":11,"domain":10,"tier":18,"attempts":37,"strip":276,"url":9,"mix":277,"praise":79,"objection":92,"sub":20},18050781,-0.22,[23,24,25,26],"100000103050300303030030011030",[30,31,32,33],1794036569778]