Neovim isn’t an upstart.

You can claim that Vim doesn’t need asynchronous features, but the droves of people running like hell to more modern editors that have things like syntax aware completion would disagree.

Things either evolve or they die. IMO Vim has taken steps to ensure that people like you can continue to have your pristine unsullied classic Vim experience (timers are an optional feature) but that the rest of us who appreciate these changes can have them.

Just my $.02.

Emacs is not as fast and streamlined as Neovim-QT, while, to my knowledge, not providing any features or plugins that hasn’t got an equivalent in the world of vim/nvim.

This really is a good thing for privacy and security.

I have two questions about that:

One, I want the same theme capability as I’ve always had. I want Firefox to look like it does for me now, not like the stock Firefox. Is that possible?

Two, I want ad blocking and script blocking and all the other privacy-enhancing add-ons to work as well, not like they do in Chrome where the bad stuff is fundamentally still loaded, it’s just hidden at some point in the rendering cycle. Is that possible?

Docker hasn’t used LXC on Linux in a while. It uses its own libcontainer which sets up the Linux namespaces and cgroups.

I don’t use it thinking I’m getting any added security.

The question was “Why would anyone choose Docker over fat binaries?”

You could use fat binaries of the AppImage variety to get the same, and probably better organization.

Maybe if AppImages could be automatically restricted with firejail-type stuff they would be equivalent. I just haven’t seen many developers making their apps that way. Containers let you deal with apps that don’t create AppImages.

That sounds genuine.

So I get that its one place, already working, to put all the parts in one place. I buy that.

So in this case, it’s not so much Docker as Docker, as it is a means to an end. This answers my question well, thank you. Any arguments to the contrary with this? Please?

Correct. It is unclear the compartmentalization aspect of containers to security specially.

I’ve implemented TSEC Orange Book Class B2/B3 systems with labelling, and worked with Class A hardware systems that had provable security at the memory cycle level. Even these had intrusion evaluations that didn’t close, but at least the models showed the bright line of where the actual value of security was delivered, as opposed to a loose, vague concept of security present as a defense here of security.

FWIW, what the actual objective that the framers of that security model was, was program verifiable object oriented programming model to limit information leakage in programming environments that let programs “leak” trusted information to trusted channels.

You can embed crypto objects inside an executable container and that would deliver a better security model w/o additional containers, because then you deal with issues involving key distribution w/o having the additional leakage of the intervening loss of the additional intracontainer references that are necessary for same.

So again I’m looking for where’s the beef instead of the existing marketing buzz that makes people feel good/scure because they use the stuff that’s cool of the moment. I’m all ears for a good argument for all this things, I really am, … but I’m not hearing it yet.

thought it was about better managing infrastructure.

I mean, yes, it does that as well, and you’re right, a lot of people use it just for that purpose.

However, you can also manage infrastructure quite well without containers by using something like Ansible to manage and deploy your services without overhead.

So what’s the benefit of Docker over that approach? Well… I think it’s security through isolation, and not much else.

Docker itself runs on binary blobs of priveleged or kernel code IIRC (dont use it).

Yes, but that’s where capabilities kicks in. In Docker you can run a process as root and still restrict its abilities.

Edit: if you’re referring to the dockerd daemon which runs as root, well, yes, that is a concern, and some people, like Jessie Frazelle, hack together stuff to get “rootless container” setups.

When I pointed out its TCB, most people talking about it on HN told me they really used it for management and deployment benefits. There was also a slideshow a year or two ago showing security issues in lots of deployments.

Like any security tool, there’s ways of misusing it / doing it wrong, I’m sure.

According to Jessie Frazelle, Linux containers are not designed to be secure:

Out of context it sounds to me like you’re saying “containers are not secure”, which is not what Jessie was saying.

In context, to someone who read the entire post, it was more like, “Linux containers are not all-in-one solutions like FreeBSD jails, and because they consist of components that must be properly put together, it is possible that they can be put together incorrectly in an insecure manner.”

Oh sure, I agree with that.

Secure container solutions existed long before Linux containers, such as Solaris Zones and FreeBSD Jails yet there wasn’t a container revolution.

That has exactly nothing (?) to do with the conversation? Ask FreeBSD why people aren’t using it as much as linux, but leave that convo for a different thread.

Generally when you add complexity to any system, you decrease its scope of security, because you’ve increased the footprint that can be attacked.