CoreOS Blog

This is something that all companies that set out to build great products have to figure out. Do you take the Apple path and attempt to build the best product possible, even if that means limiting where and what it runs on? While we try to answer that question, I'm pleased that CoreOS has taken great effort to keep our opensource projects[0] separate from our commercial offerings[1]. This allows the community, and even our competitors, to support the "chose your own fundamentals" use case. Tectonic simply represents the CoreOS fundamentals, which we believe encapsulates the right patterns that will lead a large group of people to success. [0]https://coreos.com [1]https://tectonic.com

It depends on how you are using containers. If you control what code is run in them and who has access to the containers and their hosts, then production use should be fine as far as security goes. However, if you're trying to run something which lets untrusted people login to the containers or run arbitrary untrusted code in the containers, then I certainly wouldn't recommend doing that with containers in a production environment. One project you might like to keep an eye on is CoreOS [1]. As I understand it, their goal is to create an OS which will come configured to safely run containers. Once it is ready I would expect it will be suitable for use in a production environment. [1] http://coreos.com/

San Francisco, CA - CoreOS - Full Time - https://coreos.com/ __Product Marketing Manager__ Join the CoreOS team. You'll spend time with the CoreOS line of products to develop product positioning, create lead gen campaigns and develop an expertise on the overall market. You’ll: -Analyze the CoreOS line of products and determine the best way to price, position and market products in a competitive marketplace. -Use a data-driven strategy based on customer insight and market research to understand how our products and solutions are doing in the marketplace. -Create customer-facing collateral such as white papers, customer case studies, and webinars to drive prospects through the sales funnel. -Design integrated marketing plans across owned, paid, and earned media channels - driven by a rationale for why, when, and how each channel should be used Requirements: -You have 5+ years of experience working for an enterprise-focused software, SaaS, or web services company. -You have a proven track record of marketing to a highly technical audience. You are comfortable working with and marketing to developers and technical buyers within enterprises. -You like analyzing marketing methods, doubling down on those that work and cutting those that don't. -You have a passion for measurement, metrics and continuous improvement. -You are hands on. Passionate. Persistent. Creative. Easy to work with. Get things done. If interested in the product marketing position please email your…

Disclaimer: my company was acquired by Rackspace 2 years ago. I am a developer myself and below are my honest impressions (and things I have learend) of Rackspace cloud. Back when they launched it after having had acquired Slicehost, Rackspace Cloud was the only alternative to AWS and had one significant differentiator back then: the local storage on the instances wasn't ephemeral - it was permanent. The benchmarks and pricing were competitive, so the growth was phenomenal and life was good as a result. And that's when Rackspace dropped the ball by losing some focus and getting obsessed with launching platform services one after another ignoring the compute. They even launched what I believe was the first PaaS ever and gave it an unfortunate name of "cloud sites" (and confusing plenty of developers at that point, who couldn't tell "cloud sites", significantly less powerful service, apart from "cloud servers") As a result, for a few years the lineup of VMs they offered hasn't changed, while AWS was launching new types all the time. So about two years ago Rackspace ended up with a great control panel (easiest cloud CP to use IMO), a comprehensive set of back-end services: block storage, object storage, MySQL-as-a-Service, email sending and receiving, MongoDB-as-a-Service, cloud deployments, CDN and many more... But the selection of virtual servers was small and the hardware was getting obsolete at that point. Since then I've seen tremendous investments being made into the…

Kudos for the interesting approach! I do think that DB management on Kubernetes belongs to operators, and maintaining a collection of them would be great. This being said, you should not be using TPR, but rather CRDs (see https://coreos.com/blog/custom-resource-kubernetes-v17). The welcome video is not really convincing either - condensing it to an animated gif would make it much more attractive imho.

> fleet is no longer actively developed or maintained by CoreOS. CoreOS instead recommends Kubernetes for cluster orchestration. https://coreos.com/fleet/docs/latest/launching-containers-fleet.html

You are missing the point. It's not at all about Fedora itself here. What I was trying to say is that today CoreOS (even in) stable is using Linux kernel 4.14.32 (https://coreos.com/releases/) and therefore enabling deployments to use the latest and greatest features, performance optimisations and innovation from the Linux kernel community in enterprise environments. Going back to RHEL kernel would be a major step backwards preventing a wide user base from access to what CoreOS enables them to do today. I genuinely hope that CoreOS folks at RH don't give up on continuing to deliver this sort of innovation. That is all what I was trying to get across.

Docker-ce from upstream docker works well on Debian. I've not looked at "naked" lxc for quite some time - but I've used Lxd on Ubuntu a bit, and that's a great experience. If what you want is "containers" (single-purpose, ephemeral) - I'd say for now the docker tooling is best. But there's not much isolation - there lxc is better. I've yet to try alternative "run times" like rkt - but I believe that's the better way forward compared to docker. For now we use docker mostly for packing up an application and managing dependencies - not for resource/security isolation. I suggest reading over : https://coreos.com/rkt/docs/latest/rkt-vs-other-projects.html#rkt-vs-d…

A big use case of this that we are thinking about is enabling people to use the etcd Operator[1], which makes it simple to run etcd clusters on Kubernetes, to back their ZooKeeper applications. The neat thing about the etcd Operator is you can define a cluster and the etcd Operator takes care of normal operations by using the Kubernetes API. apiVersion: "etcd.coreos.com/v1beta1" kind: "Cluster" metadata: name: "example-etcd-cluster" spec: size: 5 version: "3.1.8" Pretty neat! Anyways, the zetcd project is still super young but would love more folks to try it out. As the post says folks have already tried using Kafka, Mesos, and others. [1] https://coreos.com/blog/introducing-the-etcd-operator.html

This guide makes an interesting choice with regards to etcd security, which I'm not sure I'd go with. etcd stores a load of sensitive cluster information, so unauthorised access to it is a bad thing. There's an assumption in the guide that you have a "secure network" and therefore don't have to worry about etcd authentication/encryption. The thing is if you have a compromised container (say) and that container, which has an in-cluster IP address can see your etcd server, then it can easily dump the etcd database and get access to the information held in it... Personally I'd recommend setting up a small CA for etcd and using it's authentication features, there's a good guide to this on the CoreOS site https://coreos.com/etcd/docs/latest/op-guide/security.html

> At my company we just set everything up using cloud-config. A systemd unit boots the kubelet on each server, and static k8s manifests are loaded by the kubelet to run the rest of the k8s components as pods. This is the exact same methodology that i've been using and it's worked rather well. The current CoreOS documentation [1] on running Kubernetes follows this methodology too. [1] https://coreos.com/kubernetes/docs/latest/getting-started.html

I have attempted this using https://coreos.com/kubernetes/docs/latest/kubernetes-on-baremetal.html . One can get quite far, but I am not sure it is worth the effort. I understand this is a vague analogy, but it feels like you're trying to setup email infrastructure when what you really want is to send email. It is a lot easier on the public cloud, or easier still on a managed service.

Thanks for the feedback - may I ask if you've looked at Kubernetes at all? It appears to do exactly what you describe, and I'd love to hear if you evaluated it but found something missing. You can see some details of how this would work in a recent blog post by CoreOS (https://coreos.com/kubernetes/docs/latest/services.html). Disclosure: I work at Google on Kubernetes.

There is a hardening guide in the docs [1] and it would be great if you have ideas/contributions on how to make it more complete. Right now it is mostly focused on reducing remote services. [1] https://coreos.com/os/docs/latest/coreos-hardening-guide.html

Now it[1] just needs a centralized lock service[2] for safe cluster-wide rolling upgrades! The three release channels are already there, with the Omaha upgrade system. 1: https://coreos.com 2: https://coreos.com/etcd

Great work, although I wish they hadn't reused the terms C100K and C1M that have been used to refer to holding many TCP connections open. The timing is an interesting coincidence given recent work on K8s scheduler scalability: https://coreos.com/blog/improving-kubernetes-scheduler-performance.htm…

The CoreOS (https://coreos.com/) security team, or just the core OS security team? If the former, I'm curious what Apple's involvement with that project is.

> However, your code will be unusable by anyone who follows the normal Go way of coding. Well, that's not really true given the major projects using tools like Godeps [1], so while that argument certainly sounds good, it doesn't actually seem to be a problem in practice. [1] https://coreos.com/blog/godep-for-end-user-go-projects/

I think that's what CoreOS[1] is intended for. [1] https://coreos.com/

Yesterday, I've attended a container presentation held by Microsoft. They mentioned CoreOS (https://coreos.com/) for a potential alternative to Docker.

I'm working on something along these lines: https://www.packagelab.com/ The idea is to have a common UI and REST API for building packages and managing repositories across packaging toolchains. Right now it supports rpm+yum and deb+apt. Packages are built in isolated Linux containers using Heroku's buildpack interface. (Would love feedback from anyone who's interested in beta testing.) Also, have you seen the Omaha protocol? https://code.google.com/p/omaha/wiki/ServerProtocol It's used by a lot software, including Chrome and ChromeOS. Recently, CoreOS has built infrastructure with it and they offer a SaaS product for rolling updates. I think they're planning on using it to update Docker containers, too: https://coreos.com/products/coreupdate/

CoreOS has a pretty great update mechanism. You can read about it here: https://coreos.com/using-coreos/updates/ In short, CoreOS maintains two OS partitions, A and B. When an update is available, it is automatically downloaded to the B partition, and upon reboot the B partition becomes active, effectively rotating the partitions.

For those experimenting, you can also switch to the release channel[1] (or beta, if you prefer). CoreOS will not downgrade so you will be on the alpha version until this version is promoted to the channel you subscribe to. This way, when the changes do get promoted, you will be tracking the release channel without any additional changes. [1]: https://coreos.com/docs/cluster-management/setup/switching-channels/

This is excellent news. The lack of a container restart policy was the main reason why I was spending a bunch of time learning CoreOS and fleet. Trying to get CoreOS installed on VPS providers is a huge pain[0], and fleet and etcd are technically not labelled as production-ready (only CoreOS used as a base OS is)[1], so I'm really glad I can go back to vanilla Docker. [0]: http://serverfault.com/a/620513/85897 [1]: https://coreos.com/blog/stable-release/

Wait, little purpose? Isn't that the main purpose? "Applications on CoreOS run as Docker containers." [1] Am I misunderstanding what CoreOS is for or are you? [1] https://coreos.com/

Super great to see CoreOS making it to its first stable release. It really feels like the future. I've been reading about using vulcand to do frontend deploys and traffic management (http://coreos.com/blog/zero-downtime-frontend-deploys-vulcand/) and using ambassadors to do dynamic routing to backend stores (http://coreos.com/blog/docker-dynamic-ambassador-powered-by-etcd/) But it is hard to get my head around this - has anyone actually tied all of these concepts together in a deployment that they've written up?

Easy. Just use deis [1]. Or CoreOS [2], if you're more hardcore. In any case, with the advent of Docker and 12-factor -- not to mention openstack [3] -- Heroku is a commodity or fast approaching it, and will soon face pricing pressure. [1] http://deis.io [2] http://coreos.com [3] http://openstack.org

Great to see an etcd backend. Nice work. One feature I'd love to see is support for an etcd discovery URL (versus having to provide an explicit list of peers). See: http://coreos.com/docs/cluster-management/setup/etcd-cluster-discovery…

Sure are! On the home page ( https://coreos.com ) you'll find links to directions for various providers from EC2 & Rackspace to OpenStack & Vagrant. Each has the exact directions that will get you started with least effort (including image ids where appropriate and URLs otherwise).

CoreOS is already working great on GCE http://coreos.com/docs/running-coreos/cloud-providers/google-compute-e… We also wanted to offer a way for regular Debian users to get easily started with Docker on GCE.