On Docker
medium.com/on-docker · Company blog · on HN since 2015
On Docker is a Medium publication with posts on container platforms, overlay networks, secret management, and Docker development environments.
What HN saysHN commenters link its 2017 secret management article, citing it to point out that early Kubernetes secrets were not very secret.
16HN people shared it
4linked it in comments
23stories submitted
112story points
9 years agolast shared
2015people per year2026
Most-shared posts
- 1Secrets and LIE-Abilities: The State of Modern Secret Management (2017)6 people · 59 points · first shared 2017 · 3 comments on HN
- 2Evaluating Container Platforms at Scale5 people · 17 points · first shared 2016 · discussion on HN
- 3Docker Networks: Discovering Services on an Overlay3 people · 8 points · first shared 2015 · discussion on HN
- 4Real Development Environments with Docker2 people · 6 points · first shared 2015 · discussion on HN
- 5Docker Swarm: Flat File Engine Discovery2 people · 4 points · first shared 2016 · discussion on HN
- 6What’s Montague: Docker User Problems and Patterns2 people · 3 points · first shared 2015 · discussion on HN
- 7Publishing Docker Images with Automated Builds2 people · 2 points · first shared 2015 · discussion on HN
- 8Federated Clusters with Docker Swarm1 people · 4 points · first shared 2016 · discussion on HN
- 9Docker Overlay Networks: That Was Easy1 people · 4 points · first shared 2015 · discussion on HN
- 10Opinion: What Should I Run in My Containers?1 people · 2 points · first shared 2015 · discussion on HN
- 11Toward a Production-Ready Docker Swarm Cluster with Consul1 people · 2 points · first shared 2016 · discussion on HN
- 12Criteria for Selecting a Docker Image Distribution Method1 people · 1 points · first shared 2015 · discussion on HN
What HN people wrote when they linked it
peterwwillis · 2017-09-19
> By far the easiest
Secret management is as complex as the system which relies upon it. Vault is not as easy as many other tools designed for simple systems. GPG by itself is often enough to manage secrets.
There are probably 40 or more secret management solutions out there, many tailored for specific uses. Most CMS's have their own secret management baked in. Most orchestration and infrastructure tools do too. Four different solutions are called 'Vault'. There are at least 5 solutions just for Amazon. Depending on your platform, something other than HashiVault may be easier to adopt.
Here's some reviews of a dozen different solutions: https://gist.github.com/maxvt/bb49a6c7243163b8120625fc8ae3f3cd https://medium.com/on-docker/secrets-and-lie-abilities-the-state-of-mo… https://www.threatstack.com/blog/cloud-security-best-practices-finding… https://www.youtube.com/watch?v=OUSvv2maMYI&feature=youtu.be
tdurden · 2017-11-04
> Kubernetes had support for secrets in its 1.0 release all the way back in 2015
...but they weren't all that 'secret' [1]
1.https://medium.com/on-docker/secrets-and-lie-abilities-the-state-of-mo…
tmzt · 2017-03-03
The kublet API hardening looks very useful and there seems to a lot of good (security) stuff coming with each release.
In many environments, however, other aspects of Kube's security prove inadequate. For instance, there is currently no way to protect secrets in an environment requiring an HSM for certain keys. In contrast, secrets are stored in an etcd server accessible to the entire cluster (please correct me if this is out of date.)
One article discussing this:
https://medium.com/on-docker/secrets-and-lie-abilities-the-state-of-mo…
justincormack · 2017-02-09
Comparison of this with other secretes management frameworks here https://medium.com/on-docker/secrets-and-lie-abilities-the-state-of-mo…