garden-runc-release

Hi Everyone, I am looking for remote opportunities as consultant and contractor. I have more 12+ years software engineering experience working for companies like Telerik and Pivotal. At Telerik, I was a senior engineer building their UI components for Desktop and IOS Devices as well as their cloud IDE (git integration). At Pivotal, I was engineering lead working on Cloudfoundry PaaS, where I was building Garden Linux Containers (an open source containerization technology tailored for CF). After that, I was leading PCF RabbitMQ team where we were building and operating RabbitMQ for Cloudfoundry. Languages: Golang, Ruby, C#, Objective-C, TypeScript, FlowType Web: React, Redux, Redux-saga, Redux-Logic, BlueprintJS Other Technologies: Ansible, BOSH, Concourse CI Methodologies: Scrum, XP, Pair programming and TDD Github: github.com/svett Linke

One thing that really excites me about getting this into runC is that now we can work on making other parts of container orchestration and management run as an unprivileged user. Huge props to the Cloud Foundry team who already have taken rootless containers and have some experimental support for them[1]. It'd be awesome if we could do something similar to Kubernetes so that you could start clusters as an unprivileged user (in my mind the networking is the hardest part and I think the only way right now is to implement pseudo-bridge interfaces in userspace). But I'm pretty excited about the possibilities. :P [1]: https://github.com/cloudfoundry/garden-runc-release/blob/dev...

Thanks for your comment. We (Garden - Cloud Foundry container project) released with the runc patch yesterday (https://github.com/cloudfoundry/garden-runc-release/releases...). It was our understanding from the original report that the vulnerability was mitigated by AppArmor disabling ptrace, by no user process running as pid 1 inside the container, and because in CF buildpack apps, user processes run as unprivileged users. This is the stance communicated in the CVE report. However, with some further consideration and updated information yesterday, we decided it would be prudent to patch and release immediately to be on the safe side. This was communicated to the Cloud Foundry Security team.

> Yep, the OCI is doing great stuff. At the bottom of the Cloud Foundry stack we have Garden-Runc (https://github.com/cloudfoundry/garden-runc-release). In past we had our own homegrown containerization technology and we're super happy to have been able to swap that out entirely in place of runc - it allows us to make use of the significant engineering talent contributed and has enabled us to move faster and reduce risk. Hi! I'm one of the maintainers of runC and I wanted to say that the CF stuff around runC is awesome. Keep it up. :D > I believe the Kubernetes team is working on a simple implementation of the Kube API which is a thin wrapper around runc as well - so you're right, there are some cool things coming around as a result of the OCI. Actually, ocid is mostly being worked on by people from the OCI community (runcom, mrunalp, mys

Yep, the OCI is doing great stuff. At the bottom of the Cloud Foundry stack we have Garden-Runc (https://github.com/cloudfoundry/garden-runc-release). In past we had our own homegrown containerization technology and we're super happy to have been able to swap that out entirely in place of runc - it allows us to make use of the significant engineering talent contributed and has enabled us to move faster and reduce risk. We're also buying into the image-spec for this reason. Right now the focus is in underpinning CF, so although it is production ready functionally, it lacks the pretty fantastic user experience that Docker brings. Perhaps allowing us to reduce our focus on the containerizer, we'll be able to spend more time improving UX - which would be neat. I believe the Kubernetes team is working on a simple implementation of the Kube API

The nature of Garden is to support container managers as Garden backends. Garden itself is just a client/server API spec. For example, [Guardian](https://github.com/cloudfoundry-incubator/guardian-release) is in the works to replace the Linux backend with a thinner runC-based backend. The main value we get from it is having a nice Go API and not having to overhaul everything using Garden every time some shiny new container tech comes out.