Medallia and Redhat Talk Docker+Ceph

All the object storages have some ...erm... peculiarities. For example, S3 is very 'eventually consistent' and if you think that you you'll be able to access an object immediately after you write it, then you'll get some nasty surprises. And they are especially nasty because they happen only during high load.

Then there's a question of performance. Individual S3 connections are fairly slow (2-10 megabytes per second, top) but you can have literally thousands of them and they scale almost indefinitely. You can have a cluster of Hadoop servers hammering the S3 storage and it will work just fine. If you try the same pattern locally - you're going to be surprised.

Then there's a question of metadata. While GETs and PUTs on Amazon S3 are insanely fast, metadata operations (LIST) are limited to about 100 per second before you are throttled. Again, that's not something that you'd expect from a single server with an SSD.

So making abstractions at the cloud API is a doomed enterprise.

But I think that containers are a great way to have better security too, because of better componentization.

Why ? Because you are only running one process/application (in case of application containers like Docker and trends like microservices). This really reduces the attack surface over the network. Because these are single purpose applications we (community) have the potential to allow these processes to only do what they are supposed to do.

Remote shell ? There is no shell in your container, maybe even most syscalls aren't even allowed if we create good profiles.

Just like Docker-like application containers can make deploying easier it has the potential to make doing security easier.

An other reason is, if you have a Docker container with PostgreSQL (possibly replicated to multiple machines) how many people will have to make a security profile for running such a service ? Not many if we have a way to share them.

The Docker Security team also talked about this in I believe this video: https://www.youtube.com/watch?v=8mUm0x1uy7c

Those 2 came from Square and as part of the security team there they tried to make deploying security easy:

https://www.youtube.com/watch?v=lrGbK6fE7bI

One of the things they did was mutual TLS auth between all services and frequent key rollovers.

I guess it's their attempt at the OpenBSD motto: secure by default.

Something else I like is some one the persons working on the HP Openstack Cloud (including Public) said:
How do you mean log into a machine ? You can't. It just sends logs with errors to a logserver, there is no remote login.
These are all machines which are deployed and configured with automated tooling (like configuration management). At install time (actually they are using imaging) it pulls the machine configuration information over the network and configures itself.

If you look at for example RancherOS, they are running nothing on the host. It's all containers.

I think there is a lot of potential to get it right. Will we end up at that place... I don't know.

I am fully convinced that hybrid clouds are a loser solution. None of the "big three" (AWS, GCE, Azure) are emphasizing these for good reason: most people don't want them and they are both an architectural and business dead-end. RedHat is promoting hybrids partially because its all they *can* do...they simply don't have the resources to go build dozens of giant data centers.

Hybrid clouds just move your complexity around and mutates it by coupling it to new, immature tools (which Docker is one). What do you get? You've got the "lock in" you dread by using Openshift or whatever, yet you also have to provision a seven figure budget for ops and hardware, and you'll still probably do a crappier job than AWS.

I'd rather just roll-my-own than deal with something like OpenShift etc...I have zero interest in dealing with tens of thousands of lines of alpha quality code, open source or not.

Thats not to say AWS, GCE and Azure aren't without flaws, but the biggest danger so far is that they could gouge you once they have all your data and operations internalized. So far competition is keeping that from happening, and frankly all of these vendors realize that to abuse customers at this stage of the market would be suicide.

Indeed if you look at some of the stuff AWS is doing with Lambda and Kinesis...I don't even think it is possible for a single entity to roll something out like this...the only way you are going to get stuff like that is with a big bet.

> If you use a RDBS then keep a Amazon VPS or Rackspare or whatever active and have it replicate the stuff you have on site.
> If some other 'clouder provider' has some fire sale on capacity you can take advantage of it instantly without having to
> bother your programmers or change anything in your business. Just get a account and deploy.

Why? You can usually just pick up the phone and have your AWS rep start discounting you. Its easier than playing roulette with your business by hunting around for cheap VPS hosters.