{"action":"created","issue":{"url":"https://api.github.com/repos/subuser-security/subuser/issues/216","repository_url":"https://api.github.com/repos/subuser-security/subuser","labels_url":"https://api.github.com/repos/subuser-security/subuser/issues/216/labels{/name}","comments_url":"https://api.github.com/repos/subuser-security/subuser/issues/216/comments","events_url":"https://api.github.com/repos/subuser-security/subuser/issues/216/events","html_url":"https://github.com/subuser-security/subuser/issues/216","id":102995809,"number":216,"title":"Docker isn't perfect","user":{"login":"timthelion","id":1391608,"avatar_url":"https://avatars.githubusercontent.com/u/1391608?v=3","gravatar_id":"","url":"https://api.github.com/users/timthelion","html_url":"https://github.com/timthelion","followers_url":"https://api.github.com/users/timthelion/followers","following_url":"https://api.github.com/users/timthelion/following{/other_user}","gists_url":"https://api.github.com/users/timthelion/gists{/gist_id}","starred_url":"https://api.github.com/users/timthelion/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timthelion/subscriptions","organizations_url":"https://api.github.com/users/timthelion/orgs","repos_url":"https://api.github.com/users/timthelion/repos","events_url":"https://api.github.com/users/timthelion/events{/privacy}","received_events_url":"https://api.github.com/users/timthelion/received_events","type":"User","site_admin":false},"labels":[{"id":355287204,"url":"https://api.github.com/repos/subuser-security/subuser/labels/Future","name":"Future","color":"006b75","default":false},{"id":270854031,"url":"https://api.github.com/repos/subuser-security/subuser/labels/performance","name":"performance","color":"f7c6c7","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/subuser-security/subuser/milestones/8","html_url":"https://github.com/subuser-security/subuser/milestone/8","labels_url":"https://api.github.com/repos/subuser-security/subuser/milestones/8/labels","id":1255490,"number":8,"title":"0.6","description":"- Rework backend to use runc, repeatr\r\n- Divide out subuser runtime from rest of code","creator":{"login":"timthelion","id":1391608,"avatar_url":"https://avatars.githubusercontent.com/u/1391608?v=3","gravatar_id":"","url":"https://api.github.com/users/timthelion","html_url":"https://github.com/timthelion","followers_url":"https://api.github.com/users/timthelion/followers","following_url":"https://api.github.com/users/timthelion/following{/other_user}","gists_url":"https://api.github.com/users/timthelion/gists{/gist_id}","starred_url":"https://api.github.com/users/timthelion/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timthelion/subscriptions","organizations_url":"https://api.github.com/users/timthelion/orgs","repos_url":"https://api.github.com/users/timthelion/repos","events_url":"https://api.github.com/users/timthelion/events{/privacy}","received_events_url":"https://api.github.com/users/timthelion/received_events","type":"User","site_admin":false},"open_issues":11,"closed_issues":4,"state":"open","created_at":"2015-08-14T16:53:22Z","updated_at":"2016-08-12T10:42:17Z","due_on":null,"closed_at":null},"comments":34,"created_at":"2015-08-25T10:32:17Z","updated_at":"2016-12-09T20:31:09Z","closed_at":null,"body":"Docker is not a healthy community. The first and foremost issue that would need to be fixed with Docker, is that most releases break something for subuser:\n- Subuser existed even back in the days that Docker was a front end for LXC. Subuser configured devices via lxc options. When Docker moved to libcontainer, it became impossible to configure devices. I had to write a patch to get that working. This meant 3-4 months of broken subuser as my patch was being reviewed (read ignored).\n- Shortly after 1.0 came out, the docker folks started to care about security. They made a number of changes to the API, including:\n- changing \"id\" to \"Id\"\n- making it so that images could not be labled with 64 character names\n  These changes were breaking for subuser.\n- On a number of occations, `--net=none` has been broken. Most recently in the 1.6 release.\n- Volume mounting options got accidentally changed to \"ro\" and \"rw\" from \"r\" and \"w\" with the 1.7 release.\n\nThis constant breakage can, in the pre-1.0 days, be explained. But It hasn't gotten any better as the project has \"matured\". It seems that docker has changed it's release cycle to one in which there are release candidates. However it seems that development doesn't stop so that people can focus on polishing the new release and there is so much noise in the community that there is no clear and effective way to cummunicate an issue with a release candidate. And comming to the next problem, one can have no confidence that Docker Inc would actually care about fixing issues if they were found.\n\nThat brings me to the last problem:\n\nWhile Docker might seem like a vibrant community with 1066 contributors, the truth is, that Docker is a one company show. There WERE other companies who tried to get on board as well as independent developers such as myself. However, almost all of us have left. Docker has made it very clear that it does not need or want substantial outside help. To some extent, this is an understandable reaction on their part. A number of developers from RedHat were once very involved in the project. However, these developers had a very arrogant attitude towards Docker: They wanted docker changed so that it would follow their design ideas for RHEL and systemd. They often made pull requests with poorly written and undocumented code and then they became very agressive when those pull requests were not accepted, saying \"we need this change we will ship a patched version of Docker and cause you problems on RHEL if you don't make this change in master.\" They were arogant and agressive, when at the same time, they had the choice of working with the Docker developers and writting quality code that could actually be merged. Another thing they often said was along the lines of \"systemd is THE ONE AND ONLY INIT SYSTEM so why do you care about writing code that might be portable?\" Or \"even though the universal method works with systemd now. A redesign has already been planned in systemd, so do it the new systemd way and don't be portable.\"(This is in response to the fact that Docker writes to cgroups, and systemd would like to be the \"sole writter to cgroups\" some time in the future.) I think everyone got fed up with those people, and Docker has rightly pushed them out. But at the same time, Docker Inc seems to have pushed everyone else out too, including me.\n\nOne difficulty for me in analyzing this though, is that the Docker community once seemed vibrant, but I think it never was. I think that it seemed vibrant because there were many people from different places working on it. However, lately many of those poeple have changed their github profiles to show that they work for Docker Inc. My understanding is that those people all worked for Docker from the start (not that Docker hired them) and that I was under the false impression of community diversity from the start.\n\nMy experience working on Docker was painful. Despite the fact that I wrote two code refactorings (fixing a previous version of the networking code and writting the current device code), which should have been of interest to most of the main devs, they hardly ever communicated with me. One exception was Micheal Crosby, who was indeed helpful, however he was the ONLY person working with people outside of Docker, and he was WAY OVERSTREACHED. So his communication, despite being kind and well meaning, wasn't very meaningfull. He just didn't have time to do a good job.\n\nThis lead to two problems with the device code that I wrote and submitted as a pull request:\n- The device code was broken using the LXC backend for many releases. This was due to docker employes patching my code without asking for my review.\n- The [origional release notes](https://blog.docker.com/2014/08/announcing-docker-1-2-0/) for the `--device` flag were _WRONG_. In the release notes, the docker folks wrote that you should use the device flag like:\n\n```\ndocker run --device=/dev/snd:/dev/snd ...\n```\n\nUnfortunately `/dev/snd` is a DIRECTORY and not a device. If the person writting the release notes had simply shot me, the developer, a quick email I would have quickly seen the error and been able to fix it. Instead, the Docker folks experienced a stream of people posting issues asking why `--device` doesn't work, and eventually they changed `--device` to traverse directories searching for devices within them (which in itself is a bit wrong as the mounted devices using this method are static, they don't change after the container is created).\n\nMy poor experience as a Docker contributor: lack of recognition and communication, seems to have been the same for many other contributors. This poor contributor experience is causing the Docker comunity to become less diverse, and this jeprodizes Docker as an open source project. Continuing to write subuser when subuser relies on Docker therefore seems a risky prospect.\n## What other options does subuser have?\n- https://linuxcontainers.org/ - Is this also a one company show with Canonical?\n- https://github.com/coreos/rkt - I don't know anything about this.\n- Any other options?\n## How much work would it be to transition?\n\nSubuser is rather strongly tied to Docker. It would be hard to transition and maintian any resemblence of compatibility. I would have to have a very good alternative.\n## Should subuser move to a new system?\n\nProbably not. The grass is always greener, as they say.\n"},"comment":{"url":"https://api.github.com/repos/subuser-security/subuser/issues/comments/266115521","html_url":"https://github.com/subuser-security/subuser/issues/216#issuecomment-266115521","issue_url":"https://api.github.com/repos/subuser-security/subuser/issues/216","id":266115521,"user":{"login":"NodeGuy","id":2148537,"avatar_url":"https://avatars.githubusercontent.com/u/2148537?v=3","gravatar_id":"","url":"https://api.github.com/users/NodeGuy","html_url":"https://github.com/NodeGuy","followers_url":"https://api.github.com/users/NodeGuy/followers","following_url":"https://api.github.com/users/NodeGuy/following{/other_user}","gists_url":"https://api.github.com/users/NodeGuy/gists{/gist_id}","starred_url":"https://api.github.com/users/NodeGuy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NodeGuy/subscriptions","organizations_url":"https://api.github.com/users/NodeGuy/orgs","repos_url":"https://api.github.com/users/NodeGuy/repos","events_url":"https://api.github.com/users/NodeGuy/events{/privacy}","received_events_url":"https://api.github.com/users/NodeGuy/received_events","type":"User","site_admin":false},"created_at":"2016-12-09T20:31:09Z","updated_at":"2016-12-09T20:31:09Z","body":"[Firejail supports AppImage](https://firejail.wordpress.com/documentation-2/appimage-support/)."}}
{"actor":{"display_login":"NodeGuy"}}