One security feature in the upcoming Docker 1.11 is the capability to use an external credential store for registry authentication. The new version will automatically detect a configured external store, if it is available, and use it instead of the JSON file. We’ll be talking more about this in a few paragraphs, but first, let’s see how Docker is currently storing credentials.
Project News
Extending SELinux Policy for Containers
A developer contacted me about building a container that will run as a log aggregator for
fluentd. This container needed to be a SPC container that would manage parts of the host system, namely the log files under /var/logs.
Being a good conscientious developer, he wanted to run his application as securely as possible.
The option he wanted to avoid was running the container in --privileged mode, removing all security from the container. When he ran his container SELinux complained about the container processes trying to read log files.
Introducing Atomic Developer Mode
In this week’s latest release of Fedora Atomic Host, you might notice something
different when you boot the new image. There is now a Developer Mode
entry in
the GRUB boot menu. This blog post will describe why this new feature was added
and what it does.
One of the confusing things that newcomers encounter when they want to try out Atomic Host is setting up cloud-init. Currently, it is impossible to use an Atomic Host image without providing cloud-init with a data source. In the absence of a source, cloud-init will try connecting to various known metadata URLs for about four minutes and then give up.
ADB-Atomic Developer Bundle 1.7.1 Released
Project Atomic is pleased to announce the release of the Atomic Developer Bundle (ADB) 1.7.1, a Vagrant box that provides a ready-to-use development environment for container based applications. With the ADB, developers can dive right into producing complex, multi-container applications. The ADB is available for Microsoft Windows, Apple OS X, and Linux distributions.
The 1.7.1 release is primarily a bug fix and enhancement release.
Projectatomic.io Running in Atomic App
Since Atomic App has released version 0.4.2, I decided it was past time
to make the atomic-site into an Atomic App instead of using a shell script that
wraps Docker to test it. The new setup is a big improvement, and a useful
guide to Nuleculizing
your own apps.
As you know, the purpose of Atomic App and Nulecule is to give you a provider-agnostic way to specify multi-container applications and orchestration metadata that stays with the application image(s). Eventually, this will allow for single-command deploys of even large, scalable apps involving many containers. For now, it enables us get rid of some hackish shell scripting around Docker in our atomic-site test setup.