Top all-time · #1974
Red Hat
Company blog · rhelblog.redhat.comsystemssecurity
Red Hat is the company blog at rhelblog.redhat.com, writing about systems and security. Since 2014, 38 different Hacker News readers have linked it 49 times, most often “Introducing kpatch: Dynamic Kernel Patching”. The last post was in 2023, but the archive is still widely read.
Too few sampled comments (13) to say how often HN recommends it.?
Why HN links it
Red Hat's engineering blog on Linux containers, Docker, RHEL Atomic Host, kpatch, VDO compression and SELinux. HN commenters mostly link its posts as background or supporting references.
Summarised by Claude from a sample of 13 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
The latest on the world’s leading enterprise Linux® platform
Most-linked posts?
- Introducing kpatch: Dynamic Kernel Patching4 people · 4 mentions · first linked 2014-02-26
- Pushing the Limits of Kernel Networking3 people · 3 mentions · first linked 2015-09-30
- Rkt, Appc, and Docker: A Take on the Linux Container Upstream3 people · 3 mentions · first linked 2015-05-06
- /2017/01/13/selinux-mitigates-container-vulnerability/2 people · 2 mentions · first linked 2017-04-14
- Random Numbers in Virtual Machines2 people · 2 mentions · first linked 2015-03-11
- How Badlock was discovered and fixed2 people · 2 mentions · first linked 2016-04-18
- Mixing in-kernel / kernel-bypass networking with the bifurcated driver2 people · 2 mentions · first linked 2015-10-02
- Building a Secure and Manageable Container Software Supply Chain2 people · 2 mentions · first linked 2016-05-18
What Hacker News says?
This exploit is interesting, but if you are doing container security correctly it’s actually not a big deal. In particular if you are setting per-container usernamespaces, like you ought to be, then this exploit doesn’t do anything. In fact you can actively give a usernamespaced container any CAPs you want, because they are isolated to that container’s uid:gid offset. Obviously, giving containers unecessary CAP priv…
Comment linking /2016/10/17/secure-your-containers-with-this-one-weird-trick/
on “Escaping Docker container using waitid() – CVE-2017-5123”Submitted Docker 0-Day Stopped Cold by SELinux as a story · 275 points
HN discussionContainer virtualization in Linux is actually quite old. First appearance in Linux around 2001: http://rhelblog.redhat.com/2015/08/28/the-history-of-contain... and the concept and real practice realization (in commercial products) of containers is even older. It has roots back to 1979! https://dzone.com/articles/evolution-of-linux-containers-fut... Docker is only a philosophy (one application in one container) and t…
Comment linking /2015/08/28/the-history-of-containers/
on “Bi-Directional Replication for PostgreSQL v1.0”Submitted Dropping Linux capabilities to improve container security as a story · 175 points
HN discussionThis is why I'm really hoping RDMA [1] will catch on soon. It would be great if there was a cloud provider that would enable this feature on some of their offerings. Amazon has done something similar by allowing kernel bypass via DPDK [2] with their ENA offering but Kernel bypass is inferior to RDMA in so many ways IMO. At this point we have 200Gbit/s NICs being provided by Mellanox [3]. CPUs aren't getting any fast…
Comment linking /2015/09/29/pushing-the-limits-of-kernel-networking/
on “Turtles on the Wire: Understanding How the OS Uses the Modern NIC (2016)”Submitted Pushing the Limits of Linux Kernel Networking (2015) as a story · 94 points
HN discussionAgreed, that's why I published this: http://rhelblog.redhat.com/2016/02/24/container-tidbits-can-...
Comment linking /2016/02/24/container-tidbits-can-good-supply-chain-hygiene-mitigate-base-image-sizes/
on “Things to avoid in Docker containers”Submitted When Should I Break My Application into Multiple Containers? as a story · 90 points
HN discussionCheck out Project Atomic http://www.projectatomic.io/ . Or its downstream project RHEL Atomic Host. The whole update process for the host is much simpler. Read more abou it here: http://rhelblog.redhat.com/2015/04/01/red-hat-enterprise-lin... Note: I am not related to Redhat, but we are considering Docker, too. And we are evaluating how would Atomic fit in our infrastructure.
Comment linking /2015/04/01/red-hat-enterprise-linux-atomic-host-updates-made-easy/
on “Over 30% of Official Images in Docker Hub Contain Security Vulnerabilities”Submitted GCC Receives ACM’s 2014 Programming Languages Software Award as a story · 57 points
HN discussionFor data compression it uses the LZ4 format [1] (real-time LZ77-like data compressor -without entropy encoding, just string references and literals-, with small blocks so its LUT-based O(1) search is always in the data cache). [1] https://rhelblog.redhat.com/2018/02/05/understanding-the-con...
Comment linking /2018/02/05/understanding-the-concepts-behind-virtual-data-optimizer-vdo-in-rhel-7-5-beta/
on “A look at VDO, the new Linux compression layer”Submitted Random Numbers in Virtual Machines as a story · 56 points
HN discussionWe are building a lot of tools to simplify run/build move [1][2][3]: [1]: Run within Kubernetes: https://github.com/kubernetes-incubator/cri-o [2]: Run Standalone: https://github.com/projectatomic/libpod/blob/master/docs/pod... [3]: Build: https://www.projectatomic.io/blog/2017/11/getting-started-wi... [4]: Move: https://rhelblog.redhat.com/2017/05/11/skopeo-copy-to-the-re...
Comment linking /2017/05/11/skopeo-copy-to-the-rescue/
on “A Practical Introduction to Container Terminology”Submitted Pushing the Limits of Kernel Networking as a story · 50 points
HN discussionVery spammy content site. Official redhat blog has better info: http://rhelblog.redhat.com/2015/03/04/welcome-to-the-world-r... http://rhelblog.redhat.com/2014/12/04/top-7-reasons-to-use-r...
Comment linking /2014/12/04/top-7-reasons-to-use-red-hat-enterprise-linux-atomic-host/
on “Red Hat Introduces New Linux OS for Containers”Submitted Live Kernel Patching Update as a story · 20 points
HN discussionDespite the plethora of Docker articles here on HN, I haven't paid much attention to containers. Reading this article, I get the impression that they occupy a niche somewhere between a chroot jail and a VM. The question is, how to deploy an application in this kind of environment? Maybe I build a minimal container and find that a DBMS works fine until it does something like dlopen("/usr/lib/libxml2.so"). Oops, rebui…
Comment linking /2014/10/29/containerizing-databases-with-red-hat-enterprise-linux/
on “Introducing the “rhel-tools” for RHEL Atomic Host”Submitted (Linux And) the Enduring Magic of Unix – Red Hat Enterprise Linux Blog as a story · 9 points
HN discussionKsplice is now owned by Oracle, meaning it's dead and buried (unless you give Oracle your moneyz). Look at KPatch (included in RHEL7 as tech preview, will probably mature in subsequent minor version updates): http://rhelblog.redhat.com/2014/02/26/kpatch/
Comment linking /2014/02/26/kpatch/
on “Ksplice: Automatic Rebootless Kernel Updates (2008) [pdf]”Submitted Rkt, Appc, and Docker: A Take on the Linux Container Upstream as a story · 9 points
HN discussionYes it will. Although some of the tuning there-in can be used for improving performance on any workload (handling NUMA, for example), it's probably not necessary for the majority of environments because it involves intimate knowledge of hardware, software and application stack. It also talks about disabling a bunch of power management which is really only necessary when you're chasing microseconds. BTW if you're int…
Comment linking /2015/01/12/mysteries-of-numa-memory-management-revealed/
on “Low Latency Performance Tuning for Red Hat Enterprise Linux 7”Submitted Rkt, appc, and Docker: A Take on the Linux Container Upstream as a story · 7 points
HN discussionYou should at least isolate all your containers from the host machine using a virtual machine. LXC security can doubtless be mis-configured; how much info can you share regarding your setup? From a few minutes research it sounds like you need user namespaces and seccomp for starters. Redhat|OpenStack relies on SELinux much more than seccomp: https://news.ycombinator.com/item?id=14220503 http://rhelblog.redhat.com/20…
Comment linking /2017/01/13/selinux-mitigates-container-vulnerability/
on “Ask HN: Can tux.io rely on LXC's security?”Submitted Mitigate TCP SYN Flood Attacks with Red Hat Enterprise Linux 7 Beta as a story · 5 points
HN discussionYep, http://rhelblog.redhat.com/2017/01/13/selinux-mitigates-cont...
Comment linking /2017/01/13/selinux-mitigates-container-vulnerability/
on “Keepdisablingselinux.com”Submitted Container Tidbits: Can Good Supply Chain Hygiene Mitigate Base Image Sizes? as a story · 4 points
HN discussionSubmitted Pushing the Limits of Linux Kernel Networking as a story · 4 points
HN discussionSubmitted Rkt, Appc, and Docker: A Take on the Linux Container Upstream as a story · 3 points
HN discussionSubmitted Containers: Stumbling on the Road to Utopia as a story · 3 points
HN discussionSubmitted Introducing kpatch: Dynamic Kernel Patching as a story · 3 points
HN discussion
