Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

At some point I emailed Linus to ask for his advice but he never replied. That was a personal initiative though, not on behalf of Docker.

I did speak to Greg several times.

I think over the years there was natural overlap, people who contributed to Docker would also be kernel contributors. Especially when we spun out runc, containerd, which created a more vendor-neutral space for maintainers to focus on the bottom of the userland stack with minimum drama.

To the extent that Red Hat employees overlap with kernel folks, that made it more difficult to collaborate since Red Hat was overtly aggressive towards Docker, and generally made our engineers feel unwelcome on "Red Hat turf". I discovered that they had devolved into a toxic company with a facade of benevolence. This made me sad because Red Hat was an inspiration to me. One of those "don't meet your heroes" situations.

Not sure what you meant by the "ignoring" part.

 help



Since 2006 first as part of the Ottawa Linux Symposium and later as part of the Linux Plumbers Conference we had yearly in person meetings.

We had public discussions on the Linux Kernel mailing list and later on the containers list.

It was a collaborative effort from vserver, openvz, IBM, and Linux Networx, and google. I think those were all the original groups, my apologies if I have forgotten someone.

After Docker made a splash I occasionally asked other developers if they had any contacts at Docker. To the best of my knowledge we never received a bug report, or a feature request. No one from Docker ever showed up at any of our meetings.

I know at one point I wanted to let someone know that Docker they were holding the pieces wrong when it came to security.

Eventually I think one of the OpenVZ guys wound up working for Docker for a time. But that was quite late in the timeline.

I was passing through RedHat about the time of the spat you mention. My impression at the time was that Docker never worked well with anyone, and after some frustrations trying to cooperate the RedHat userspace folks decided it was easier to get a real standard without Docker.

At that point I had gotten the unprivileged user namespace support into RedHat's kernel and changed a lot of minds about it's utility.

I don't remember Docker ever picking up unprivileged user namespace support and as a result was a security disaster waiting to happen.

It felt to me like Docker treated the userspace API for containers like most folks treat the POSIX API. Fixed in stone. In fact there was a lot of wiggle room, and opportunity to shape things for anyone who was willing to dive deep into the technical details.


Docker worked well with lots of people.

Red Hat was frustrated with us because they were used to calling the shots. They couldn't fathom that we would refuse a pull request from them. Well guess what, every project is entitled to saying no. And Red Hat's contributions were just overall not good, or they didn't bother to consult with the maintainers on our design principles - like independence from the underlying OS distro.

You're reminding me why working with that company was such a pain. Always with the fucking superiority complex and passive aggressive drama.

As for a "security disaster waiting to happen". My view was, and remains, that the only isolation you can trust is the hypervisor. Kernel level isolation is not strong enough, and unprivileged user namespaces never actually mattered in cloud architectures. Your work on that feature was just security theater and ultimately useless, so spare me the lecture.

I do think Docker embraced user namespaces after my time but I couldn't care less.




Consider applying for YC's Winter 2027 batch! Applications are open till November 2.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: