Profile picture
jessie frazelle @jessfraz
, 7 tweets, 1 min read Read on Twitter
Seems to be some confusion about the difference between running a container as root without "privileged" & actually being unprivileged. This runs as root in the container.. calling it unprivileged is only in the context of the container "privileged" flag.
cloudplatform.googleblog.com/2018/04/introd…
"privileged" flag set to false != Linux unprivileged user, just so that's clear.
Naming that flag privileged was a mistake. Because the inverse is not true.
Shoulda been called super duper unsafe so the inverse only "kinda unsafe" is true :p
Anyways not trying to throw shade, just trying to make sure everyone knows the difference. Also an important lesson in naming things and the fact the "privileged" flag was a design mistake to begin with because of confusion like this.
whats even worse tho is you are actually _worse_ off running this tool than you were mounting the docker socket, because at least docker uses the default seccomp profile while building and this does not have that enabled...
I drew a picture just so we are clear.
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to jessie frazelle
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

More from @jessfraz see all

Profile picture
Strong agree. Everyone wants actual isolation, but tbh I’m not sure k8s is the best abstraction for the job. It’s so complex and leaves so much room for error. One config gone wrong or one missed patch and it’s game over for your cluster.
You’d need to hire a perfectionist to set up your cluster perfectly and then maintain it for eternity and at that point might as well just build your own orchestrator you trust. And have a team continually pass it down.
It’s a trade-off invest in one of the few people in the world who can actually create a secure cluster or hire folks who can schedule VMs on different nodes. It’s not rocket science, just code.
Read 6 tweets
Profile picture
If you haven't seen it "The Power of Introvert" TED talk is great, Susan Cain talks about how she forced herself to be a extrovert to blend/prove she could, but then goes into how introverts bring extraordinary talents & abilities to the world ted.com/talks/susan_ca…
It talks about how Introverts are often great leaders and managers because they let the people below them shine and are not afraid of that versus extroverts might get so excited by something they overlook other ideas.
"this turns out to have a special power all its own, bc people could feel that these leaders were at the helm not bc they enjoyed directing others & not out of the pleasure of being looked at; but bc they had no choice, bc they were driven to do what they thought was right"
Read 3 tweets
Profile picture
I love how everything internally at github is a repo...

Want access to a thing? PR the repo for access.
Want to plan an event at HQ? Go to the events repo.

I understand this world.
They’ve replaced turtles with repos. It’s repos all the way down.
I’ve worked at a lot of different companies and this is the one that most closely aligns with the weird world I created for my infrastructure etc.
Read 5 tweets

Related threads

Profile picture
One need not hold a brief for @dewamavhinga to realise how shocking, outrageous & unacceptable it is for Strive Masiyiwa to accuse Dewa of cyberbullying his wife; & top that by peddling his crap accusation on the Internet while name dropping, in the hope of costing Dewa his job!
1/24 The self-righteous outburst by #StriveMasiyiwa, supported by his fellow bible-quoting juntapreneurs, in response to a polite & genuine concern by @dewamavhinga reveals he holds himself as an untouchable who is beyond criticism. Yet his closet is full of despicable skeletons!
2/24 #StriveMasiyiwa has escaped scrutiny, thanks to Zimbabwe's flawed public discourse which has never been about facts, truth or ideas but about "good guys" versus "bad guys"; presumed to be such by definition, not by deed. So Zimbabwe, sadly, has no culture of truth-telling!
Read 50 tweets
Profile picture
(THREAD) Reporters' confusion over the difference between direct and circumstantial evidence has led to a dangerous false equivalence between Cohen's claim Trump knew of the 2016 Trump Tower meeting and Trump's denial. There's ample evidence Trump knew—read this thread to see it.
1/ Direct evidence is seeing it rain. Circumstantial evidence is waking up, looking out your window, seeing that the grass is soaking wet, and taking that as *some* evidence it rained the night before. The *overwhelming majority* of evidence in criminal cases is *circumstantial*.
2/ Because reporters think—contrary to fact—that direct evidence isn't just the primary but in fact the only form of evidence in criminal cases, they're trying to "solve" the June 2016 Trump Tower meeting mystery by comparing the direct evidence each side has publicly presented.
Read 52 tweets
Profile picture
Tweeps: short thread here on the soul of America, and how the cynics who believe we are failed and done and burn it all down -- from the left or right -- are dead wrong. /1
I spent the afternoon in 2 conversations. The first was w/ one of my oldest friends, who is deeply learned & intellectual, caring & decent -- and now explains everything POTUS does as pragmatic. Because he's smart and thoughtful, there are some points worth explaining. /2
Core logic:

1) system is so broken, maybe this crazy sh*t POTUS does can break it more so it can be fixed. Nothing worked before: why NOT this?

2) yeah, awful things are happening, but that isn't about me. I like that POTUS says it's ok to think about my homestead first /3
Read 22 tweets
Profile picture
It's time to write a thread debunking @seriouspod's serious mischaracterization of the law, bad faith, bullying, non-engagement with my girl and collabatrice @aimeeterese on #metoo/#metooism. Firstly, you can listen to the interview here: seriouspod.com/sio145-left-cr…
This is mostly in response to the 'addendum' that @seriouspod appends to the end of the interview, wherein he seeks to further clarify (?) what he sees as @aimeeterese's 'nonsense' interventions. I will focus on one aspect here: his raging misunderstanding and mischaracterization
of the Canadian @SCC_eng case R. v. J.A. (2011) -- you can read the decision here: scc-csc.lexum.com/scc-csc/scc-cs… …. (@seriouspod only references a @VICE article, which apparently is the extent of his research). Everything @seriouspod says in his addendum is wrong:
Read 13 tweets
Profile picture
Some thoughts about MtF transition, FFS, conformity, gender stereotypes, and "cis assimilation."

If you're feeling dysphoric or likely to be triggered by a trans woman dissecting what she thinks is "male" about her face, please don't read.
Some people interpreted my last video as taking an anti-FFS (facial feminization surgery) stance, because evil Tiffany talks about wanting it.

Actually, I want FFS myself, and that scene is a parody of the way people react when I mention it.
In fact I've learned to avoid mentioning that I want FFS most of the time because people's reactions, trans and cis, range from polite neutrality to outraged indignation.
Read 49 tweets
Profile picture
UNFAITHFUL SHEPHERDS

"Many years ago, the then president of The National Council of Churches warned that the danger of the great religious awakening taking place in our country, might become fanatical and be carried into our political and business life!
"Perhaps this was a fair assessment, that is, if you conflate #Christian #Zionism with religious awakening. Unfortunately, these "fanatical" #Evangelicals have 0 faith in the #Christian religion to which they give empty lip service--while paying homage to those who hate #Christ.
"For lack of faith in the actual #Bible, #Evangelicals make Scofield’ Notes, (Scofield! A drunkard and a con-man allied with the Satanist, Darby) --#Evangelicals have turned Scofield’s NOTES into a DIABOLICAL FORCE in our #national life.
Read 177 tweets

Trending hashtags

#fakenews #Christian #DailyNews #righteousness #smarticities #prince #Patriots #Matthew #KAG #aii #Econet #owledition #integration #congregations #corruption #cursed #safety #Malachi #Comeymemos #Where_Is_She #Witiko #failed #Masiyiwa #45DaysOfElvisCostello #politicians

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member and get exclusive features!

Premium member ($3.00/month or $30.00/year)

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!