undefined | Better HN

0 pointsjstream674y ago0 comments

If you are on AWS you should check out ECS Fargate (serverless). It is really really good. Probably one of their more polished products.

If you want to stay on the Kubernetes route check out k3s. Super easy to setup and usable for small production workloads

0 comments

7 comments · 3 top-level

Sohcahtoa824y ago· 4 in thread

As a security engineer, I always cringe when anything involving containers is referred to as "serverless".

I always thought that one of the advantages of going serverless was that you didn't have to worry about keeping the underlying operating system up-to-date. No needing to do a monthly "sudo apt update && apt upgrade" or whatever. But containers throw that all away when container images enter the world.

Instead of updating your operating system, you're updating your images...and it's basically the same thing.

OJFord4y ago

Is anyone's goal of 'serverless' that they no longer have to deal with updating the OS?

Most would say even a server-ful system (k8s, or whatever) should be considered 'cattle not pets' with immutable nodes replaced as needed anyway. No update, just replace. Just like building a new image and having new pods (or serverless whatevers) pull it.

thakoppno4y ago

The cattle not pets abstraction always struck me as wildly bizarre. Whoever came up with that phrase, did they grow up on a farm?

I’ve never cordoned off an individual head of cattle and lobotomized it, which is kinda what we do when debugging issues. We take the pod out of rotation, flip a bunch of configs, then give it some traffic to see the new debugging statements.

Sohcahtoa824y ago

From a purely security standpoint, "updating your OS" and "updating your image" are equivalent. What matters to the security people are that you're running the latest OpenSSL that isn't vulnerable to the newest branded vulnerability.

If you're truly "serverless" by my interpretation of it, then you wouldn't care. Your cloud provider will have updated their infrastructure, and that's all that matters.

1 more reply

kuschku4y ago

AppEngine was the original serverless platform

jeffwask4y ago

I second this. There are a few limitations in Fargate that are annoying but overall it's solid and easy to use.

netfortius4y ago

How does k3s compare with MicroK8s, for the purpose of this topic?

j / k navigate · click thread line to collapse