Vulnerability Alert: Avoiding “Dirty Pipe” CVE-2022-0847 on Docker Engine and Docker Desktop

You might have heard about a new Linux vulnerability that was released last week, CVE-2022-0847, aka “Dirty Pipe”. This vulnerability overwrites supposedly read-only files in the Linux kernel host, which could enable attackers to modify files inside the host images from the container instance.

If you use Docker Engine natively, we recommend you should update your Linux OS to a version that has patched the vulnerability, e.g. Linux 5.16.11, 5.15.25, and 5.10.102. 

For those of you using Docker Desktop, we recently released a patch of our own for Mac and for Windows.

Docker Desktop for Mac – update to the latest releaseDocker Desktop for Windows – update to the latest release If you have enabled WSL2 – you need to update the kernel from Microsoft as well. 

To read more about the vulnerability itself, the blog by Max Kellerman provides the details and the blog by Rory McKune shows how this vulnerability could be exploited on containers. 
The post Vulnerability Alert: Avoiding “Dirty Pipe” CVE-2022-0847 on Docker Engine and Docker Desktop appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

Speed boost achievement unlocked on Docker Desktop 4.6 for Mac

Introducing virtiofs

The 4.6 release of Docker Desktop for Mac contains a number of changes that drastically improve file sharing performance for macOS users. Firstly, developers now have the option of using a new experimental file sharing implementation called virtiofs (the current default is gRPC-FUSE). Secondly, improvements have been made to the way that files are synced between the macOS host and Docker VM. During testing with our amazing macOS community of users, we have observed that these changes have reduced the time taken to complete filesystem operations by up to 98%.

For developers, these incredible gains in speed mean less time waiting for filesystem operations to complete (or building project-specific workarounds to improve performance) and more time focusing on innovation!

Understanding common developer workflows

A common developer workflow when using technologies like Symfony or React is to edit source code located on the macOS host while running the app itself in a Docker container. The source code is shared between the host and the container by using Docker volumes, with a command like the following:

docker run -v /Users/me:/code -p 8080:8080 my-symfony-app

This allows the developer to edit their source code, save the changes and immediately see the results in their browser. Changes made to files located on the host system must propagate quickly and reliably to the container file system for the developer to optimize productivity and have a good user experience. This is where file sharing performance is absolutely critical.

Big performance improvements

Performance is vital when application source code is shared between the host and container. For example when a developer uses the Symfony PHP framework, edits the source code and then reloads the page in the browser, the web-server in the container must re-read many PHP files stored on the host. When considering that modern dependency management can easily bring 10k – 100k files into a project (which linearly increases the performance penalty), this can result in poor performance as the host and container keep in sync via the volume.

The recent changes to Docker Desktop for Mac, including the usage of virtiofs, alleviate this problem and bring drastic improvements to file system performance. Specifically, developers working with an early preview of Docker Desktop 4.6 with virtiofs enabled and changes to file syncing included have observed:

A 90% improvement in the time taken to complete a 284MB MySQL import (3m 16s to 18s)An 87% improvement in the time taken to run ‘composer install’ in a large codebase (1m 27s to 11s)An 80% improvement in the time taken to boot a monolithic Typescript app (1m 30s to 18s)

And here are some of the comments we’ve heard from users: 

“This works great on my mac mini M1!, running migrations on my laravel instance is now instant…instead of running for minutes.” (Source: Github user feedback)“My development setup is ridiculously fast now. Thanks everyone!” (Source: Github user feedback)“Looking forward to seeing this enhancement land in a released build. It was like night and day! .” (Source: Github user feedback)

How to enable virtiofs

Virtiofs is only available to users of the following macOS versions:

macOS 12.2 and above (for Apple Silicon)macOS 12.3 and above (for Intel)

To enable virtiofs in Docker Desktop:

Ensure that you are using Docker Desktop version 4.6, available hereNavigate to ‘Preferences’ (the gear icon) > ‘Experimental Features’Select the ‘Use the new Virtualization framework’ and ‘Enable VirtioFS accelerated directory sharing’ togglesClick ‘Apply & Restart’

Your feedback is needed!

Virtiofs is accessible today within Docker Desktop for Mac (version 4.6) and available to all users including Docker Personal free users as well as Docker Pro, Team and Business paid subscription users. 

Please download it, give it a try and let us know how it goes. If you discover any problems, please report them on the Mac filesystem performance thread on our public roadmap. For the moment, we are aware of an outstanding issue where containers running with virtiofs can fail due to permission errors. We have released a fix for this in an experimental Desktop build to the Mac filesystem performance thread and will confirm its stability in the coming days.

Likewise, we’re always interested to hear of any performance benchmarks that you may use to test out virtiofs !

Download button for Desktop 4.6

Thanks to our macOS community

We’d like to say a massive thank you to our macOS community of users for providing brilliant feedback and testing out the feature so rigorously. In particular, the excellent analysis of file system performance conducted by Konstantinos Tsanaktsidis led to valuable insights around file syncing.
The post Speed boost achievement unlocked on Docker Desktop 4.6 for Mac appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

Docker: Nine Years YOUNG

Nine years ago today, March 15, 2013, Solomon Hykes, the founder of Docker, first demoed Docker publicly to the world at PyCon. On stage Solomon noted that, for developers, “shipping to the server is hard,” and thus he and the early team designed Docker to help developers more easily build, share, and run any app, anywhere. The rest, as they say, is history.

Fast forward to today, and thanks to Solomon, hundreds of Docker employees past and present, and millions of developers, community members, contributors, customers, and partners, we are able to celebrate Docker’s ninth birthday and can look forward to many more to come. And while our journey these last nine years has been anything but a straight line, our re-focusing in 2019 on the needs of developers is starting to bear fruit across our community, product, customers, and business.

Sustainably growing Docker was the critical desired outcome of our re-focusing in 2019. The changes we’ve made to our product, pricing, and licensing since then have enabled us to sustainably grow the business while continuing to grow the Docker developer community. To wit, growing sustainably enables us to continue to serve 100% for free 10 million registered Docker developers, 35 million Docker Engine downloads / month, 14 PB of container image storage, 31 PB / month in container image network egress, and much more.

In addition to investing in the community, sustainably growing our business enables us to increase our investment in our product for developers. Since 2019, you’ve seen us consistently deliver against our public product roadmap – most recently Docker Desktop for Linux and a 6X improvement in performance in Docker Desktop for Mac – and there’s much more to come! Be sure to swing by the Docker Community All Hands on March 31 for more birthday celebrations and exciting announcements, and there’s even more to share at DockerCon on May 10.

Happy ninth birthday, Docker community! Here’s to many more years in which we together build, share, and run!

sj

DockerCon Live 2022  

Join us for DockerCon Live 2022 on Tuesday, May 10. DockerCon Live is a free, one day virtual event that is a unique experience for developers and development teams who are building the next generation of modern applications. If you want to learn about how to go from code to cloud fast and how to solve your development challenges, DockerCon Live 2022 offers engaging live content to help you build, share and run your applications. Register today at https://www.docker.com/dockercon/
The post Docker: Nine Years YOUNG appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

Amazon Chime SDK unterstützt jetzt Live-Transkription mit automatischer Spracherkennung

Mit Amazon-Chime-SDK können Entwickler Echtzeit-Audio, -Video und -Bildschirmfreigabe zu ihren Web- und Mobilanwendungen hinzufügen. Die Live-Transkription verwendet eine Integration mit Amazon Transcribe, um eine Live-Audio-Transkription zur Verwendung als Untertitel oder Transkription zu generieren. Ab heute können Entwickler mithilfe der automatischen Spracherkennung die gesprochene Sprache erkennen und Transkriptionen in dieser Sprache erstellen.
Quelle: aws.amazon.com

Amazon EventBridge führt erweiterte Regelfilter- und Ereignisumwandlungsfunktionen in der Verwaltungskonsole ein

Die aktualisierten Konsolenfunktionen von Amazon EventBridge sind jetzt allgemein in allen AWS-Regionen verfügbar, in denen EventBridge verfügbar ist. Kunden können diese neuen Funktionen nutzen, um die Erfahrung beim Testen und Konfigurieren von Ereignismustern zu verbessern, Ereignisse umzuwandeln und Regeln und Ziele einzurichten.
Quelle: aws.amazon.com