7 ms·

Sounds cool but I think the WordPress implementation is TERRIBLE: it depends on a WordPress fork that is completely outdated, instead of downloading an up-to-da

by ozh 12y ago

Sounds cool but I think the WordPress implementation is TERRIBLE: it depends on a WordPress fork that is completely outdated, instead of downloading an up-to-date fresh archive.

paulproteus 12y ago
I agree -- the current WordPress package needs work. Thank you for trying it and looking into it! Community-wise, one thing we're going to need, as Sandstorm grows, is an ecosystem of app package maintainers. Part of what we're hoping is that more developers of the apps themselves will maintain the Sandstorm ports, like Audrey Tang is maintaining the EtherCalc port. Tech-wise, one thing we're going to need is a solid story for how Sandstorm packages will easily stay up to date with the latest changes as the upstream author releases new updates. I work on+for Sandstorm, and I'm also a Debian developer. Debian is not a shining example with regard to either of the above, and I'm sure we can do even better at Sandstorm.
- tokenizerrr 12y ago
  Is it possible to run arbitrary Docker containers? If so, that could be a solution.
  - paulproteus 12y ago
    It's not currently possible to run arbitrary Docker containers through Sandstorm, since we prefer app packages (we call them SPKs) to be: * Self-contained -- if the app needs MySQL, bundle it; * Able to run with external network access unavailable -- this improves security, since even if an app gets compromised, it's not a big deal since it can't leak any data out to the world; and a few other constraints that are more technical than philosophical. https://github.com/sandstorm-io/sandstorm/wiki/Porting-Guide https://github.com/sandstorm-io/sandstorm/wiki/Porting-Guide hints at them, but I don't quickly find a reference for all these constraints. I'm likely to write such a reference in the next few days/weeks, though.
    - Sarien 12y ago
      How can a COMPROMISED WEBapp ever not be able to leak data while being usable?
      - paulproteus 12y ago
        Here's how: * Backend: Due to Linux network namespaces, the app can't communicate with the network (except over "sandstorm-http-bridge" which allows it to respond to inbound HTTP requests). * Frontend: Due to Content-Security-Policy, the client part of the app can't communicate with any hostname other than the one the app runs on. The CSP header is set by Sandstorm, not the app. So then it has no network access, and therefore even if it is compromised, can't leak anything. This does hinge on the app's dynamic code only being run for logged-in users. For many apps -- imagine a Google Docs spreadsheet only accessible to people within your domain -- this is a pretty straightforwardly reasonable model. Sandstorm handles authentication for apps, so it can enforce this even if the app is 0wned.
        Sarien 12y ago
        I compromise an app, add myself admin account, log-in, download everything. What's stopping me?
        jerf 12y ago
        The only "everything" you should be able to get, if the security is correct, is for the app you compromised, not the other ones running on Sandstorm. No, it does not magically secure applications put behind it (though IIRC it does put a couple of useful tweaks in place, but that's all it can do), but it can prevent "I compromised your WordPress and stole your entire machine's contents."
        ohyeshedid 12y ago
        Is that because of the security of Sandstorm as a platform or because each app would need it's own DB engine bundled with it?
  - mikewhy 12y ago
    Disclaimer: I couldn't get this thing to work reliably at all Panamax[0] might be something to look into. It has app templates that are comprised of Docker images. For example, getting Gitlab up and running is as simple as finding the Gitlab template and pressing "Install". You can also save templates locally, think "Python Web App (db, cache, app server)". [0]: http://panamax.io/ http://panamax.io/
  - kentonv 12y ago
    In addition to what Asheesh (paulproteus) said, see: https://blog.sandstorm.io/news/2014-08-19-why-not-run-docker-apps.html https://blog.sandstorm.io/news/2014-08-19-why-not-run-docker...

by ozh 12y ago

Sounds cool but I think the WordPress implementation is TERRIBLE: it depends on a WordPress fork that is completely outdated, instead of downloading an up-to-date fresh archive.

paulproteus 12y ago

I agree -- the current WordPress package needs work. Thank you for trying it and looking into it! Community-wise, one thing we're going to need, as Sandstorm grows, is an ecosystem of app package maintainers. Part of what we're hoping is that more developers of the apps themselves will maintain the Sandstorm ports, like Audrey Tang is maintaining the EtherCalc port. Tech-wise, one thing we're going to need is a solid story for how Sandstorm packages will easily stay up to date with the latest changes as the upstream author releases new updates. I work on+for Sandstorm, and I'm also a Debian developer. Debian is not a shining example with regard to either of the above, and I'm sure we can do even better at Sandstorm.

tokenizerrr 12y ago
Is it possible to run arbitrary Docker containers? If so, that could be a solution.
- paulproteus 12y ago
  It's not currently possible to run arbitrary Docker containers through Sandstorm, since we prefer app packages (we call them SPKs) to be: * Self-contained -- if the app needs MySQL, bundle it; * Able to run with external network access unavailable -- this improves security, since even if an app gets compromised, it's not a big deal since it can't leak any data out to the world; and a few other constraints that are more technical than philosophical. https://github.com/sandstorm-io/sandstorm/wiki/Porting-Guide https://github.com/sandstorm-io/sandstorm/wiki/Porting-Guide hints at them, but I don't quickly find a reference for all these constraints. I'm likely to write such a reference in the next few days/weeks, though.
  - Sarien 12y ago
    How can a COMPROMISED WEBapp ever not be able to leak data while being usable?
    - paulproteus 12y ago
      Here's how: * Backend: Due to Linux network namespaces, the app can't communicate with the network (except over "sandstorm-http-bridge" which allows it to respond to inbound HTTP requests). * Frontend: Due to Content-Security-Policy, the client part of the app can't communicate with any hostname other than the one the app runs on. The CSP header is set by Sandstorm, not the app. So then it has no network access, and therefore even if it is compromised, can't leak anything. This does hinge on the app's dynamic code only being run for logged-in users. For many apps -- imagine a Google Docs spreadsheet only accessible to people within your domain -- this is a pretty straightforwardly reasonable model. Sandstorm handles authentication for apps, so it can enforce this even if the app is 0wned.
      - Sarien 12y ago
        I compromise an app, add myself admin account, log-in, download everything. What's stopping me?
        jerf 12y ago
        The only "everything" you should be able to get, if the security is correct, is for the app you compromised, not the other ones running on Sandstorm. No, it does not magically secure applications put behind it (though IIRC it does put a couple of useful tweaks in place, but that's all it can do), but it can prevent "I compromised your WordPress and stole your entire machine's contents."
        ohyeshedid 12y ago
        Is that because of the security of Sandstorm as a platform or because each app would need it's own DB engine bundled with it?
- mikewhy 12y ago
  Disclaimer: I couldn't get this thing to work reliably at all Panamax[0] might be something to look into. It has app templates that are comprised of Docker images. For example, getting Gitlab up and running is as simple as finding the Gitlab template and pressing "Install". You can also save templates locally, think "Python Web App (db, cache, app server)". [0]: http://panamax.io/ http://panamax.io/
- kentonv 12y ago
  In addition to what Asheesh (paulproteus) said, see: https://blog.sandstorm.io/news/2014-08-19-why-not-run-docker-apps.html https://blog.sandstorm.io/news/2014-08-19-why-not-run-docker...