The sad state of sysadmin in the age of containers (2015)

Ex Amazon here. Most grumpy system engineers did not disappear: we got hired by Google/Amazon/etc to build large-scale infrastructure... and sometimes sell it back to you as a service. Believe me or not, most of the underlying infra does not run on the popular technology of the year. Far, far from it. That's why it works. Modern devops, with its million tools that break backward compatibility every month sometimes becomes the running joke at lunch.

Ever tried to security update a container? The whole point of using a container is that you can destroy it and build a new one easily. The new one should be built using up-to-date packages with security patches applied (and tested, obvs). Using the 'pets versus cattle'[1] analogy, patching a container feels like you're treating it like a pet. You should just kill it and get a new one instead. [1] https://thenewstack.io/how-to-treat-your-kubernetes-clusters...

I'm raising my eyebrow a bit while reading this. It conflates build tools, Debian packages, and Docker containers as one big tangled mess or abstraction. More than half of it is about everything BUT containers. There are proven methods for providing security and governance of containers in data centers. It's a nice rant, but lacks the whole picture.

When you read words like: "Nobody seems to know how to..", you should mentally translate this to "_I_ don't know how to ... and I am unwilling to learn" At my job, I've spent a lot of time making the existing software reproducible. It's tedious and time-consuming, but also pretty straightforward. Take that "sudo curl" script, read every line, tear it apart, and make nice, installable .deb. Write a makefile which downloads requirements from servers _you_ trust and runs the…