Docker has been a godsend for home labs. People don't need to know where on the filesystem their configs have been scattered (distro dependent). They just need to know how to docker pull and configure their container.
In case you ever wish to change the operating conditions/environment/hardware in the future. Having a consistent operating environment is a big win, in my opinion.
Yes absolutely, but if the hardware requirements for running docker currently doesn't fit on a keychain (a physical one that is), perhaps its not the best choice today for secure password storage.
One reason is that software isn't always distributed in normal distro repositories anymore. People can't (or don't want to) deal with dependency management so they ship an entire (slightly outdated version of an) OS with their application to make deployment foolproof.
The vaultwarden install instructions assume Docker, for example: https://github.com/dani-garcia/vaultwarden. If you want to install native binaries, you're going to have to git fetch/checkout/pull the latest release tag and run `cargo build --features sqlite --release` yourself. Doable in a cronjob, but it'll probably take a compile to build a system like vaultwarden on a low-power ARM core.
Yes, Docker is a black box. You don't know anything, you just launch something without understanding what components it consists of, what are they doing individually, what is their attack surface.
Not to mention that it encourages sloppiness and software bloat. The password manager could be put on a simple MCU device, instead, we have a large non-transparent multi-component installation swept under the rug with Docker. I do not think this is a good thing.
The same can be said of any software that you don't review and compile yourself. Whether I run a Docker container or pull in 500 npm/pip/cargo/gems/composer dependencies, the attack service remains. With Docker these individual layers can be separated and inspected at the very least.
Based on the name, I expected someone to take vaultwarden and make it an αcτµαlly pδrταblε εxεcµταblε that runs on its own without an OS; instead, this is just a quick tutorial for "how to set up vaultwarden".
Comments
Not the OP but maybe bec this is a single use device… why not just install direct on the OS and back the whole thing up?
Docker has been a godsend for home labs. People don't need to know where on the filesystem their configs have been scattered (distro dependent). They just need to know how to docker pull and configure their container.
In case you ever wish to change the operating conditions/environment/hardware in the future. Having a consistent operating environment is a big win, in my opinion.
Yes absolutely, but if the hardware requirements for running docker currently doesn't fit on a keychain (a physical one that is), perhaps its not the best choice today for secure password storage.
Is there a generally supported way to back up an entire Linux installation from the device itself while it's running?
Is there a way to do it without backing up all the os packages?
With docker I can stop the service, then snapshot its data volume, then restart it. And restoring is very easy.
I have no idea how to get that workflow at an os level without a vm manager.
One reason is that software isn't always distributed in normal distro repositories anymore. People can't (or don't want to) deal with dependency management so they ship an entire (slightly outdated version of an) OS with their application to make deployment foolproof.
The vaultwarden install instructions assume Docker, for example: https://github.com/dani-garcia/vaultwarden. If you want to install native binaries, you're going to have to git fetch/checkout/pull the latest release tag and run `cargo build --features sqlite --release` yourself. Doable in a cronjob, but it'll probably take a compile to build a system like vaultwarden on a low-power ARM core.
Yes, Docker is a black box. You don't know anything, you just launch something without understanding what components it consists of, what are they doing individually, what is their attack surface.
Not to mention that it encourages sloppiness and software bloat. The password manager could be put on a simple MCU device, instead, we have a large non-transparent multi-component installation swept under the rug with Docker. I do not think this is a good thing.
The same can be said of any software that you don't review and compile yourself. Whether I run a Docker container or pull in 500 npm/pip/cargo/gems/composer dependencies, the attack service remains. With Docker these individual layers can be separated and inspected at the very least.
Based on the name, I expected someone to take vaultwarden and make it an αcτµαlly pδrταblε εxεcµταblε that runs on its own without an OS; instead, this is just a quick tutorial for "how to set up vaultwarden".