What a fun blog post! I'll try this on my own stuff. Shockingly, HAProxy protects extremely well with their http-request-reject, tcp deny/reject and http-silent-drop. Would be interesting to test if HA Proxy could actually mitigate these attacks on a single machine, as long as the port isn't fully saturated with requests!
Moving from classic servers to containers you get:
- Builds with fixed dependencies that never change. Rollback is easy -> what about VMs?
- Easy deployment of a prod environment on a local machine -> yep, that's a nice touch, the only valid point for me!
- Fast deployment -> lol no, Im faster with VMs.
- Easy automation (use version X with config Y) -> valid for VMs and baremetal too
With Kubernetes (or other derivates like Openshift) you get:
- Auto scaling -> you can get it with VMs too
- Fail over -> you can get it with VMs too
- Better resource usage if multiple environments are executed -> you can get it with VMs too
- Abstraction of infrastructure -> Should I really write it?
- Zero downtime deployment (biggest point for my company, we deploy >3 times per week) -> We do on some specific DC (government style) and we release 10-15 times and day with Bare metal servers and ansible
There are applications that do not need Kubernetes or even containers, but is this list really nothing oO? -> None of the arguments convinced me
I can imagine that if you use Kubernetes just like a classic cluster it could seem like an unnecesarry added complexity but you gain a lot of things. -> yes, extra cost and extra skills needed
I did read the article, but that wasn’t immediately clear to me. Maybe something about the formatting of pre-generated docker images in the same line as the compiled versions?
It will be more clear once the video is released :-)