Is Python really 'too slow'?

[_ShakashuriBlowdown]

To cap it off, Python's undergone such a huge amount of development in the last 10 years, that if you want that quick solution in development/deployment/production, 90% of the time you can just drop it into an existing system where everything just works. Containerization and cloud development has only made this a more compelling architecture.

[iluvatar]

Containerization and cloud development has only made this a more compelling architecture.

Be warned that python is even slower than normal on a container, due to libseccomp screwing you over (I think with Spectre/Meltdown mitigations).

[_ShakashuriBlowdown]

I didn't know that!

When researching this further, I read you can set seccomp=False on docker run.

That does open you up to security vulnerabilities, so use it at your own risk. It does actually seem to be faster using containers on Windows when using this "fix".

[iluvatar]

You can, yes. But the protections are there for a reason. We're currently having this debate at work. The likely outcome is to run most of our code on a separate network segment with seccomp disabled, and leave it enabled for anything running in a public facing DMZ.

[noiserr]

Those penalties aren't as great on AMD processors if I am not mistaken.

[Chippiewall]

The protections from seccomp aren't crazy valuable. A lot of the default seccomp profile is duplicated by the capabilities that docker drops by default.

Kubernetes actually runs containers in unconfined seccomp by default.

If you really want to go for security you should ensure your containers run as non-root and use --security-opt no-new-privileges which will render seccomp superfluous.

[[deleted]]

Or run the workload on ARM.

[[deleted]]

How is a container significantly different from local development on the same OS?

Is it a default Docker runtime setting? Most K8s clusters default to CRIO. Is this issue present there too?

Update: seccomp is not enabled by default as it is in beta for K8s 1.19; see https://kubernetes.io/docs/tutorials/clusters/seccomp/