fabiokung·12 anni fa·discussGreat response."..., or ideally don't grant root access to the application."+1
fabiokung·12 anni fa·discussIt's possible, but only part of a possible solution. Those tools still would need a (standard) place to read cgroup specific data from inside the container.
fabiokung·13 anni fa·discussHeroku engineer here. Thanks for the suggestion, we will definitely consider it in the future.Meanwhile, there is an add-on that does exactly this: https://addons.heroku.com/proximo
fabiokung·13 anni fa·discussIt is still abstracted, nothing changes from the point of view of most applications.It just opens more possibilities and increases the isolation.
fabiokung·13 anni fa·discussNot all services support unix domain sockets. It's one more option on the table, but I agree that domain sockets should be favored in most cases.
fabiokung·13 anni fa·discuss`heroku run bash` is still the best option, but I've always wanted to ssh into heroku dynos myself, so I did this:https://github.com/fabiokung/heroku-ssh
"..., or ideally don't grant root access to the application."
+1