|
| 1 | +--- |
| 2 | +title: "Telepresence vs mirrord" |
| 3 | +hide_table_of_contents: true |
| 4 | +--- |
| 5 | + |
| 6 | +## Telepresence |
| 7 | + |
| 8 | +Telepresence is a very feature rich tool, designed to handle a large majority of use-cases. You can use it as a cluster VPN only, or use one of its three different ways (replace, intercept, or ingest) to engage with the cluster's resources. |
| 9 | + |
| 10 | +Telepresence is intended to be installed in the cluster by an administrator and then let clients connect with a very limited set of permissions. This model is generally required by larger companies. |
| 11 | + |
| 12 | +The client can be either completely contained in Docker or run directly on the workstation. The latter will require the creation of a virtual network device, and hence admin access. |
| 13 | + |
| 14 | +## mirrord |
| 15 | + |
| 16 | +Mirrord was designed with simplicity in mind. You install the CLI tool, and that's it. It will do the rest automatically under the hood. |
| 17 | + |
| 18 | +Mirrord solves the same problem as Telepresence, but in a different way. Instead of providing a proper network |
| 19 | +device and remotely mounted filesystems, mirrord will link the client application with a `mirrord-layer` shared library. This library will inject code that intercepts accesses to the network, file system, and environment variables, and reroute them to a corresponding process in the cluster (the `mirrord-agent`) which then interacts with the targeted pod. |
| 20 | + |
| 21 | +### Limitations with Code Injection |
| 22 | + |
| 23 | +Telepresence 1.x used the [code injection approach](https://www.getambassador.io/blog/code-injection-on-linux-and-macos), but desided to abandon it due to several limitations: |
| 24 | + |
| 25 | +1. It will only work on Linux and macOS platforms. There's no native support on Windows. |
| 26 | +2. It will only work with dynamically linked executables. |
| 27 | +3. It cannot be used with docker unless you rebuild the container and inject the `mirrord-layer` into it. |
| 28 | +4. `DYLD_INSERT_LIBRARIES` causes various problems on macOS (SIP prevents it from being used), especially on silicon-based machines where mirrord will require Rosetta. |
| 29 | +5. Should Apple decide to protect their intel-based platform the same way as the silicon-based one in a future release, then mirrord will likely be problematic to use on that platform. |
| 30 | + |
| 31 | +### Cluster Permissions |
| 32 | + |
| 33 | +Mirrord does not require a sidecar. Instead they install a the `mirror-agent` into the namespace of the pod that it impersonates. That agent requires several permissions that a cluster admin might consider a security risk: |
| 34 | + |
| 35 | +* `CAP_NET_ADMIN` and `CAP_NET_RAW` - required for modifying routing tables |
| 36 | +* `CAP_SYS_PTRACE` - required for reading target pod environment |
| 37 | +* `CAP_SYS_ADMIN` - required for joining target pod network namespace |
| 38 | + |
| 39 | +Unless using "mirrord for Teams" (proprietary), all users must have permissions to create the job running the `mirror-agent` in the cluster. |
| 40 | + |
| 41 | +## Comparison Telepresence vs mirrord |
| 42 | + |
| 43 | +This comparison chart applies to the Open Source editions of both products. |
| 44 | + |
| 45 | +| Feature | Telepresence | mirrord | |
| 46 | +|----------------------------------------------------------------------------|--------------|---------| |
| 47 | +| Run or Debug your cluster containers locally | ✅ | ✅ | |
| 48 | +| Does not need administrative permission on workstation | ✅ [^1] | ✅ | |
| 49 | +| Can be used with very large clusters | ✅ | ✅ | |
| 50 | +| Works without interrupting the remote service | ✅ [^2] | ✅ | |
| 51 | +| Doesn't require injection of a sidecar | ✅ [^3] | ✅ | |
| 52 | +| Supports connecting to clusters over a corporate VPN | ✅ | ✅ | |
| 53 | +| Can intercept traffic | ✅ | ✅ | |
| 54 | +| Can mirror traffic | ✅ | ✅ | |
| 55 | +| Can ingest a container | ✅ | ❌ | |
| 56 | +| Can replace a container | ✅ | ❌ | |
| 57 | +| Can act as a cluster VPN only | ✅ | ❌ | |
| 58 | +| Will work with statically linked binaries | ✅ | ❌ | |
| 59 | +| Runs natively on windows | ✅ | ❌ | |
| 60 | +| Can intercept traffic to and from pod's localhost | ✅ | ❌ | |
| 61 | +| Remotely mounted file system available from all applications | ✅ | ❌ | |
| 62 | +| Cluster network available to all applications (including browser) | ✅ | ❌ | |
| 63 | +| Can run the same docker container locally without rebuilding it | ✅ | ❌ | |
| 64 | +| Provides remote mounts as volumes in docker | ✅ | ❌ | |
| 65 | +| Does not require special capabilities such as CAP_SYS_ADMIN in the cluster | ✅ | ❌ | |
| 66 | +| Centralized client configuration using Helm chart | ✅ | ❌ | |
| 67 | +| Installed using a JSON-schema validated Helm chart | ✅ | ❌ | |
| 68 | +| Client need no special RBAC permissions | ✅ | ❌ | |
| 69 | + |
| 70 | +[^1]: Telepresence will not require root access on the workstation when running in docker mode. |
| 71 | + |
| 72 | +[^2]: The remote service will only restart when a traffic-agent sidecar is installed. Pod disruption budgets or pre-installed agents can be used to avoid interruptions. |
| 73 | + |
| 74 | +[^3]: A traffic-agent is necessary when engaging with a pod. It is unnecessary when using Telepresence as a VPN. |
0 commit comments