Viewing profile — ctalledo

Thanks again for the detailed response. > Have a look at what gVisor actually does I am aware of what it does, though I had missed the fact that the Sentry and/or Gopher run within…

LXD is great, but one nice feature of Sysbox is that it's an OCI-based runtime, and therefore integrates with Docker, K8s, etc. In a way, Sysbox turns Docker containers or Kubernet…

Thanks for the feedback; I am one of the developers of Sysbox. Some answers to the above comments: - Regarding the container isolation, Sysbox uses a combination of Linux user-name…

Hi HN, this is Cesar, one of the developers behind Sysbox, a next-generation "runc". Sysbox enables containers (or pods) to act as "VM-like" environments, capable of running system…

Hi HN, this is Cesar and Rodny, developers of an open-source container runtime called Sysbox, and co-founders of a startup called Nestybox (YC S20). We launched on HN almost a year…

Thanks! Yes, if you wish to setup dev environments backed by Docker or K8s containers/pods, Sysbox is an excellent way to do so because it gives you a rootless container inside of …

Hi HN, my name is Cesar, I am one of the lead developers of Sysbox (https://github.com/nestybox/sysbox), an enhanced "runc" that enables rootless containers to act as "VM-like" env…

If you are using Docker-in-Docker, you may want to checkout the new Sysbox runtime (find it on Github). It's a new type of runc that sits below Docker and creates rootless containe…

+1 for the Emacs client.

Thanks; one thing I may have omitted mentioning is that Sysbox works with the fast overlayfs storage driver, meaning that when you do use it for Docker-in-Docker for example, both …

Agreed; it's certainly something we will keep in mind as we mature Sysbox.

A use case that we often get asked about for Docker-in-Docker is using the outer container as a dev environment that includes a developer's tools, ssh, and a dedicated Docker (CLI …

Ubuntu carries a few things that Sysbox relies on: a couple that come to mind are the shiftfs module (which Sysbox uses to enable the user-namespace in containers without requiring…

There is plenty of info on Kubernetes (K8s) on the web, so I would start there. As far as running K8s inside Docker containers though, the use case would be one in which you want t…

This is something we've not tried yet, so I don't know. I would be surprised if it worked right now. But in general, it's something we would definitely be interested in exploring. …

We felt just providing enterprise support would not be sufficient to create a healthy business, given that Sysbox is designed to work under the covers (i.e., under docker/container…

Take a look at the Nestybox blog site: https://blog.nestybox.com/ It has an article on Docker sandboxing. Hope that helps!

Correct; Sysbox always enables the user-namespace in containers and manages the subuid/subgid allocation. In the open-source version, it assigns all containers the same subuid/subg…

Thanks @lopezator.

That's funny ... brings back memories of the 90s :) One thing I've noticed is that in modern IT infrastructure, there is usually two levels of sandboxing going on. At the low level…

It's hard to compare them because the goals are different. Kata containers seeks to harden container security by wrapping it with a highly optimized VM. Sysbox seeks to enable cont…

Please take a look at these examples and let us know if they help: https://github.com/nestybox/sysbox/blob/master/docs/quicksta...

Got it; note that inside a system container you can always run docker-in-docker using privileged containers ( https://hub.docker.com/_/docker ). That is, you don't need sysbox nest…

Yes, as long as you can install Sysbox on the EC2 nodes, you are good to go.