Viewing profile — rmolina

Appreciate your comment lmarcos! Yes, the above instruction runs on macos too as long as you have docker-desktop installed.

You are probably referring to Sysbox ( https://github.com/nestybox/sysbox ), which I believe will meet your requirements (systemd, inner containers, security, etc). Btw, Sysbox is …

Thanks a lot Peter!

Right, that will work. I fully agree that Sysbox use-cases extend beyond docker-in-docker and k8s-in-docker. These, docker and k8s, were just the first two system 'apps' that we de…

We are actively working on this one as @ctalledo mentioned. Please ping us offline if want more details.

Thanks!

Please see our response to a similar question below. Hope that helps. Thanks. "The main difference is that Sysbox is OCI-based, so it works with Docker/containerd and hopefully K8s…

Thank you. Please reach out to us through email/slack. Would love to hear more.

Didn't know that. But it makes sense given that podman already supports it. Btw, i did a quick search but couldn't find anything on this (docker's systemd support in rhel). If you …

Thanks @sanketdasgupta for reporting the issue and @asadlionpk for the explanation. Nestybox's github account is an organization now.

Thanks @geofft, you made a lot of great points. I don't think rootless approach is fully aligned with what we're doing right now. True, we both rely on user-namespaces, and we both…

Interesting. Thanks @jdoss!

We haven't had enough cycles to look at Podman in details (yet), but my understanding is that Podman and Docker serve similar purposes: they are high-level runtimes. (i'm obviating…

As @wh33zle mentioned, CI/CD is an obvious use-case. Development environments is another one (pls see the other question i just answered on this topic). But i also see 'production'…

Absolutely, that's one of Sysbox's main use-cases, we usually refer to it as 'docker sandboxes'. As you mentioned, the idea is to have your entire dev environment within your fully…

I see. Will look into that right away. Thanks!

Thanks for the kind words!

Thanks! We are out of the critical path, meaning we only emulate interactions with procfs / sysfs, and we only intercept mount syscalls at the moment, so we don't see any tangible …

Yes. Having said that, we have certain limitations at the moment (e.g. we don't run all cni's), but we are not relying on priv containers as i believe is the case for existing K8s-…

Sorry, not sure i got that. Can you please elaborate?

Got it, thanks for the explanation. I clearly see the use-case, just need to review cgroup specs (specifically cpuset) to fully understand if what you mention is already supported …

Thanks! Both of your suggestions sound very interesting. I personally like the idea of creating large network topologies with a very few outer containers: the real mesh would be at…

Right, systemd uses pid 1, but it does so within the pid-namespace of the container, so each container has its own systemd. Hope it makes sense. Thanks!