Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Containers in 2019: They're Calling It a Hypervisor Comeback

infoq.com

Post reply on HN
Print view View original

21–30 of 196 posts

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#21

Post by jacquesm »

panpanna wrote: post #14
BiteCode_dev wrote: post #6

Earlier quoted context omitted.

Plus now, the app devs, now all turned devops because talent is scarse and demand is high, get to handle the complexity of concurrency, networking and reliability. This adds to deployment/testing/development setup, and when you change stack or job, the architecture slightly different and you need to learn it all over again. Funnily enough, we couldn't make the microkernel concept works despite an homogeneous, integra…

What if the pure microkernel approach is flawed and hypervisors offer a sensible middle ground?

Most of the people that rail against pure microkernels have zero experience actually building stuff with them. Those that do have that experience have hard proof that systems built in this way are more reliable and easier to build than others. Hypervisors have their own place in the hierarchy, they do not compete effectively with microkernels on their own turf.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#22

Post by zbuf »

hinkley wrote: post #3

And let me state again for the record that all of these promises being made by container systems sound an awful lot like the promises I was offered by 'real' operating systems in the early nineties. I think the only real difference is that there has been a sea change in public opinion on this kind of aggressive isolation by default being worthwhile. But a hypervisor publishing a bunch of services that talk to the wor…

I believe it's because at some point the operating systems (particularly Linux based ones) became semi-closed ecosystems of software, instead of a platform to run other people's software. Also became a 'singleton' mentality too, where the only one version or variant of an app/library is accomodated.

So now we're falling back to the few stable ABIs we have available -- Linus's kernel ABI (containers) and some kind of x86 platform virtualization. I think it's a little sad that this happens because operating systems made a poor job of doing what we needed them to do.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#23

Post by nunchuckninja »

So I read something succinct a while back - docker et al are distribution platforms not security platforms . They add "0" security against an adversary (think padlocks). How true is it ? And what high perf securely contained systems are there? OpenVZ?

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#25

Post by gdamjan1 »

blablabla123 wrote: post #7

> The Docker engine default seccomp profile blocks 44 system calls today, leaving containers running in this default Docker engine configuration with just around 300 syscalls available. ...preventing devs/ops people to run tools like iotop, unless extra capabilities are added. I'm all in for containers, cgroups/namespaces but at the moment it's namespace isolation for the price of less features. Unless namespaces bec…

> ...preventing devs/ops people to run tools like iotop, unless extra capabilities are added.

you run those on the host, not inside containers

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#27

Post by upofadown »

nunchuckninja wrote: post #23

So I read something succinct a while back - docker et al are distribution platforms not security platforms . They add "0" security against an adversary (think padlocks). How true is it ? And what high perf securely contained systems are there? OpenVZ?

The generic issue seems to be that stuff like containers can be escaped with pretty much any privilege escalation exploit ... and such exploits are reasonably common in the world of Linux.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#28

Post by nunchuckninja »

upofadown wrote: post #27
nunchuckninja wrote: post #23

So I read something succinct a while back - docker et al are distribution platforms not security platforms . They add "0" security against an adversary (think padlocks). How true is it ? And what high perf securely contained systems are there? OpenVZ?

The generic issue seems to be that stuff like containers can be escaped with pretty much any privilege escalation exploit ... and such exploits are reasonably common in the world of Linux.

So either take perf hit or don't expect isolation at all?

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#29

Post by naasking »

hinkley wrote: post #3

And let me state again for the record that all of these promises being made by container systems sound an awful lot like the promises I was offered by 'real' operating systems in the early nineties. I think the only real difference is that there has been a sea change in public opinion on this kind of aggressive isolation by default being worthwhile. But a hypervisor publishing a bunch of services that talk to the wor…

> Things are beginning to look a bit more like microkernels as time goes on.

Hypervisors typically are microkernels. The very first "hypervisor" was L4 in fact, with L4Linux.

Also, you're right that virtualization and containers are fulfilling the promises of operating systems. The problem of earlier OSes is that they didn't take security seriously enough. Modern hypervisors aren't much better at isolation than real microkernels like L4, KeyKOS and EROS. They're better than containers though.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#30

Post by naasking »

jacquesm wrote: post #21
panpanna wrote: post #14

Earlier quoted context omitted.

What if the pure microkernel approach is flawed and hypervisors offer a sensible middle ground?

Most of the people that rail against pure microkernels have zero experience actually building stuff with them. Those that do have that experience have hard proof that systems built in this way are more reliable and easier to build than others. Hypervisors have their own place in the hierarchy, they do not compete effectively with microkernels on their own turf.

The typical problem with microkernels is poor backwards compatibility, mainly due to POSIX. If you add POSIX compatibility, you don't gain any isolation, performance or security benefits of microkernels, and changing your thinking and your programs to gain those benefits requires significant work when they're written against the POSIX API.

Building them that way from scratch is pretty much just as easy as writing programs in UNIX, modulo the lack of tooling that is mostly POSIX-based.

Post reply on HN