Containers in 2019: They're Calling It a Hypervisor Comeback • Hacker News Board

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#161

Post by depr » Sat, Oct 26, 2019, 11:02 PM UTC

denton-scratch wrote: post #44

I have a Xen hypervisor at home, running on a (well-configured) NUC. VMs boot in about 15 seconds. I'm patient! I'm not doing devops stuff; I no longer code, so I don't need a testing pipeline. I looked into containers based on LXC, when it was first introduced. I decided to stay away - I don't want to get tied into Poettering's code. Yeah, I'm running systemd on some of the VMs, but you don't really have much choice…

It is popular because of the developer experience. You can get a Postgres database running with one command, and then throw it away (and no this is not equivalent to apt install postgres). Many other things are pretty polished as well, definitely more polished than LXC.

Kubernetes and similar software "solve" some problems and create a bunch of new ones.

I don't think the actual tech is that good (or new for that matter, Solaris had zones in ~2005); for example getting a core dump from a container without going into the host machine is an unsolved problem.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#162

Post by depr » Sat, Oct 26, 2019, 11:06 PM UTC

gdamjan1 wrote: post #25

blablabla123 wrote: post #7

> The Docker engine default seccomp profile blocks 44 system calls today, leaving containers running in this default Docker engine configuration with just around 300 syscalls available. ...preventing devs/ops people to run tools like iotop, unless extra capabilities are added. I'm all in for containers, cgroups/namespaces but at the moment it's namespace isolation for the price of less features. Unless namespaces bec…

> ...preventing devs/ops people to run tools like iotop, unless extra capabilities are added. you run those on the host, not inside containers

So you have to give people access to the entire host! Great. And you can't even do that in cloud environments.

And even then you run top on the host and obviously it doesn't know anything about containers because they're not real.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#163

Post by depr » Sat, Oct 26, 2019, 11:07 PM UTC

jacques_chester wrote: post #45

"Containers" is an unfortunate term, since it really better describes the container image than an actual running process with API virtualisation. I think VMs-as-containers is where we'll wind up. The container image has turned out to be the real thing of interest, the runtime is almost secondary. Virtual machine systems have closed the performance gap in a variety of ways. For example: tearing out kernel checks for d…

Yes and no, there's the attack surface of the guest operating system.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#164

Post by hamiltont » Sat, Oct 26, 2019, 11:41 PM UTC

eyberg wrote: post #61

sansnomme wrote: post #54

Earlier quoted context omitted.

Because current model of processes frankly sucks. If I give you random binary would you run it? You can talk about sandboxing, lecture about permissions and principles of least privilege. But that still doesn't answer the question: can it run hostile code without having side effects on the rest of the system? Other than the newer web tech initiatives like WebAssembly/JS sandboxing, there do not exist any other techno…

Deploying a hypervisor on top of a hypervisor (eg: a public cloud) usually makes very little sense so I don't see that as a trend. However, outside of the valley bubble many large sectors of the economy do not use public clouds (such as banking, health, defense) so hypervisors typically in the form of ESX is still very much a thing and now that we are seeing tighter integration with things like unikernels that is whe…

Wanted to share my first experience with the ops.city site. This is unsolicited, but I do hope it helps your team succeed:

I opened the 'Why' tab and found blurbs I wanted to see more about. For example, security through smaller code+attack surface sounds interesting, 'no ops' (didn't grok the bullets here, but I was interested to know more), and higher performance are all interesting

The bullets were interesting enough for me to want more, so I opened the video.

Unfortunately, the video was really vanilla and didn't expand on these concepts at all. It shows how easy ops.city is, but gives me nothing more on why it is better than ten other technologies that have similar 'easy intro' videos.

What I was hoping for was a 5-10 minute video focused on benefits of your approach vs alternatives. For example, some talk or demo on improved performance, data on how much code/attack surface is reduced, comments on OS/kernel memory footprint (this is a problem for us - clients like using 500MB "tiny" VMs on public clouds that hang running cadvisor), etc.

I could leave your site to answer these questions on my own. I did this and found some promising looking links over on the nanovm website. But that is an awkward experience - leaving your site to try and understand your offering.

Perhaps I'm not your target audience. For context, I do a minor amount of devops as part of delivering initial R&D products to multiple clients. We are not ops experts, but we try to deliver future proof work, which involves us staying apprised of new approaches and making them available to clients when they are a fit.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#165

Post by barbecue_sauce » Sun, Oct 27, 2019, 1:31 AM UTC

louwrentius wrote: post #157

dopylitty wrote: post #52

I've had this sneaking but hard to articulate suspicion that datacenters, bare metal servers, VMs, operating systems, containers, OS processes, language VMs, and threads are all really attempts to abstract the same thing. You want to run business code in a way that's protected from other business code but also able to interact with other business code and data in a well defined way. I also have this sneaking suspicio…

I think you could build a secure application environment with just bare metal. The only hip tool I would use is Ansible after paying my respects to cfengine. No virtualisation No containers No overlay networks A few VLANs perhaps. If I may. It can be done. Just a few dedicated people. The kind of people colonel Kurtz talked about...

Is Ansible still hip or has it gone the way of MongoDB?

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#166

Post by ahartmetz » Sun, Oct 27, 2019, 7:31 AM UTC

panpanna wrote: post #160

jacquesm wrote: post #65

Earlier quoted context omitted.

No. I thought GNU Hurd was a great idea executed poorly. QnX is that same idea executed in an excellent and pragmatic way.

But qnx is almost universally hated by people actually working with it :)

I've developed for it and I thought it was pretty nice. Sure, the kill command is called slay, and other oddities, but at its core it is a very well-designed system.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#167

Post by brylie » Sun, Oct 27, 2019, 7:45 AM UTC

jabl wrote: post #153

user_error wrote: post #129

Earlier quoted context omitted.

> this is what naming things refers to in Phil Karlton's quote "There are only two hard things in Computer Science: cache invalidation and naming things," not to the literal naming of variables in computer programs That is mighty interesting. Do you happen to have a source for this? It's the first time I've heard it being put in this particular way.

The version I've heard is "There are only two hard things in Computer Science: cache invalidation, naming things, and off by one errors".

Zero-based indexing.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#168

Post by 08-15 » Sun, Oct 27, 2019, 9:13 AM UTC

zbentley wrote: post #127

RcouF1uZ4gsC wrote: post #125

Earlier quoted context omitted.

> I will continue to suspect that almost all of its adopters use it because packaging software with dependencies is hard, poorly understood, terribly tooled (looking at you, Python), and even more poorly executed in the vast majority of projects and companies. Static linking solves a lot of these deployment issues. But I guess people are worried about duplicating libraries and security vulnerabilities. So we end up w…

Can't easily statically link a big complex application written in a dynamic language.

Depends on the language, doesn't it? Many Scheme implementations have "unexec".

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#169

Post by imtringued » Sun, Oct 27, 2019, 9:45 AM UTC

zzzcpan wrote: post #115

icebraining wrote: post #105

Earlier quoted context omitted.

Docker is convenient. You can just download the docker binary and type "docker run postgres" and have a container running Postgres. What's the equivalent for FreeBSD jails?

There is no equivalent of course. I guess people are confused on what jails are. Jails, Solaris Zones, lxc, runC, chroot with namespaces and cgroups are all similar technology that are not solving the same problems as Docker. Docker just uses containers underneath to address specific package management problems. Projects that try to do the same are actually just package managers, like nix and guix.

Docker is a turn key solution to three different problems (build, package, run). A lot of people know of alternatives that cover only the run part and then they wonder why their particular solution didn't become as popular.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#170

Post by imtringued » Sun, Oct 27, 2019, 10:05 AM UTC

hinkley wrote: post #3

And let me state again for the record that all of these promises being made by container systems sound an awful lot like the promises I was offered by 'real' operating systems in the early nineties. I think the only real difference is that there has been a sea change in public opinion on this kind of aggressive isolation by default being worthwhile. But a hypervisor publishing a bunch of services that talk to the wor…

Yeah all those stupid fools... who needs machine VMs, language VMs, processes, process namespaces... Just compile your software with pointer authentication and run it in kernelspace on bare metal. Why is everyone so stupid and I am the only smart person on this planet?

... If you haven't realized it yet. I'm not serious at all ...