Containers in 2019: They're Calling It a Hypervisor Comeback • Hacker News Board

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#181

Post by takeda » Sun, Oct 27, 2019, 5:33 PM UTC

zzzcpan wrote: post #115

icebraining wrote: post #105

Earlier quoted context omitted.

Docker is convenient. You can just download the docker binary and type "docker run postgres" and have a container running Postgres. What's the equivalent for FreeBSD jails?

There is no equivalent of course. I guess people are confused on what jails are. Jails, Solaris Zones, lxc, runC, chroot with namespaces and cgroups are all similar technology that are not solving the same problems as Docker. Docker just uses containers underneath to address specific package management problems. Projects that try to do the same are actually just package managers, like nix and guix.

Also I think many people think it is very complicated to setup database, I just run it yesterday on OS X the command issues were:

    nix-env -iA nixpkgs.postgresql_11
    initdb ~/data
    pg_ctl -D ~/data start
    createdb

First command installs the database, second one populates database files, this one starts the database, last command is optional and it creates a database for your user name.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#182

Post by marios » Sun, Oct 27, 2019, 5:43 PM UTC

sayhello wrote: post #72

regularfry wrote: post #67

Earlier quoted context omitted.

From memory, I seem to recall that Genode takes this to its logical conclusion: every process is isolated with virtualization primitives. As to why: isolating processes the old way needs jails to work properly, BSD lost the popularity contest, and Linux jails didn't get secure enough before VMs and containers took off.

Did the BSD jails provide enough isolation? Would memory from a process truly be isolated from another? How about FD’s? Could there be side channel attacks? At what level? Perhaps the whole kernel design needs to be revisited, which I assume is what’s being taken on by Fuchsia.

The BSD jails / Solaris zones approach is not the same at the path taken by Linux. Linux gives you a facility to isolate network, a facility to isolate process views etc. You put them all together and you get a "container". The former starts off by having a container primitive that can't do much because, well, it's contained from everything. You then proceed to give it access to the network, the filesystem.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#183

Post by denton-scratch » Sun, Oct 27, 2019, 7:55 PM UTC

meddlepal wrote: post #47

denton-scratch wrote: post #44

I have a Xen hypervisor at home, running on a (well-configured) NUC. VMs boot in about 15 seconds. I'm patient! I'm not doing devops stuff; I no longer code, so I don't need a testing pipeline. I looked into containers based on LXC, when it was first introduced. I decided to stay away - I don't want to get tied into Poettering's code. Yeah, I'm running systemd on some of the VMs, but you don't really have much choice…

Some of us have problems that are actually well solved by these tools and run on more sophisticated hardware than our home computer... It doesn't sound like you've hit that set of problems.

Yeah, thanks. It's a home computer because I don't work any more - I set-up and operated a continuous production VM pipeline on my boss's rack, back when I had a boss.

Docker had turned up; I evaluated it (quite briefly - I had work to do, and nobody had asked me to evaluate Docker). We had fairly specific requirements that I couldn't match to Docker.

I recall now that Kubernetes is principally a deployment system - sorry. Perhaps it is well-integrated with some container systems, such as Docker. Kubernetes didn't exist when I had a boss. I use Ansible.

I get that LXC is not very friendly. But it works OK, doesn't it? Just wrap a shiny skin around it. Don't re-invent the wheel; we already have enough wheel inventions.

I'm not by any means knowledgeable about containers; I evaluated LXC way back when, and decided that VMs were more secure. And never revisited that decision.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#184

Post by denton-scratch » Sun, Oct 27, 2019, 8:03 PM UTC

jacques_chester wrote: post #48

denton-scratch wrote: post #44

I have a Xen hypervisor at home, running on a (well-configured) NUC. VMs boot in about 15 seconds. I'm patient! I'm not doing devops stuff; I no longer code, so I don't need a testing pipeline. I looked into containers based on LXC, when it was first introduced. I decided to stay away - I don't want to get tied into Poettering's code. Yeah, I'm running systemd on some of the VMs, but you don't really have much choice…

Docker achieved a number of things: they provided a simple user experience and a simple, relatively effective image format. The primitives had been in the kernel for some time and were widely used to implement a variety of systems (Cloud Foundry used these kernel features over 2 generations of its own code before switching to runc). If you're just running stuff on a single machine for your own satisfaction, you don't…

"you don't need to fret about Kubernetes"

Don't know why you got voted down.

I'm retired, but I want to keep my hand in. I like to be able to throw up a server quickly. I like to be able to automate testing and deployment - Ansible is my friend. But I don't have to throw up and configure 100 servers by 10:00am :-)

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#185

Post by takeda » Sun, Oct 27, 2019, 9:56 PM UTC

marios wrote: post #182

sayhello wrote: post #72

Earlier quoted context omitted.

Did the BSD jails provide enough isolation? Would memory from a process truly be isolated from another? How about FD’s? Could there be side channel attacks? At what level? Perhaps the whole kernel design needs to be revisited, which I assume is what’s being taken on by Fuchsia.

The BSD jails / Solaris zones approach is not the same at the path taken by Linux. Linux gives you a facility to isolate network, a facility to isolate process views etc. You put them all together and you get a "container". The former starts off by having a container primitive that can't do much because, well, it's contained from everything. You then proceed to give it access to the network, the filesystem.

What do you mean? Isolating network and isolate processes view is what FreeBSD jail was always doing. The most common use of freebsd jails was providing VPS servers to users.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#186

Post by cwp » Mon, Oct 28, 2019, 4:41 AM UTC

takeda wrote: post #180

cwp wrote: post #112

Earlier quoted context omitted.

Yes, this is exactly right. Dependency management is a hard problem, and with Docker you only have to get it right once. I think Docker wouldn't exist if Amazon had shipped a way to build and test an AMI locally.

There is already a solutions such as Guix and Nix, but then people aren't willing to learn a new language that allows expressing dependencies. Docker solves dependencies in same way a disk image does, you save the image and it should look the same way each time you look at it. The Dockerfile is not a reproducible though, you just list steps iteratively to generate an image, but it doesn't guarantee to produce the sam…

Agreed. Nix and Guix actually solve the dependency problem, Docker allows you to work around it. But a work around is better than nothing.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#187

Post by chelmuth » Mon, Oct 28, 2019, 7:29 AM UTC

gnufx wrote: post #146

gtirloni wrote: post #35

Earlier quoted context omitted.

If you don't mind this tangent question... Is there a microkernel API that has more acceptance nowadays? In other words, where should anyone wanting to work on real world / enterprise systems based on microkernel look?

I don't know if that's the idea, but Genode works over a few microkernels.

(original Genode dev here)

You nailed it: From day 2 or so we imagined to develop Genode as the future common API for the diverse range of microkernels and showcased the approach with all L4 kernels we could get our hands on. The vision is still to provide a replacement for POSIX in the microkernel world ;-)

Regarding POSIX, we don't think that tools and applications developed for this interface do not fit the microkernel world but on the traditional systems level POSIX (and its tools) is not sufficient to make the best of out of the microkernel advantages. For example, we run libcurl, GPG, libarchive, and coreutils in an orchestrated scenario to implement a robust and secure deployment/installation subsystem in the Genode-based Sculpt OS https://genode.org/documentation/articles/sculpt-19-07.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#188

Post by marios » Mon, Oct 28, 2019, 10:02 AM UTC

takeda wrote: post #185

marios wrote: post #182

Earlier quoted context omitted.

The BSD jails / Solaris zones approach is not the same at the path taken by Linux. Linux gives you a facility to isolate network, a facility to isolate process views etc. You put them all together and you get a "container". The former starts off by having a container primitive that can't do much because, well, it's contained from everything. You then proceed to give it access to the network, the filesystem.

What do you mean? Isolating network and isolate processes view is what FreeBSD jail was always doing. The most common use of freebsd jails was providing VPS servers to users.

No argument there. My point is that the default for FreeBSD jails is "isolate everything" and it's up to the user to open it up.

My post was in response to 'sayhello' that is wondering whether jails provide enough isolation.

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#189

Post by [deleted] » Mon, Oct 28, 2019, 12:37 PM UTC

takeda wrote: post #180

cwp wrote: post #112

Earlier quoted context omitted.

Yes, this is exactly right. Dependency management is a hard problem, and with Docker you only have to get it right once. I think Docker wouldn't exist if Amazon had shipped a way to build and test an AMI locally.

There is already a solutions such as Guix and Nix, but then people aren't willing to learn a new language that allows expressing dependencies. Docker solves dependencies in same way a disk image does, you save the image and it should look the same way each time you look at it. The Dockerfile is not a reproducible though, you just list steps iteratively to generate an image, but it doesn't guarantee to produce the sam…

[deleted]

Re: Containers in 2019: They're Calling It a Hypervisor Comeback

#190

Post by takeda » Mon, Oct 28, 2019, 6:21 PM UTC

marios wrote: post #188

takeda wrote: post #185

Earlier quoted context omitted.

What do you mean? Isolating network and isolate processes view is what FreeBSD jail was always doing. The most common use of freebsd jails was providing VPS servers to users.

No argument there. My point is that the default for FreeBSD jails is "isolate everything" and it's up to the user to open it up. My post was in response to 'sayhello' that is wondering whether jails provide enough isolation.

I see, I misunderstood what you meant.