Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Containers vs. Zones vs. Jails vs. VMs (2017)

blog.jessfraz.com

Post reply on HN
Print view View original

51–60 of 134 posts

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#51

Post by mav3rick »

cmckn wrote: post #23
matharmin wrote: post #11

Earlier quoted context omitted.

I feel nowadays containers generally refer to the concept, and cgroups and namespaces are the implementation details of a specific container runtime. These are very important implementation details for security and performance, but it doesn't fundamentally impact how you structure your containerized application. You can take the same container image, and run using Docker, Firecracker, gVisor, or many other container…

Agreed. The post feels a bit pedantic; I don't know any dev doing "cool things" with the underlying namespaces/cgroups. They're just using Docker. De-mystifying containers has value, but so does the abstraction.

The abstraction muddles the performance, security etc. impact of these two models. Not knowing them is going to be bad in the long run. Not everyone is a web dev.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#52

Post by mav3rick »

cmckn wrote: post #23
matharmin wrote: post #11

Earlier quoted context omitted.

I feel nowadays containers generally refer to the concept, and cgroups and namespaces are the implementation details of a specific container runtime. These are very important implementation details for security and performance, but it doesn't fundamentally impact how you structure your containerized application. You can take the same container image, and run using Docker, Firecracker, gVisor, or many other container…

Agreed. The post feels a bit pedantic; I don't know any dev doing "cool things" with the underlying namespaces/cgroups. They're just using Docker. De-mystifying containers has value, but so does the abstraction.

And I'm a dev "doing cool things" with namespaces / cgroups.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#53

Post by mav3rick »

outworlder wrote: post #4

> A “container” is just a term people use to describe a combination of Linux namespaces and cgroups. Linux namespaces and cgroups ARE first class objects. NOT containers. Amen. Somewhat tangential note: most developers I have met do not understand what a 'container' is. There's an aura of magic and mystique around them. And a heavy emphasis on Docker. A sizable fraction will be concerned about 'container overhead' (a…

A process in a namespace is running just like another process being managed by your kernel. Based on how you set up networking, you may face an extra hop to get packets. I don't know what other scalability issues will be there, it's literally a process running similar to other processors.

Can you shed light on some of these, maybe I haven't encountered these in my day to day ? (Please note I am not talking about containers running in VMs, which apparently Docker does now).

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#54

Post by wmf »

lmm wrote: post #43
wmf wrote: post #6

Earlier quoted context omitted.

People love to bring this up, but if Linux did have first-class containers, how would the developer's experience be different?

There would maybe be more consistency. E.g. currently if I say an application is running in a container, do you expect there is virtual networking in place, or not?

Jails and Zones probably also have bridged, routed, and NATed modes so I'm not sure that example is that useful. It's true that networking is different in Docker vs. k8s but there are valid reasons for it.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#55

Post by moomin »

cmckn wrote: post #23
matharmin wrote: post #11

Earlier quoted context omitted.

I feel nowadays containers generally refer to the concept, and cgroups and namespaces are the implementation details of a specific container runtime. These are very important implementation details for security and performance, but it doesn't fundamentally impact how you structure your containerized application. You can take the same container image, and run using Docker, Firecracker, gVisor, or many other container…

Agreed. The post feels a bit pedantic; I don't know any dev doing "cool things" with the underlying namespaces/cgroups. They're just using Docker. De-mystifying containers has value, but so does the abstraction.

Plenty of them using those features, if they’re using Kubernetes, Docker Swarm or especially Istio.

They might not know they are, but that’s besides the point.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#56

Post by fiddlerwoaroof »

erjiang wrote: post #8
outworlder wrote: post #4

> A “container” is just a term people use to describe a combination of Linux namespaces and cgroups. Linux namespaces and cgroups ARE first class objects. NOT containers. Amen. Somewhat tangential note: most developers I have met do not understand what a 'container' is. There's an aura of magic and mystique around them. And a heavy emphasis on Docker. A sizable fraction will be concerned about 'container overhead' (a…

This is true for many new waves of popular technologies. 1) A new technology or method becomes popular. 2) Developers find new advantages in using the technology. 3) Understanding of tech and original advantage is somewhat lost. For example: containers are now widely used as part of a scriptable application build process, e.g. the Dockerfile. There are probably many developers out there who care about this and not ab…

A down side is that people feel like they have to bundle an entire Linux rootfs because they think of a container as a lightweight vm: if they thought of it as a os process running inside various namespaces, they might be more inclined to only ship what they actually need.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#57

Post by chrisweekly »

potta_coffee wrote: post #48
dielectrikboog wrote: post #18

Earlier quoted context omitted.

No, it isn’t an exaggeration. They ceded one particular competency, systems administrator, and now pay cloud providers to do it instead. The job didn’t go anywhere. Capacity planning, change management, peering, supply chain management, all of that stuff is still happening, they just willingly tapped out of it and took another job (probably because the DevOps people came in with a slide deck and hand waved them out o…

As a developer, I'm not happy about it either. I'm now expected to write code, as fast as possible, and then handle all the ops / sysadmin tasks too, which I don't enjoy and am not really equipped to handle.

But wait, aren't you "full-stack"? That means you also know all the minutia of UI animation rendering performance optimizations across the mobile landscape, right?

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#58

Post by jmb12686 »

dielectrikboog wrote: post #17
delusional wrote: post #15

Earlier quoted context omitted.

Has sysadmin not evolved? if I found some sysadmin logging into a production system and editing the config file in nano today, I'd be downright depressed.

Sounds like you’re going to be depressed when you learn how the entire Internet plane, all software engineering outside of “SV”, all IT, all government, and basically everything except your GitHub CI/CD adventure works, then. Sorry.

This isn't an accurate statement. I work on behalf of a federal government agency, and no one has write access in development, let alone production. Everything is required to run thru our ci/cd pipeline. Times are changing.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#59

Post by icedchai »

potta_coffee wrote: post #48
dielectrikboog wrote: post #18

Earlier quoted context omitted.

No, it isn’t an exaggeration. They ceded one particular competency, systems administrator, and now pay cloud providers to do it instead. The job didn’t go anywhere. Capacity planning, change management, peering, supply chain management, all of that stuff is still happening, they just willingly tapped out of it and took another job (probably because the DevOps people came in with a slide deck and hand waved them out o…

As a developer, I'm not happy about it either. I'm now expected to write code, as fast as possible, and then handle all the ops / sysadmin tasks too, which I don't enjoy and am not really equipped to handle.

Yes! Most developers don't want to do operations work. It's not their specialty, and often uninteresting to them. A good team will let developers actually develop.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#60

Post by thaumasiotes »

CBLT wrote: post #29
outworlder wrote: post #4

> A “container” is just a term people use to describe a combination of Linux namespaces and cgroups. Linux namespaces and cgroups ARE first class objects. NOT containers. Amen. Somewhat tangential note: most developers I have met do not understand what a 'container' is. There's an aura of magic and mystique around them. And a heavy emphasis on Docker. A sizable fraction will be concerned about 'container overhead' (a…

> To this day, I've heard CGroups being mentioned only once. See https://www.kernel.org/doc/Documentation/cgroup-v2.txt > "cgroup" stands for "control group" and is never capitalized. The singular form is used to designate the whole feature and also as a qualifier as in "cgroup controllers". When explicitly referring to multiple individual control groups, the plural form "cgroups" is used. To this day, I've heard cgr…

> The singular form is used to designate the whole feature and also as a qualifier as in "cgroup controllers". When explicitly referring to multiple individual control groups, the plural form "cgroups" is used.

They're free to say this, but since it violates the rules of the language they're never going to get any significant level of compliance.

Post reply on HN