Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Containers vs. Zones vs. Jails vs. VMs (2017)

blog.jessfraz.com

Post reply on HN
Print view View original

81–90 of 134 posts

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#81

Post by imtringued »

mav3rick wrote: post #50
matharmin wrote: post #11

Earlier quoted context omitted.

I feel nowadays containers generally refer to the concept, and cgroups and namespaces are the implementation details of a specific container runtime. These are very important implementation details for security and performance, but it doesn't fundamentally impact how you structure your containerized application. You can take the same container image, and run using Docker, Firecracker, gVisor, or many other container…

Please don't propagate this. Running in a hypervisor with a possible different kernel vs running on the same kernel in the same ring as the host are two very different things. Implications of these are very different.

From the perspective of the developer there is no difference. They just configure kubernetes or docker to use a different Container runtime and keep using the same compose files, etc.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#82

Post by imtringued »

barbecue_sauce wrote: post #78
cle wrote: post #76

Earlier quoted context omitted.

The gap is that it's skipping half of what makes Docker powerful, and what isn't really discussed in this conversation at all either. Distribution. E.g. see this line of code: https://github.com/p8952/bocker/blob/master/bocker#L25 "But I thought bocker implements Docker?" It doesn't, it only attempts to implement the "Docker daemon" part, and piggy-backs on Docker registries for image distribution. This is a huge par…

So many people don't seem to understand that artifact distribution is the compelling feature of Docker.

And if you want to have artifacts you also need a way to build them... Running containers is just one third of the features that docker offers.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#83

Post by TeMPOraL »

legulere wrote: post #80
justanotherc wrote: post #19

Earlier quoted context omitted.

You talk as if that's a bad thing. As a developer I don't want to wade into the details of systems I'm using, I want to spend my time writing code that solves the business problems I'm tasked with solving. If there is a system that allows me to do that by abstracting away the details I don't care about, why wouldn't I use that system?

Abstractions usually only work within a boundary. If you understand the underlying implementation you know its limitations. Abstractions help you to not think about the implementation all the time and to have your own code work in a coherent way.

Abstractions are almost never self-contained enough. It's much easier to work within the bounds of an abstraction if you have at least a basic idea about the thing that's being abstracted.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#84

Post by gwd »

imtringued wrote: post #82
barbecue_sauce wrote: post #78

Earlier quoted context omitted.

So many people don't seem to understand that artifact distribution is the compelling feature of Docker.

And if you want to have artifacts you also need a way to build them... Running containers is just one third of the features that docker offers.

Exactly. Containers were around for at least a decade before Docker, just like mp3's were around for decades before the iPod. Docker's simple, efficient way to package containers were the key to their explosion.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#85

Post by didibus »

outworlder wrote: post #4

> A “container” is just a term people use to describe a combination of Linux namespaces and cgroups. Linux namespaces and cgroups ARE first class objects. NOT containers. Amen. Somewhat tangential note: most developers I have met do not understand what a 'container' is. There's an aura of magic and mystique around them. And a heavy emphasis on Docker. A sizable fraction will be concerned about 'container overhead' (a…

I don't know, container is an abstract idea, and that's all. Can you run apps within a contained OS environment?

LXC is one way to do so, runc is another way to do so, docker is a third way to do so, all for Linux. Now if you took some other OS, there'd be different solutions, each with slightly different details and thus properties, but same idea.

I mean, do you ask people what SQL is? And get frustrated if they don't start talking about MySQL specific details like InnoDB and what not?

Don't know, I feel I can't agree with you, do devs feel there's less magic involved in VMs? Honestly, I have less idea what VMs are built on top of than I do for containers.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#86

Post by simonh »

imtringued wrote: post #81
mav3rick wrote: post #50

Earlier quoted context omitted.

Please don't propagate this. Running in a hypervisor with a possible different kernel vs running on the same kernel in the same ring as the host are two very different things. Implications of these are very different.

From the perspective of the developer there is no difference. They just configure kubernetes or docker to use a different Container runtime and keep using the same compose files, etc.

I think the point the OPs was making is that yes, as you say, developers can use containers without knowing these differences, but that there are actually real and important differences and maybe it would be better if more devs were aware of them.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#87

Post by irishsultan »

gwd wrote: post #84
imtringued wrote: post #82

Earlier quoted context omitted.

And if you want to have artifacts you also need a way to build them... Running containers is just one third of the features that docker offers.

Exactly. Containers were around for at least a decade before Docker, just like mp3's were around for decades before the iPod. Docker's simple, efficient way to package containers were the key to their explosion.

> , just like mp3's were around for decades before the iPod

That sounded wrong intuitively, so I decided to look it up: Wikipedia claims that mp3 was initially released in 1993, and the iPod was initially released in 2001, so not decades and not even a full decade.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#88

Post by ailideex »

outworlder wrote: post #4

> A “container” is just a term people use to describe a combination of Linux namespaces and cgroups. Linux namespaces and cgroups ARE first class objects. NOT containers. Amen. Somewhat tangential note: most developers I have met do not understand what a 'container' is. There's an aura of magic and mystique around them. And a heavy emphasis on Docker. A sizable fraction will be concerned about 'container overhead' (a…

> A “container” is just a term people use to describe a combination of Linux namespaces and cgroups.

And those people should stop because that would be inaccurate. More specifically, a "container" can be any of the following:

- Someone who contains; something that contains. An item in which objects, materials or data can be stored or transported.

- (transport) A very large, typically metal, box used for transporting goods.

- (by extension) Someone who holds people in their seats or in a (reasonably) calm state.

- (computing) A file format that can hold various types of data.

- (object-oriented programming) An abstract data type whose instances are collections of other objects.

- (computing, graphical user interface) Any user interface component that can hold further (child) components.

...

If we are talking about a Docker Container (here Docker Container is a proper noun), on the other hand - then clearly you are still wrong - as Docker have worked at various times on Windows and FreeBSD.

Now trying to grasp at even more straws to find some the "container" definition of the gaps that may give some justification to your claims, we can look at the other proper noun "OCI Container" ... but alas ...

https://www.opencontainers.org/faq

> Will the runtime and image format specs support multiple platforms?

> Yes. For example, take a look at the runtime-specification configuration where it mentions example Linux, Windows and Solaris configurations. There are also multiple implementations of the runtime-specification that you can take a look at.

It seems then that you are just wrong. Plain and simple. I'm seriously concerned with whoever is having you interview candidates.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#89

Post by ZoomZoomZoom »

CBLT wrote: post #29
outworlder wrote: post #4

> A “container” is just a term people use to describe a combination of Linux namespaces and cgroups. Linux namespaces and cgroups ARE first class objects. NOT containers. Amen. Somewhat tangential note: most developers I have met do not understand what a 'container' is. There's an aura of magic and mystique around them. And a heavy emphasis on Docker. A sizable fraction will be concerned about 'container overhead' (a…

> To this day, I've heard CGroups being mentioned only once. See https://www.kernel.org/doc/Documentation/cgroup-v2.txt > "cgroup" stands for "control group" and is never capitalized. The singular form is used to designate the whole feature and also as a qualifier as in "cgroup controllers". When explicitly referring to multiple individual control groups, the plural form "cgroups" is used. To this day, I've heard cgr…

>Does it really feel that much better to be one level above others?

Yes? Because levels are finite and quantifiable.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#90

Post by peteretep »

didibus wrote: post #85
outworlder wrote: post #4

> A “container” is just a term people use to describe a combination of Linux namespaces and cgroups. Linux namespaces and cgroups ARE first class objects. NOT containers. Amen. Somewhat tangential note: most developers I have met do not understand what a 'container' is. There's an aura of magic and mystique around them. And a heavy emphasis on Docker. A sizable fraction will be concerned about 'container overhead' (a…

I don't know, container is an abstract idea, and that's all. Can you run apps within a contained OS environment? LXC is one way to do so, runc is another way to do so, docker is a third way to do so, all for Linux. Now if you took some other OS, there'd be different solutions, each with slightly different details and thus properties, but same idea. I mean, do you ask people what SQL is? And get frustrated if they don…

> container is an abstract idea

In this context, it's not, it's specifically referring to a process running in a cgroup.

> LXC is one way to do so, runc is another way to do so, docker is a third way to do so

Docker is a suite of tools for managing running LXC or runc, both of which set up processes running under cgroups.

> Now if you took some other OS, there'd be different solutions, each with slightly different details and thus properties, but same idea

You should read the article.

Post reply on HN