Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Containers vs. Zones vs. Jails vs. VMs (2017)

blog.jessfraz.com

Post reply on HN
Print view View original

101–110 of 134 posts

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#101

Post by zurn »

wmf wrote: post #6
outworlder wrote: post #4

> A “container” is just a term people use to describe a combination of Linux namespaces and cgroups. Linux namespaces and cgroups ARE first class objects. NOT containers. Amen. Somewhat tangential note: most developers I have met do not understand what a 'container' is. There's an aura of magic and mystique around them. And a heavy emphasis on Docker. A sizable fraction will be concerned about 'container overhead' (a…

People love to bring this up, but if Linux did have first-class containers, how would the developer's experience be different?

Docker would probably diverge less from LXC, because it was first built on LXC and only later got its own low level implementation using namespaces and the other low-level things. Hard to say if the alternative world would have been better or worse, a lot of LXC/LXD implementation details seem more technically competent than Docker.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#102

Post by nickik »

moonchild wrote: post #68

I'm a bit disappointed it didn't go into detail into the way jails differ from zones. VMs I understand, but it seemed like the main point of the post was to distinguish containers from the other three.

All the detail you could possible want:

https://www.youtube.com/watch?v=hgN8pCMLI2U

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#103

Post by zodiac »

peteretep wrote: post #90
didibus wrote: post #85

Earlier quoted context omitted.

I don't know, container is an abstract idea, and that's all. Can you run apps within a contained OS environment? LXC is one way to do so, runc is another way to do so, docker is a third way to do so, all for Linux. Now if you took some other OS, there'd be different solutions, each with slightly different details and thus properties, but same idea. I mean, do you ask people what SQL is? And get frustrated if they don…

> container is an abstract idea In this context, it's not, it's specifically referring to a process running in a cgroup. > LXC is one way to do so, runc is another way to do so, docker is a third way to do so Docker is a suite of tools for managing running LXC or runc, both of which set up processes running under cgroups. > Now if you took some other OS, there'd be different solutions, each with slightly different de…

"container" can mean other things in other contexts though, e.g. I'm running a configuration of Docker on my machine right now such that the CLI talks about "containers" but it is actually running VirtualBox in the background

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#104

Post by fluffything »

outworlder wrote: post #4

> A “container” is just a term people use to describe a combination of Linux namespaces and cgroups. Linux namespaces and cgroups ARE first class objects. NOT containers. Amen. Somewhat tangential note: most developers I have met do not understand what a 'container' is. There's an aura of magic and mystique around them. And a heavy emphasis on Docker. A sizable fraction will be concerned about 'container overhead' (a…

I think how you are asking candidates the question might be unfortunate. A FreeBSD, MacOSX, or Windows dev that know their OSes might never tell you "namespace + cgroup".

Hell if you try to explain containers to 99% of the world programmers by saying "namespace + cgroup", I'd bet you that 0% of them will understand what you mean.

Instead, if you tell them that's "like a VM, but faster, because it "reuses" the host's kernel", you might be able to reach a substantial amount of them, and that level of abstraction would be enough for most of them to do something useful with containers.

Maybe the question you should be asking your candidates is: "How would you implement a Docker-like container app on Linux?". That's a question that specifically constraints the level of abstraction of the answer to at least one layer below Docker, and also specifies that you are interested on hearing the details for Linux.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#105

Post by nfoz »

So.... are any or all of these what you would call a process "sandbox"? Do operating systems make it easy to sandbox an application from causing harm to the system? What more could be done to make that a natural, first-class feature?

Like, let's say you found some binary and you don't know what it does, and don't want it to mess anything up. Is there an easy way to run it securely? Why not? And how about giving it specific, opt-in permissions, like limited network or filesystem access.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#106

Post by Jnr »

kqr wrote: post #93
outworlder wrote: post #4

> A “container” is just a term people use to describe a combination of Linux namespaces and cgroups. Linux namespaces and cgroups ARE first class objects. NOT containers. Amen. Somewhat tangential note: most developers I have met do not understand what a 'container' is. There's an aura of magic and mystique around them. And a heavy emphasis on Docker. A sizable fraction will be concerned about 'container overhead' (a…

> A “container” is just a term people use to describe a combination of Linux namespaces and cgroups. Linux namespaces and cgroups ARE first class objects. NOT containers. Wow. I have always wondered in which cases one would use "containers". I have asked so many Docker enthusiasts, "Why would I use containers instead of the strong process separation functionality that's built into the operating system, like users, cg…

I started using Linux containers long time ago and I have used it to achieve compatibility and ease of use.

Before LXC was introduced it was somewhat painful to manage multiple environments using chroot, managing network, etc.

But running the same software in a single environment wasn't always easy. You had to take care of different software versions. And it wasn't uncommon for things to break frequently because of that.

While things like python venv, ruby rvm, etc. helped dealing with it, there was no universal tool for whole filesystem environments besides virtualization.

When LXC came out, I started using it for everything. Nowadays I use LXD and sometimes Docker and it is so nice and requires minimal effort. I know that without those tools it would be very inconvenient to manage my own servers. I have separate auto-updating containers for everything and if one thing breaks, it doesn't take everything down with it. And when everything is contained and each system has minimal set of packages set up, over the years rarely anything ever breaks.

And let's not forget that these Linux features also enabled the universal packages (flatpaks, snaps, etc.) which make it easier for Desktop users to get up to date software easily.

Of course I know that it is not virtualization. But why do people say "containers are not really containers"? It still contains different environments. No one said it is about containing memory or something else.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#107

Post by pmichaud »

xelxebar wrote: post #47
CBLT wrote: post #29

Earlier quoted context omitted.

> To this day, I've heard CGroups being mentioned only once. See https://www.kernel.org/doc/Documentation/cgroup-v2.txt > "cgroup" stands for "control group" and is never capitalized. The singular form is used to designate the whole feature and also as a qualifier as in "cgroup controllers". When explicitly referring to multiple individual control groups, the plural form "cgroups" is used. To this day, I've heard cgr…

> To put forth a more substantive argument, everybody has a layer of abstraction they do not peek under. Sure. Though it's reasonable to want your level N developers to have some idea of what goes on at levels N-1 and perhaps N-2, cf. Law of Leaky Abstractions etc. It's similar to wanting your developers to be aware of their users' needs, which are level N+1 concerns.

Yeah, I wonder if there's an "optimal target" for the number of layers up and down you'd ideally be aware of. It has to be at least yours, and ones immediately above and below, but I see innovation coming from people with unusually keen insight into layers further away--eg. people making brilliant architectural decisions because they really, really know what the consumers of an api need and how those people think about the domain. Or vice versa, someone making something radically better or faster in a web app because they really get how the linux kernal is implemented.

It seems like cases where that deep knowledge is an advantage are rare but also very high value. I wonder how the EV pans out, both for individuals and orgs.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#108

Post by bregma »

cmckn wrote: post #23
matharmin wrote: post #11

Earlier quoted context omitted.

I feel nowadays containers generally refer to the concept, and cgroups and namespaces are the implementation details of a specific container runtime. These are very important implementation details for security and performance, but it doesn't fundamentally impact how you structure your containerized application. You can take the same container image, and run using Docker, Firecracker, gVisor, or many other container…

Agreed. The post feels a bit pedantic; I don't know any dev doing "cool things" with the underlying namespaces/cgroups. They're just using Docker. De-mystifying containers has value, but so does the abstraction.

Your personal ignorance makes a poor argument.

Not only do I know several devs doing cool things with namespaces and cgroup, but I myself have done cool things with namespaces and cgroups.

I played with Docker briefly, but it has no real practical application in my line of work.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#109

Post by dirtydroog »

For my workload I've struggled to see the advantage containers would give me. Maybe someone here can convince me, rather than the current justification of 'docker all the things'.

We have servers, they handle a lot of traffic. It's the only thing running on the machines and takes over all the resources of the machine. It will need all the RAM, and all 16 vCPUs are at ~90%.

It's running on GCP. To rollout we have a jenkins job that builds a tag, creates a package (dpkg) and builds an image. There's another jenkins job that deploys the new image to all regions and starts the update process, autoscaling and all that.

Can containers help me here?

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#110

Post by cyphar »

microtonal wrote: post #92
cyphar wrote: post #65

Earlier quoted context omitted.

All system programs could operate and manage the containers running on the system, meaning you can use your existing knowledge to manage a bunch of containers. For instance, you could run your package manager across all containers to see if they have packages with known CVEs. Or manage the filesystems of all containers on the system (the usefulness of this is only clear with filesystems like ZFS and btrfs). This is e…

For instance, you could run your package manager across all containers to see if they have packages with known CVEs. Or manage the filesystems of all containers on the system (the usefulness of this is only clear with filesystems like ZFS and btrfs). This is effectively what you can do with Solaris Zones. You can also do this on Linux with NixOS, where you can define the system and all containers it runs declarativel…

Sure that's because the package manager is container-aware (and NixOS is very cool -- don't get me wrong), but the distinction is that on Solaris all system tools are Zone-aware (including things like DTrace which would require specifically an in-kernel container concept because you need to be able to aggregate by container and there isn't any in-kernel data to aggregate on in Linux -- and no, cgroup IDs aren't sufficient).
Post reply on HN