Live data from Hacker News

Linux containers in a few lines of code

zserge.com

11–20 of 87 posts

Re: Linux containers in a few lines of code

#11

DIY Containers on Linux is probably a better term here given that Linux Containers is already heavily in use around the world and included in ubuntu by Canonical? For me this is enough to get a container running: lxd init lxc launch ubuntu mycontainer lxc exec mycontainer bash https://linuxcontainers.org/

I'll add systemd-nspawn to the list.

Re: Linux containers in a few lines of code

#12

DIY Containers on Linux is probably a better term here given that Linux Containers is already heavily in use around the world and included in ubuntu by Canonical? For me this is enough to get a container running: lxd init lxc launch ubuntu mycontainer lxc exec mycontainer bash https://linuxcontainers.org/

I don't know, I find "Linux Containers" to be sufficiently generic as Linux has native support for them. LXD/LXC, Docker, etc, are simply tools built upon that.

[deleted]

Re: Linux containers in a few lines of code

#13
post #10

While this is interesting, it doesn't really show how containers actually work , only lists the specific syscall flags to tell Linux create one . A similar snippet[1] exists for go, and it doesn't do anything particularly special either. I don't know, maybe David beazley has altered my sense of what "from scratch" means. [1] https://gist.github.com/lizrice/a5ef4d175fd0cd3491c7e8d71682...

This is how containers work though. Or did you want more detail about the internals of pivot_root or something?

Re: Linux containers in a few lines of code

#14

DIY Containers on Linux is probably a better term here given that Linux Containers is already heavily in use around the world and included in ubuntu by Canonical? For me this is enough to get a container running: lxd init lxc launch ubuntu mycontainer lxc exec mycontainer bash https://linuxcontainers.org/

I don't know, I find "Linux Containers" to be sufficiently generic as Linux has native support for them. LXD/LXC, Docker, etc, are simply tools built upon that.

I agree. Most people who read "Linux Containers" are going to think of Docker, not LXD.

Re: Linux containers in a few lines of code

#15
post #13
post #10

While this is interesting, it doesn't really show how containers actually work , only lists the specific syscall flags to tell Linux create one . A similar snippet[1] exists for go, and it doesn't do anything particularly special either. I don't know, maybe David beazley has altered my sense of what "from scratch" means. [1] https://gist.github.com/lizrice/a5ef4d175fd0cd3491c7e8d71682...

This is how containers work though. Or did you want more detail about the internals of pivot_root or something?

Yes, something like that.

Like here's David's "Build Your Own Async" [1], which I prefer over Philip's (still extremely good) "What the heck is the event loop anyway?" [2].

It's one thing to tell how something works, but to successfully show what the hell its actually doing under the covers, just conveys much more information.

[1] https://www.youtube.com/watch?v=Y4Gt3Xjd7G8 [2] https://www.youtube.com/watch?v=8aGhZQkoFbQ

Re: Linux containers in a few lines of code

#16
post #13
post #10

While this is interesting, it doesn't really show how containers actually work , only lists the specific syscall flags to tell Linux create one . A similar snippet[1] exists for go, and it doesn't do anything particularly special either. I don't know, maybe David beazley has altered my sense of what "from scratch" means. [1] https://gist.github.com/lizrice/a5ef4d175fd0cd3491c7e8d71682...

This is how containers work though. Or did you want more detail about the internals of pivot_root or something?

Agree, you can't make your own code to isolate from the OS. You need the OS to do that.

Re: Linux containers in a few lines of code

#17
post #4

A little bit of education about container systems in linux[1]. A container system is typically made up a number of components: isolation layer : the piece that limits privileges and resource usage. (On linux, this is usually handled by cgroups and the kernel, but could also be handled by something like kvm for vm-based containers) raw container configuration : Given an image and some metadata (like cpu limits), launc…

I feel like podman is proving that you don't really need the api daemon and a porcelain over runc with a one-off process supervisor is sufficient for a good number of workloads.

Being able to run containers like any other process and leave the lifecycle management to systemd is actually really nice.

Re: Linux containers in a few lines of code

#20
Could someone comment on how secure such a container is, at least nominally? Should I be able to theoretically run untrusted code on such a container if the system is bug-free and I add proper error-checking to the code? Or are there things that you'd need to worry about the code being able to access? Any considerations regarding sudo permissions?
Post reply on HN