Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Nestybox (YC S20) – Containers beyond microservices

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 112 posts

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#41

Post by ctalledo »

swsieber wrote: post #38
ctalledo wrote: post #36

Earlier quoted context omitted.

Thanks! Yes, Sysbox is using OS-virtualization techniques to augment the abstraction of the container, thereby enabling software that interacts deeply with the kernel (e.g., dockerd, k8s, etc) to run inside the container, and do so with proper isolation (no privileged containers). Now that you mention user-mode linux, it is one of the references we used as we built Sysbox, though they are very different things of cou…

So can you run sysbox in sysbox?

Unfortunately not. Sysbox requires "true root" privileges, so it can't run inside a system container deployed by Sysbox itself (since that system container would use the user namespace). You can run Sysbox inside a privileged container however, and in fact the Sysbox test framework relies on this heavily.

What use case do you envision for running sysbox in sysbox?

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#42

Post by ctalledo »

jpetrucc wrote: post #32
ctalledo wrote: post #29

Earlier quoted context omitted.

Thanks! Performance wise, we've not noticed any reduction in performance compared to a regular container, mainly because Sysbox sits on some control-path operations (e.g., accesses to /proc/sys, mount syscall, etc) but is really not intercepting anything on the datapath. For example, deploying K8s inside a system container takes As far as using this in production, the software is well tested but has not been used in…

Thanks for the response - looking forward to trying it out this weekend!

Great! ping us on our slack channel (the link is in the sysbox README file) in case you need help.

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#43

Post by omginternets »

ctalledo wrote: post #39
omginternets wrote: post #37

How can I use this to start a system container on e.g. AWS?

You can certainly install Sysbox on an AWS EC2 VM and launch system containers inside that VM. Note that Sysbox currently requires Ubuntu Linux, because the latest Ubuntu releases use pretty new kernels and carry kernel patches that Sysbox relies on in order to perform some of the OS-virtualization in userland. See this doc for the distros supported by Sysbox: https://github.com/nestybox/sysbox/blob/master/docs/distr…

Ah sorry, I was unclear: I meant Amazon ECS.

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#44

Post by rmolina »

asadlionpk wrote: post #40
rmolina wrote: post #26

Earlier quoted context omitted.

Sorry, not sure i got that. Can you please elaborate?

I think they mean: why is https://github.com/nestybox a user instead of an org account?

I see. Will look into that right away. Thanks!

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#45

Post by ctalledo »

omginternets wrote: post #43
ctalledo wrote: post #39

Earlier quoted context omitted.

You can certainly install Sysbox on an AWS EC2 VM and launch system containers inside that VM. Note that Sysbox currently requires Ubuntu Linux, because the latest Ubuntu releases use pretty new kernels and carry kernel patches that Sysbox relies on in order to perform some of the OS-virtualization in userland. See this doc for the distros supported by Sysbox: https://github.com/nestybox/sysbox/blob/master/docs/distr…

Ah sorry, I was unclear: I meant Amazon ECS.

Got it; the answer is no, because I believe AWS ECS (Fargate) creates the containers using the OCI runc. In order for them to offer system-containers as a service, AWS ECS would need to run Sysbox on their backend to deploy the containers.

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#46

Post by ram_rar »

bfirsh wrote: post #31

Ex-Docker person here. I got an early peek at Sysbox and I'm really excited by it -- it's really neat. Docker is missing a bunch of features that make some software work, which is why you can't run Docker inside Docker by default. Instead of dropping from containers all the way down to hardware virtualization, Sysbox is "augmenting" containers with the missing features by simulating them in userland. That gives you a…

i'm just curious. For what kind of use cases do you need docker inside of another docker?

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#47

Post by wh33zle »

ram_rar wrote: post #46
bfirsh wrote: post #31

Ex-Docker person here. I got an early peek at Sysbox and I'm really excited by it -- it's really neat. Docker is missing a bunch of features that make some software work, which is why you can't run Docker inside Docker by default. Instead of dropping from containers all the way down to hardware virtualization, Sysbox is "augmenting" containers with the missing features by simulating them in userland. That gives you a…

i'm just curious. For what kind of use cases do you need docker inside of another docker?

For example, my CI provider might want to execute my build in a docker container for security reasons but I also want to run/build a docker container as part of my CI.

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#48

Post by sterlinm »

Have you considered looking at data science use cases for this (particularly with Python)? I've spent a lot of time tweaking containers meant for data science and one issue I run into a lot is that since you actually spend a lot of time developing inside the containers you want access to a lot of developer tools, but you end up with enormous images as a result. I could see using a tool like this to have one main developer container for working from that has all of your tooling and then using more streamlined containers for individual projects that have only the dependencies you need.

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#49

Post by rmolina »

sterlinm wrote: post #48

Have you considered looking at data science use cases for this (particularly with Python)? I've spent a lot of time tweaking containers meant for data science and one issue I run into a lot is that since you actually spend a lot of time developing inside the containers you want access to a lot of developer tools, but you end up with enormous images as a result. I could see using a tool like this to have one main deve…

Absolutely, that's one of Sysbox's main use-cases, we usually refer to it as 'docker sandboxes'. As you mentioned, the idea is to have your entire dev environment within your fully-customized container, which would allow you to take that environment wherever you go, you are not tied to a particular hypervisor or cloud service-provider. We have heard of people already using Sysbox in Jupyter ecosystem.
Post reply on HN