Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Nestybox (YC S20) – Containers beyond microservices

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 112 posts

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#102

Post by compsciphd »

rmolina wrote: post #93
compsciphd wrote: post #92

the docker installation that rhel uses carries small patches that enable one to build containers that run with systemd as init with ease, without the user having to do anything special (or run with privilege), its runtime sets everything up for you correctly. I've built and run them, so I know they work. RedHat wanted docker to take them, but Docker refused.

Didn't know that. But it makes sense given that podman already supports it. Btw, i did a quick search but couldn't find anything on this (docker's systemd support in rhel). If you happen to know where to find these patches, please send them my way. Thanks.

https://www.projectatomic.io/docs/docker_patches/

specifically, the hooks patch.

then see https://developers.redhat.com/blog/2016/09/13/running-system... (i.e. 4 years ago when I built containers to do this)

though of course as you note they now say to use podman https://developers.redhat.com/blog/2019/04/24/how-to-run-sys...

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#103

Post by smcleod »

yjftsjthsd-h wrote: post #62
ram_rar wrote: post #46

Earlier quoted context omitted.

i'm just curious. For what kind of use cases do you need docker inside of another docker?

I use dind to build containers in gitlab ci.

Try using Kaniko with GitLab CI, it will save you from having to run privileged / DIND containers.

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#104

Post by yjftsjthsd-h »

smcleod wrote: post #103
yjftsjthsd-h wrote: post #62

Earlier quoted context omitted.

I use dind to build containers in gitlab ci.

Try using Kaniko with GitLab CI, it will save you from having to run privileged / DIND containers.

I've been experimenting with buildah, but that does look like another option I should try, thanks.

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#105

Post by peter_d_sherman »

I think this might have some use cases outside of running microservices, services, Docker / container images, etc.

For example, let's say that I'd like to compile some complex piece of Linux software, software for which I don't have all of the third-party software/library dependencies, and I don't want to download/install all of those packages on my desktop Linux computer, because they're only going to spam it up...

Well, it sounds like with a Nestybox -- I could install all of those 3rd party libraries/packages, compile the code (inside of the Nestybox), and then not have to worry about my main Linux desktop being clogged/spammed up by unwanted third party libraries/binaries/dependencies... is that true?

Will Nestybox work for the above scenario?

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#106

Post by rmolina »

peter_d_sherman wrote: post #105

I think this might have some use cases outside of running microservices, services, Docker / container images, etc. For example, let's say that I'd like to compile some complex piece of Linux software, software for which I don't have all of the third-party software/library dependencies, and I don't want to download/install all of those packages on my desktop Linux computer, because they're only going to spam it up...…

Right, that will work.

I fully agree that Sysbox use-cases extend beyond docker-in-docker and k8s-in-docker. These, docker and k8s, were just the first two system 'apps' that we decided to support, but Sysbox can grow to support many others.

To be fair, we are not expecting Sysbox to be able to run _every_ application, for many apps you'll still need hw virtualization. Our goal is to focus on the (potentially large) subset of apps that could technically run inside a container, but are not capable of doing so due to current runtime limitations (mainly coz they were not designed for that purpose).

Thanks.

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#107

Post by ctalledo »

Omnipresent wrote: post #86

what are some practical use cases of being able to run docker inside docker? Does that help with hardware in the loop?

A use case that we often get asked about for Docker-in-Docker is using the outer container as a dev environment that includes a developer's tools, ssh, and a dedicated Docker (CLI + daemon). It gives sys-admins a lighter-weight alternative to VMs for launching those dev environments, and works well in scenarios where efficiency & cost reduction is important and having VM-level isolation is not required. The problem is that prior to Sysbox, those outer containers had to be privileged containers, which provide very weak isolation (e.g., it's possible to turn off the host from within the privileged container!). With Sysbox, those outer containers are now properly isolated via the Linux user-namespace, truly enabling this use-case.

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#108

Post by peter_d_sherman »

rmolina wrote: post #106
peter_d_sherman wrote: post #105

I think this might have some use cases outside of running microservices, services, Docker / container images, etc. For example, let's say that I'd like to compile some complex piece of Linux software, software for which I don't have all of the third-party software/library dependencies, and I don't want to download/install all of those packages on my desktop Linux computer, because they're only going to spam it up...…

Right, that will work. I fully agree that Sysbox use-cases extend beyond docker-in-docker and k8s-in-docker. These, docker and k8s, were just the first two system 'apps' that we decided to support, but Sysbox can grow to support many others. To be fair, we are not expecting Sysbox to be able to run _every_ application, for many apps you'll still need hw virtualization. Our goal is to focus on the (potentially large)…

Sounds absolutely awesome! Congrats on your excellent product / company!

I hope you find much success!

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#109

Post by rmolina »

peter_d_sherman wrote: post #108
rmolina wrote: post #106

Earlier quoted context omitted.

Right, that will work. I fully agree that Sysbox use-cases extend beyond docker-in-docker and k8s-in-docker. These, docker and k8s, were just the first two system 'apps' that we decided to support, but Sysbox can grow to support many others. To be fair, we are not expecting Sysbox to be able to run _every_ application, for many apps you'll still need hw virtualization. Our goal is to focus on the (potentially large)…

Sounds absolutely awesome! Congrats on your excellent product / company! I hope you find much success!

Thanks a lot Peter!

Re: Launch HN: Nestybox (YC S20) – Containers beyond microservices

#110

Post by Klasiaster »

mleonard wrote: post #53

How does Sysbox compare to Podman? (If I remember correctly you can run systemd in a podman container and/or run a podman container with systemd.

Yes, the situation even improved with the latest releases:

  podman run -ti --security-opt label=disable --security-opt seccomp=unconfined --cap-add SYS_ADMIN --env STORAGE_DRIVER=vfs quay.io/podman/stable sh -c "dnf update -y; podman run hello-world"
Post reply on HN