11–20 of 104 posts
> We take Docker-type containers from users and transmogrify them into Firecracker micro-VMs What is the relationship with micro kernels? Is the feature available separate from the deployment/hosting?
Earlier quoted context omitted.
Why not something like: ssh dogmatic-potato-342@jump.fly.io And tunnel connection over wireguard on jump server
Because then there would be some service exposed to the Internet (not over WireGuard; if you have WireGuard, you don't need a jump box) whose job it would be to hop 6PN networks. The only thing we have in our infra now that controls access to 6PN is eBPF code; we keep the system simple so we can reason about it.
Earlier quoted context omitted.
Because then there would be some service exposed to the Internet (not over WireGuard; if you have WireGuard, you don't need a jump box) whose job it would be to hop 6PN networks. The only thing we have in our infra now that controls access to 6PN is eBPF code; we keep the system simple so we can reason about it.
Fair point, but isn’t this also losing “who connected to this server in my organization and when” information.
https://github.com/majek/slirpnetstack/
(btw, gvisor netstack, while not without problems, is likely to be faster than libslirp, see benchmarks https://github.com/rootless-containers/rootlesskit/pull/101#... )
> We take Docker-type containers from users and transmogrify them into Firecracker micro-VMs What is the relationship with micro kernels? Is the feature available separate from the deployment/hosting?
None. A Firecracker micro-vm is just a very small, very quick-to-start-up VM. It uses KVM, eliminates the BIOS, and implements only the minimal devices needed to boot and run server Linux. Amazon built the project for Lambda and Fargate. More about it here: https://fly.io/blog/sandboxing-and-workload-isolation/
By the way, as an elixir developer Fly.io looks extremely cool. But my (mostly public sector) customers want to hear something similar to the words "AWS" when asked about hosting – so is it running on top of AWS or Azure or GCP? (instances look like they may be GCP, which is fine too).
Earlier quoted context omitted.
None. A Firecracker micro-vm is just a very small, very quick-to-start-up VM. It uses KVM, eliminates the BIOS, and implements only the minimal devices needed to boot and run server Linux. Amazon built the project for Lambda and Fargate. More about it here: https://fly.io/blog/sandboxing-and-workload-isolation/
Is this sort of like what MS is doing with Windows Subsystem for Linux, where they're able to "boot" that Linux in mere seconds? By the way, as an elixir developer Fly.io looks extremely cool. But my (mostly public sector) customers want to hear something similar to the words "AWS" when asked about hosting – so is it running on top of AWS or Azure or GCP? (instances look like they may be GCP, which is fine too).
Off-topic: What's the software used for the blog?
Is this super complex infrastructure for fairly simple thing or am I missing something?
No, it is extra-super complex infrastructure for a fairly simple thing. Normal SSH still works, and is usually going to be what people end up using. You just have to have WireGuard installed and running. The product feature here is less interesting than how we did it.
(I admit that I haven't looked much into mesh networking / edge servers, so I don't know what the problems are. I always preferred Internet -> Identity Aware Proxy type thing -> mTLS mesh that is useless to humans. And, I don't ssh to stuff much anymore... I have my software collect debugging information and send it to something I can access through a browser or API, and control that software through an API. So everything is editing config files, basically, not SSHing places ;)
Earlier quoted context omitted.
No, it is extra-super complex infrastructure for a fairly simple thing. Normal SSH still works, and is usually going to be what people end up using. You just have to have WireGuard installed and running. The product feature here is less interesting than how we did it.
It's not clear to me how much day-to-day use of Wireguard being a Fly customer requires, but I can't help but wonder if you guys should collaborate with Tailscale to make all of the micro-VMs appear on a Tailscale network, and authorize access between humans and the VMs that way. (I admit that I haven't looked much into mesh networking / edge servers, so I don't know what the problems are. I always preferred Internet…