91–100 of 161 posts
Earlier quoted context omitted.
Lack of GNU stuff would be a selling point.
Quoted post unavailable.
With brand ambassadors like yourself is there any wonder why I and many others want nothing to do with GNU or the FSF?
Earlier quoted context omitted.
I don't get it. How are people using this flexibility to get things done in practice, and what uses aren't allowed by the jail model?
You can just compare the APIs, namespaces are like the individual components of a jail. You can use them to build something like a jail, or something different that has a different security model. This was discussed a lot in an old HN thread: https://news.ycombinator.com/item?id=13982620
Earlier quoted context omitted.
I don't get it. How are people using this flexibility to get things done in practice, and what uses aren't allowed by the jail model?
> How are people using this flexibility to get things done in practice Um... to loop back to the upthread point: Docker. People are using Docker, and docker is using this stuff.
If I'm wrong: what is it using, and what problems is this flexibility solving?
Earlier quoted context omitted.
The "market" did not want Docker. Docker as a product failed. There are many reasons why FreeBSD jails count not get out for FreeBSD land, one, very important thing is the Linux community's NIH attitude.
I don't think you can explain that as NIH. From what I have seen, Linux namespaces are a much more powerful primitive than BSD jails.
- brtfs vs zfs
- cgroups vs jails
- SystemTap vs dtrace
- Systemd vs smf
I get it, many of these were due to licensing issues. So they said[1]. Anyways, there are still some things to implement for linux. pf is my favourite (software) firewall. It would be great to see it ported to Linux.
1. https://opensource.stackexchange.com/questions/2094/are-cddl...
Earlier quoted context omitted.
Same here, but I never understood how BSD jails or Solaris zones are better over normal hardware virtualization which is used in Qubes OS. In addition, you get a great UX in the latter.
Also OS level emulation. Linux system calls can be translated to Solaris system calls allowing to run Linux specific workloads without having to emulate hardware and a full Linux kernels. Furthermore before Dtrace was ported Linux it allowed to debug Linux workloads under DTrace.
One thing I find so valuable about jails is the ability to jail a single command with no other userland than what that binary requires. Here's an example from my personal name server: /usr/sbin/jail /jails/www www 10.10.10.36 /lighttpd -f conf/lighttpd.conf ... and although this jail has a lot of content files in it, the actual UNIX userland is only what is required to run 'lighttpd': # find /jails/www/usr | wc -l 43…
Just seems unnecessarily complicated.
Earlier quoted context omitted.
I don't get it. How are people using this flexibility to get things done in practice, and what uses aren't allowed by the jail model?
You can just compare the APIs, namespaces are like the individual components of a jail. You can use them to build something like a jail, or something different that has a different security model. This was discussed a lot in an old HN thread: https://news.ycombinator.com/item?id=13982620
One real difference is that you need to be root to create a jail. It'll get fixed eventually - FreeBSD already has unprivileged chroot, jail isn't that much different.
I use jails for years, the only thing which is painful are upgrades from ports for all the jails. It's time consuming. Poudriere helps but the whole thing is far from ideal :(