Live data from Hacker News

My VM is lighter (and safer) than your container (2017)

dl.acm.org

11–20 of 111 posts

Re: My VM is lighter (and safer) than your container (2017)

#11

Sometimes the less strict separation is a feature, not a bug. Without folder sharing with dockers for example, it would be pretty useless.

While a flawed comparison, WSL does use a VM in conjunction with the 9p protocol to achieve folder sharing.

9p-based folder sharing is (used to be?) possible with qemu, too.

Re: My VM is lighter (and safer) than your container (2017)

#12
post #2

Title is kinda clickbaity (wha-? how can a VM be lighter than a container). It's about unikernels.

Exactly, unikernels are great for performance and isolation, but that can't be compared to a full application stack running in a container or VM.

Re: My VM is lighter (and safer) than your container (2017)

#13
I'm quite interested in seeing where slim VM's go. Personally I don't use Kubernetes, it just doesn't fit my client work which is nearly all single-server and it makes more sense to just run podman systemd units or docker-compose setups.

So from that perspective, when I've peeked at firecracker, kata containers, etc, the "small dev dx" isn't quite there yet, or maybe never will get there since the players target other spaces (aws, fly.io, etc). Stuff like a way to share volumes isn't supported, etc. Personally I find Dockers architecture a bit distasteful and Podmans tooling isn't quite there yet (but very close).

Honestly I don't really care about containers vs VMs except the VM alleges better security which is nice, and I guess I like poking at things but they're were a little too rough for weekend poking.

Is anyone doing "small scale" lightweight vm deployments - maybe just in your homelab or toy projects? Have you found the experience better than containers?

Re: My VM is lighter (and safer) than your container (2017)

#15

Kubernetes says no... The article is light on detail. Containers and VMs have different use cases. If you self host lightweight VMs is likely the better path, however, once you in the cloud most managed services only provide support for containers.

You can also use a firecracker runner in k8s to wrap each container in a VM for high isolation and security.

Re: My VM is lighter (and safer) than your container (2017)

#16
post #6

Containers and VMs are totally not the same thing. They serve a complete other purpose , as multiple containers can be combined to create an application/service , VMs always use a complete os etc etc anyway the internet is full of the true purpose of containers , they were never meant to use as a "VM" and about security.. meh everything is insecure until proven differently

VMs can have private networks between each other just as containers do. That's pretty much what EC2 is about.

Re: My VM is lighter (and safer) than your container (2017)

#18
"orders of magnitude" :

Why does anyone ever write "two orders of magnitude" when 100x is shorter?

Of course, this presumes 10 as the magnitude and the N orders to be the exponent, but I don't think I've ever, since the 90s, seen that stilted phrasing ever used for a base other than 10.

Re: My VM is lighter (and safer) than your container (2017)

#19

"orders of magnitude" : Why does anyone ever write "two orders of magnitude" when 100x is shorter? Of course, this presumes 10 as the magnitude and the N orders to be the exponent, but I don't think I've ever, since the 90s, seen that stilted phrasing ever used for a base other than 10.

Because two orders of magnitude does not mean 100x. It means on the same order as 100x.

Re: My VM is lighter (and safer) than your container (2017)

#20

This paper references consistently mischaracterizes AWS Lambda as a "Container as a Service" technology, when in fact it is exactly the sort of lightweight VM that they are describing - https://aws.amazon.com/blogs/aws/firecracker-lightweight-vir...

For what it’s worth, Google’s cloud functions are a container service. You can even download the final docker container.

KVM gVisor is a hybrid model in this context. It shares properties with both containers and lightweight VMs.
Post reply on HN