Tell me you don't understand containers wihout telling me you dont understand containers.
You don't understand vm's neither. Ever used virtual network interfaces?
My VM is lighter (and safer) than your container (2017)
31–40 of 111 posts
Re: My VM is lighter (and safer) than your container (2017)
#32This paper references consistently mischaracterizes AWS Lambda as a "Container as a Service" technology, when in fact it is exactly the sort of lightweight VM that they are describing - https://aws.amazon.com/blogs/aws/firecracker-lightweight-vir...
AWS "just" runs linux but this is using unikernels tho ?
No, it's using a modified version of the Xen hypervisor and the numbers they show are boot times and memory usage for both unikernels and pared down Linux systems (via tinyx). It's described in the abstract:
> We achieve lightweight VMs by using unikernels for specialized applications and with Tinyx, a tool that enables creating tailor-made, trimmed-down Linux virtual machines.
Re: My VM is lighter (and safer) than your container (2017)
#33Title is kinda clickbaity (wha-? how can a VM be lighter than a container). It's about unikernels.
Firecracker VMs are considered lighter than a container and are pretty old at this point.
I would say that firecracker VMs are not more lightweight than Linux containers.
Linux containers are essentially the separation of Linux processes via various namespaces e.g. mount, cgroup, process, network etc. Because this separation is done by Linux internally there are not that many overheads.
VMs provide a different kind of separation one that is arguably more secure because it is backed up hardware -- each VM thinks it has the whole hardware to itself. When you switch between the VM and the host there is quite a heavyweight context switch (VMEXIT/VMENTER in Intel parlance). It can take a long time compared to just the usual context switch from one Linux container (process) to another host (process) or another Linux container (process).
But coming back to your point, no firecracker VMs are not lighter/lightweight than a Linux container. They are quite heavyweight actually. But the firecracker VMM is probably the most nimble of all VMMs.
Re: My VM is lighter (and safer) than your container (2017)
#34> We achieve lightweight VMs by using unikernels
When I attended Infiltrate a few years ago, there was a talk about unikernels. The speaker showed off how incredibly insecure many of them were, not even offering support for basic modern security features like DEP and ALSR.
Have they changed? Or did the speaker likely just cherry-pick some especially bad ones?
Re: My VM is lighter (and safer) than your container (2017)
#35Title is kinda clickbaity (wha-? how can a VM be lighter than a container). It's about unikernels.
> how can a VM be lighter than a container It's still clickbaity, but the title implies a comparison between a very lightweight VM and a heavy-weight container (presumably a container based on a full Linux distro). You could imagine an analogous article about a tiny house titled "my house is smaller than your apartment".
It is still lighter in memory only. CPU is also a relevant thing to compare them.
Re: My VM is lighter (and safer) than your container (2017)
#36> We achieve lightweight VMs by using unikernels When I attended Infiltrate a few years ago, there was a talk about unikernels. The speaker showed off how incredibly insecure many of them were, not even offering support for basic modern security features like DEP and ALSR. Have they changed? Or did the speaker likely just cherry-pick some especially bad ones?
The headline reads like a reddit post so I'm going to assume the same still holds true.
Re: My VM is lighter (and safer) than your container (2017)
#37Yes, when you custom engineer a specific, complex solution for a specific use case, it is generally more performative than a general-use solution that's simple.
Re: My VM is lighter (and safer) than your container (2017)
#38"orders of magnitude" : Why does anyone ever write "two orders of magnitude" when 100x is shorter? Of course, this presumes 10 as the magnitude and the N orders to be the exponent, but I don't think I've ever, since the 90s, seen that stilted phrasing ever used for a base other than 10.
Because two orders of magnitude does not mean 100x. It means on the same order as 100x.
Do you mean folks using the phrase know big-O, big-omega, big-theta, and are thinking along those lines?
Re: My VM is lighter (and safer) than your container (2017)
#39The issue with unikernels and things like Firecracker are that you can't run them on already-virtualized platforms
I researched Firecracker when I was looking for an alternative to Docker for deploying FaaS functions on an OpenFaaS-like clone I was building
It would have worked great if the target deployment was bare metal but if you're asking a user to deploy on IE an EC2 or Fargate or whatnot, you can't use these things so all points are moot
This is relevant if you're self-hosting or you ARE a service provider I guess.
(Yes, I know about Firecracker-in-Docker, but I mean real production use)
Re: My VM is lighter (and safer) than your container (2017)
#40It's not clear to me that VMs actually do offer better isolation than well-designed containers (i.e. not docker).
It's basically a question of: do you trust the safety of kernel-mode drivers (for e.g. PV network devices or emulated hardware) for VMs, or do you trust the safety of userland APIs + the limited set of kernel APIs available to containers.
On my FreeBSD server, I kind of trust jails with strict device rules (i.e. there are only like 5 things in /dev/) over a VM with virtualized graphics, networking, etc.