Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My VM is lighter (and safer) than your container (2017)

dl.acm.org

Post reply on HN
Print view View original

91–100 of 111 posts

Re: My VM is lighter (and safer) than your container (2017)

#91

Post by fomine3 »

hinkley wrote: post #56
All4All wrote: post #45

Earlier quoted context omitted.

Isn't that essentially what Vagrant and Vagrantfiles do?

What is your theory for why Docker won and Vagrant didn't? Mine is that all of the previous options were too Turing Complete, while the Dockerfile format more closely follows the Principle of Least Power. Power users always complain about how their awesome tool gets ignored while 'lesser' tools become popular. And then they put so much energy into apologizing for problems with the tool or deflecting by denigrating th…

Vagrant never targeted production so not much money/resource/interest invested?

Re: My VM is lighter (and safer) than your container (2017)

#92

Post by _0w8t »

evol262 wrote: post #49
xani_ wrote: post #28

Earlier quoted context omitted.

They went to trash because containers are more convenient to use and saving few MBs of disk/memory is not what most users care. The whole idea was pretty much either use custom kernel (which inevitably have way less info on how to debug anything in it), and re-do all of the network and storage plumbing containers already do via the OS they are running one. OR just very slim linux one which at least people know how to…

Virtualization is not just "perceived" security over containerization. From CPU rings on down, it offers dramatically more isolation for security than containerization does. This isn't about 'what most users care' about either. Most users don't really care about 99% of what container orchestration platforms offer. The providers do absolutely care that malicious users cannot punch out to get a shell on an Azure AKS co…

Running a VM is not necessary more secure than running a container. By definition VM allows to run an untrusted kernel code which makes exploiting curtain bugs more feasible. This is especially so with hardware bugs.

What is fundamentally more secure is running applications inside a VM which is what Amazon is doing. The attacker then has to first exploit the kernel before trying to escape the hypervisor.

Re: My VM is lighter (and safer) than your container (2017)

#93

Post by indigodaddy »

NorwegianDude wrote: post #62
bongobingo1 wrote: post #13

I'm quite interested in seeing where slim VM's go. Personally I don't use Kubernetes, it just doesn't fit my client work which is nearly all single-server and it makes more sense to just run podman systemd units or docker-compose setups. So from that perspective, when I've peeked at firecracker, kata containers, etc, the "small dev dx" isn't quite there yet, or maybe never will get there since the players target othe…

I've been using containers since 2007 for isolating workloads. I don't really like Docker for production either because of the network overhead with the "docker-way" of doing things. LXD is definetly my favorite container tool.

LXD can now do VM as well. https://ubuntu.com/blog/lxd-virtual-machines-an-overview

Re: My VM is lighter (and safer) than your container (2017)

#94

Post by gaocegege »

bongobingo1 wrote: post #13

I'm quite interested in seeing where slim VM's go. Personally I don't use Kubernetes, it just doesn't fit my client work which is nearly all single-server and it makes more sense to just run podman systemd units or docker-compose setups. So from that perspective, when I've peeked at firecracker, kata containers, etc, the "small dev dx" isn't quite there yet, or maybe never will get there since the players target othe…

I do not think Docker is the end game. Firecracker/kata containers neither.

https://github.com/tensorchord/envd is my favorite container tool. It provides the build language based on Python and the build is optimized for this scenario.

There may be more runtime and image build tools for both containers and VMs. And different tools may be designed for different purposes. That's the future I believe.

Re: My VM is lighter (and safer) than your container (2017)

#95

Post by gaocegege »

hinkley wrote: post #56
All4All wrote: post #45

Earlier quoted context omitted.

Isn't that essentially what Vagrant and Vagrantfiles do?

What is your theory for why Docker won and Vagrant didn't? Mine is that all of the previous options were too Turing Complete, while the Dockerfile format more closely follows the Principle of Least Power. Power users always complain about how their awesome tool gets ignored while 'lesser' tools become popular. And then they put so much energy into apologizing for problems with the tool or deflecting by denigrating th…

Vagrant images are always huge. But docker images are small. You can deliver and share docker images with ease.

Re: My VM is lighter (and safer) than your container (2017)

#96

Post by Sirened »

gavinray wrote: post #57
gamegoblin wrote: post #42

Earlier quoted context omitted.

This is a limitation of whatever virtualized instance you're running on, not Firecracker itself. Firecracker depends on KVM, and AWS EC2 virtualized instances don't enable KVM. But not all virtualized instance services disable KVM. Obviously, Firecracker being developed by AWS and AWS disabling KVM is not ideal :) Google Cloud, for instance, allows nested virtualization, IIRC.

Yeah but imagine trying to convince people to use an OSS tool where the catch is that you have to deploy it on special instances, only on providers that support nested virtualization Not a great DX, haha I wound up using GraalVM's "Polyglot" abilities alongside it's WASM stuff

eh, I think most of the reason we don't see NV support on most public cloud instances is that nobody has come up with a compelling OSS tool that needs it. afaik most providers disable it because they want to discourage you from subletting their instances lol.

Re: My VM is lighter (and safer) than your container (2017)

#97

Post by pjmlp »

xani_ wrote: post #28
bongobingo1 wrote: post #13

I'm quite interested in seeing where slim VM's go. Personally I don't use Kubernetes, it just doesn't fit my client work which is nearly all single-server and it makes more sense to just run podman systemd units or docker-compose setups. So from that perspective, when I've peeked at firecracker, kata containers, etc, the "small dev dx" isn't quite there yet, or maybe never will get there since the players target othe…

They went to trash because containers are more convenient to use and saving few MBs of disk/memory is not what most users care. The whole idea was pretty much either use custom kernel (which inevitably have way less info on how to debug anything in it), and re-do all of the network and storage plumbing containers already do via the OS they are running one. OR just very slim linux one which at least people know how to…

Except stuff like Kata Containers exist exactly because containers alone is not enough.

WebAssembly on the cloud is only re-inventing what other bytecode based platforms have been doing for decades, but VC need ideas to invest into apparently.

Re: My VM is lighter (and safer) than your container (2017)

#98

Post by pjmlp »

fnord123 wrote: post #2

Title is kinda clickbaity (wha-? how can a VM be lighter than a container). It's about unikernels.

Which in case someone has failed to notice, is pretty much how serverless happens to work out from development point of view.

No one cares how the language runtime is actually running.

Re: My VM is lighter (and safer) than your container (2017)

#99

Post by pjmlp »

lamontcg wrote: post #55

Containers should really be viewed as an extension of packages (like RPM) with a bit of extra sauce with the layered filesystem, a chroot/jail and cgroups for some isolation between different software running on the same server. Back in 2003 or so we tried doing this with microservices that didn't need an entire server with multiple different software teams running apps on the same physical image to try to avoid givi…

Back in 2000 we were doing this with HP-UX Vaults, IT keeps going in circles.

Re: My VM is lighter (and safer) than your container (2017)

#100

Post by R0flcopt3r »

r3mc0 wrote: post #6

Containers and VMs are totally not the same thing. They serve a complete other purpose , as multiple containers can be combined to create an application/service , VMs always use a complete os etc etc anyway the internet is full of the true purpose of containers , they were never meant to use as a "VM" and about security.. meh everything is insecure until proven differently

Maybe you should read the article? The article basically covers running a tiny kernel that as exactly what you need to run one single binary, which is your application. No printer drivers, video drivers. Probably have network drivers, as that would be quite handy. Kinda up to you on what kernel you pick for this, and what drivers are included. Multiple VMs with networking can also be "combined"...

Containers are great because they are small and fast, low overhead etc. And that is why they replaced virtual machines. This article however proves that this is also achievable with virtual machines.

Post reply on HN