Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ignite – Use Firecracker VMs with Docker images

github.com

Post reply on HN
Print view View original

41–50 of 84 posts

Re: Ignite – Use Firecracker VMs with Docker images

#41

Post by tillk »

duskwuff wrote: post #25

I like the way this sounds, but... is the project still alive? There haven't been any commits to the main branch since July, and the last release was over a year ago.

I have the same question. WeaveWorks has another project called footloose which allows docker containers to be used like VMs. Also dead.

The only other project/company (aside from Kata) promoting firecracker was Talos. But not sure if they maintain their integration still.

https://www.talos.dev/v1.2/reference/cli/#talosctl-cluster-c...

Re: Ignite – Use Firecracker VMs with Docker images

#42

Post by rwmj »

deathanatos wrote: post #21
cercatrova wrote: post #2

Related, My VM is Lighter (and Safer) than your Container (2017) : https://news.ycombinator.com/item?id=32764501 Looks like Ignite could be the best of both worlds, use the network effect of Docker images but have them as a VM instead.

What I want to know is how I read all these posts about starting VMs in … could be I'm stuck in Azure, but I feel like I get comparable times in GCP, too.

You should be able to provision, customize and boot a full VM in 60 seconds or so. Maybe 2-3 minutes if it involves copying in a lot of data and SELinux relabelling. If it's taking too much longer than that it's something wrong with the cloud or environment you're using.

Re: Ignite – Use Firecracker VMs with Docker images

#43

Post by matharmin »

zozbot234 wrote: post #40

Running Docker in a VM is not new at all. This is even how Docker for Windows/Mac works. The GitHub page states that Ignite does more than just "wrapping a container in a VM layer" but I'm not sure how that matters, since the notion of a "container" is purely about configuration. It seems like a distinction without a difference.

Docker for Windows/Mac uses a single VM for all your containers. Firecracker/Ignite has a dedicated micro-VM for each container - a completely different architecture, with much better isolation between containers. And the 125ms boot time is not something you get with a typical VM.

But I do agree that they don't explain how Ignite is different from "wrapping a container in a VM layer" that Kata/gVisor does.

Re: Ignite – Use Firecracker VMs with Docker images

#44

Post by ritchiey »

zozbot234 wrote: post #40

Running Docker in a VM is not new at all. This is even how Docker for Windows/Mac works. The GitHub page states that Ignite does more than just "wrapping a container in a VM layer" but I'm not sure how that matters, since the notion of a "container" is purely about configuration. It seems like a distinction without a difference.

Ignite is running a VM per container. Docker for Windows/Mac runs all containers in a single VM.

Re: Ignite – Use Firecracker VMs with Docker images

#45

Post by withinboredom »

sneak wrote: post #39
claytongulick wrote: post #29

Earlier quoted context omitted.

> microVMs for running containers are definitely a great idea I think my greybeard must be getting too long... This sounds like insanity to me. Why not just make a base image and some simple setup scripts? If you need to get super fancy, these guys have it figured out [1]. They can clone a running vm in under two seconds. [1] https://codesandbox.io/post/how-we-clone-a-running-vm-in-2-s...

General advice: when smart people are investing time and energy into a solution, and your alternative solution involves the word "just", it's usually a code smell that you're not giving the people doing the work enough credit.

So, wait. You’re saying the people who developed that squeeze juice thing or the drop of blood thing shouldn’t be criticized because it is obviously a stupid idea from the get-go? C’mon man, some of us have critical thinking skills and some of us will tell you when an idea is stupid or over-engineered.

Containers as VMs is usually peak over-engineering. It’s unnecessary most of the time. In fact, there’s only a few use-cases where it’s desired to have that isolation:

- different clock rates in the container than outside (deliberate skew)

- high security applications

- require certain kernel modules that you don’t want installed in all containers

Isolation can already be guaranteed by the kernel (excepting some bugs), so I don’t think that is a valid use-case, but I could be wrong.

Re: Ignite – Use Firecracker VMs with Docker images

#46

Post by withinboredom »

tptacek wrote: post #32
bogomipz wrote: post #31

Earlier quoted context omitted.

>"All serverside cloud-style VMs get tap devices." I'm having trouble understanding this sentence. Specifically "serverside cloud-style VMs." Does "serverside" mean from the host OS that's running the Hypervisor? Like if I were logged into that host an "ifconfig" would show me tap devices?

Yes, it does.

No, it doesn’t.

Re: Ignite – Use Firecracker VMs with Docker images

#47

Post by jeroenhd »

deathanatos wrote: post #21
cercatrova wrote: post #2

Related, My VM is Lighter (and Safer) than your Container (2017) : https://news.ycombinator.com/item?id=32764501 Looks like Ignite could be the best of both worlds, use the network effect of Docker images but have them as a VM instead.

What I want to know is how I read all these posts about starting VMs in … could be I'm stuck in Azure, but I feel like I get comparable times in GCP, too.

The Big Cloud Providers (Amazon, Microsoft, Google) are all terribly slow. This is probably because of the (administrative) overhead of provisioning a VM to a customer, setting up billing, any private networking you may need, redundant storage in three timezones, and probably tons of scripts and hooks I don't even know about.

In contrast, Firecracker restores a VM state to do session resumption. The OS has practically already been booted the moment execution for your specific VM begins.

That said, creating a brand new VM takes less than a second on my machine and then maybe 30 seconds for a full first boot, surely the super smart people at these huge cloud companies can figure out a way to get up and running in less than a minute. The ability to spawn quick disposable VMs is one of the reasons I stick to local VMs for dev work rather than some expensive cloud solution.

Re: Ignite – Use Firecracker VMs with Docker images

#48

Post by mhuffman »

sneak wrote: post #39
claytongulick wrote: post #29

Earlier quoted context omitted.

> microVMs for running containers are definitely a great idea I think my greybeard must be getting too long... This sounds like insanity to me. Why not just make a base image and some simple setup scripts? If you need to get super fancy, these guys have it figured out [1]. They can clone a running vm in under two seconds. [1] https://codesandbox.io/post/how-we-clone-a-running-vm-in-2-s...

General advice: when smart people are investing time and energy into a solution, and your alternative solution involves the word "just", it's usually a code smell that you're not giving the people doing the work enough credit.

OTOH, smart people seem to constantly try to reinvent existing products or over-engineer tools to set themselves apart and create a new business. See the endless stream of new JS frameworks popping up every day. Or the myriad ways that people try to create clouds on top of clouds (Yo dawg! I heard you like clouds!). Or new databases (although I confess I follow these). Or reinventing static HTML page delivery. ... and it goes on and on. All of these are smart people investing time and energy into a "solution" ... where there may not actually be a problem to begin with.

Re: Ignite – Use Firecracker VMs with Docker images

#49

Post by easton »

russell_h wrote: post #22
deathanatos wrote: post #21

Earlier quoted context omitted.

What I want to know is how I read all these posts about starting VMs in … could be I'm stuck in Azure, but I feel like I get comparable times in GCP, too.

Wow, what OS are you booting? I used to run a “bare metal servers as a service” product, and we could provision most images to a bare metal server in under 5 minutes. If I had a VM take more than 60 seconds to come up today I’d suspect something was wrong.

15 minutes is on the high end, but 5-10 minutes is typical for Windows. You can’t deploy a ready image, usually, you have to deploy one that is sysprepped so Windows can do device discovery on first boot.

You can deploy them with the devices already set up, but sometimes (literally sometimes, it’s hard to tell when it happens) Windows gets really upset if any of the hardware changes. I think Windows 10/11 (and Server equivalents) has made that easier though (MS still recommends sysprep).

Re: Ignite – Use Firecracker VMs with Docker images

#50

Post by mbreese »

withinboredom wrote: post #45
sneak wrote: post #39

Earlier quoted context omitted.

General advice: when smart people are investing time and energy into a solution, and your alternative solution involves the word "just", it's usually a code smell that you're not giving the people doing the work enough credit.

So, wait. You’re saying the people who developed that squeeze juice thing or the drop of blood thing shouldn’t be criticized because it is obviously a stupid idea from the get-go? C’mon man, some of us have critical thinking skills and some of us will tell you when an idea is stupid or over-engineered. Containers as VMs is usually peak over-engineering. It’s unnecessary most of the time. In fact, there’s only a few u…

Multi-tenant systems are also a use-case (and a pretty major one).
Post reply on HN