Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebAssembly: Docker Without Containers

wasmlabs.dev

Post reply on HN
Print view View original

241–250 of 313 posts

Re: WebAssembly: Docker Without Containers

#241

Post by pxc »

pxc wrote: post #168
nine_k wrote: post #102

Earlier quoted context omitted.

Oh shucks. Docker's value proposition is emphatically not security. If you want really good insulation, run a proper VM. Docker's value proposition is convenient. reproducible, self-contained packaging of software. It's the ability to deploy pieces of existing, battle-tested, gnarly and imperfect software next to each other, and care not about their conflicting or missing dependencies . It's more like Flatpak or AppI…

> Docker's value proposition is convenient, reproducible, self-contained packaging of software. Docker doesn't solve any packaging problems, though. It just piggybacks off of other package management solutions and allows ad-hoc, unmanaged modifications to OS images (the convenience) and contains that result for easy distribution. But nothing in that process ensures reproducibility— the package managers wrapped in Doc…

Downvotes without replies is always disappointing.

I would be curious to hear what is wrong in my comment above from anyone who has actually worked on general purpose packaging (e.g., written a package to be included in or overlaid onto a ports tree, maintained RPMs built from RPM spec files, run their own Ubuntu PPA, etc.), implemented tools that scan containers (e.g., SCA scanning or SBOM generation tools), or done reproducibility research.

Would someone with an awareness of full-fledged package management solutions based on or built with containers (e.g., Luet, Distri, Flatpak) really argue that having fine-grained abstractions for reasoning about dependencies or shared runtimes, performing security updates, etc., makes no difference as to what kind of software we're talking about and what problems it solves?

To me it seems obvious that

  - not all software distribution mechanisms are package management solutions
  - Docker cannot see or reckon with individual packages
  - the Docker ecosystem relies on rather than replaces package managers, build systems, etc.
and so on. Are there serious arguments to be had here about those things, or do people just feel like my earlier comment was somehow unkind to Docker?

Re: WebAssembly: Docker Without Containers

#242

Post by jmholla »

ridruejo wrote: post #51
pharmakom wrote: post #49

Docker is useful because I can throw any old POSIX library into a container and it will work in the cloud. How does WASM help here?

It is a bit more involved (getting easier by the day) but you can do the same AND run it anywhere from a browser to an IoT device to ... a container :)

Do you have a link to a guide or any sources on the on-going work? I'm with many of the commenters here agreeing that WebAssembly does not sufficiently replace Docker containers and would love to see what's happening on this front.

Re: WebAssembly: Docker Without Containers

#243

Post by lc5G »

_0w8t wrote: post #52

Despite the sandboxing one still cannot run untrsuted WASM code in the same process as trusted code due to hardware bugs. CPU vendors are not going to fix those anytime soon. Their message is to always use separated address space for security isolation. And since one need an external process in any case, native containers wins as they are faster by factor of two over WASM. EDIT: It does not even make sense to use WAS…

Could you give some examples of hardware bugs that CPU vendors are not going to fix and would break this security model?

Re: WebAssembly: Docker Without Containers

#244

Post by alzaeem »

the_gipsy wrote: post #228
alzaeem wrote: post #226

How is it possible that the image size is so much smaller with the WASM image compared to the Docker image? They need to ship the entire php runtime compiled to WASM, so I don’t see how it can be smaller

What do you think is in the docker image?

They showed the WASM image is 5mb vs 30mb for the alpine Docker image. So that’s 25mb of overhead due to the alpine distro?

Re: WebAssembly: Docker Without Containers

#245

Post by jbverschoor »

So what's the purpose of Docker according to Docker?

Reproducible builds, consistent dev environments? I always thought it was to have production and development environments the same, but these statements contradict that..

Unless they expect you to run WASM on your servers..

Re: WebAssembly: Docker Without Containers

#246

Post by tinyspacewizard »

This totally missed the point. I use Docker where the compilation story (and cross-compilation story) is a mess (looking at you, Python) and I don't have the resources to figure it all out. With Docker, I can get a portable image working in a few hours. It's a hack, but it's a convenient one. WASM does not offer this.

Re: WebAssembly: Docker Without Containers

#247

Post by b33j0r »

tinyspacewizard wrote: post #246

This totally missed the point. I use Docker where the compilation story (and cross-compilation story) is a mess (looking at you, Python) and I don't have the resources to figure it all out. With Docker, I can get a portable image working in a few hours. It's a hack, but it's a convenient one. WASM does not offer this.

It’s people who see the potential of this emergent technology getting prematurely excited.

It promises to neutralize the playing field like Java promised, and Docker.

I’ve seen WASM do some cool shit, don’t count it out. Just factor in the irrational exuberance.

Re: WebAssembly: Docker Without Containers

#248

Post by _0w8t »

bastawhiz wrote: post #170
_0w8t wrote: post #52

Despite the sandboxing one still cannot run untrsuted WASM code in the same process as trusted code due to hardware bugs. CPU vendors are not going to fix those anytime soon. Their message is to always use separated address space for security isolation. And since one need an external process in any case, native containers wins as they are faster by factor of two over WASM. EDIT: It does not even make sense to use WAS…

> native containers wins If your threat model includes hardware bugs, then a container doesn't really help, no? You can't really trust your containers without sandboxing them, and then you're killing your performance anyway.

Heavily sandboxed container has overhead of few percents. A hardware VM slows things down by 10-20% for a typical application. So even combining VM with a container will still be significantly faster than WASM.

Re: WebAssembly: Docker Without Containers

#249

Post by the_gipsy »

alzaeem wrote: post #244
the_gipsy wrote: post #228

Earlier quoted context omitted.

What do you think is in the docker image?

They showed the WASM image is 5mb vs 30mb for the alpine Docker image. So that’s 25mb of overhead due to the alpine distro?

That could be the main factor.

Re: WebAssembly: Docker Without Containers

#250

Post by vlunkr »

jbverschoor wrote: post #245

So what's the purpose of Docker according to Docker? Reproducible builds, consistent dev environments? I always thought it was to have production and development environments the same, but these statements contradict that.. Unless they expect you to run WASM on your servers..

> Unless they expect you to run WASM on your servers

They do, this is an emerging idea.

> I always thought it was to have production and development environments the same

This seems to be the first thing many people try to do with Docker. IMO it's actually not a great experience. In dev, you need to make changes, in prod, you shouldn't, so they're not the same at all.

Docker has many strengths: reproducible builds, consistent deployment strategies(k8s doesn't care what's in your container), a consistent DSL for building apps, The ability to extend a huge collection of other Dockerfiles to get what you want. I'm sure there are more.

Post reply on HN