Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebAssembly: Docker Without Containers

wasmlabs.dev

Post reply on HN
Print view View original

291–300 of 313 posts

Re: WebAssembly: Docker Without Containers

#291

Post by kaba0 »

dralley wrote: post #279
solomatov wrote: post #180

Earlier quoted context omitted.

@nine_k shared this https://programming-language-benchmarks.vercel.app/wasm-vs-r... in the comment tree. The results are pretty bad. You could lose 2x or more in cpu perf. There're cases where wasm is pretty close to native though.

I wouldn't call 50% loss "pretty bad". I mean sure, it's not great, but if you were to go from Rust to C# or Java you would most likely see a similar loss.

That would depend on the type of code you write. Heavily allocating code can be very fast in case of the JVM, and you can’t always avoid dynamic allocations/arenas are not always a solution.

Re: WebAssembly: Docker Without Containers

#292

Post by pjmlp »

orf wrote: post #214
pjmlp wrote: post #213

Earlier quoted context omitted.

Well, I learned about the InteliJ plugin, I guess. Which I don't use hence why I wasn't aware of it.

Yes, your lack of knowledge was never in question. > The Dunning–Kruger effect is a cognitive bias whereby people with low ability, expertise, or experience regarding a certain type of task or area of knowledge tend to overestimate their ability or knowledge https://en.m.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effec...

Lovely Internet discussions.

Re: WebAssembly: Docker Without Containers

#293

Post by kaba0 »

nine_k wrote: post #65
tony-allan wrote: post #2

If WASM+WASI existed in 2008, we wouldn't have needed to create Docker. That's how important it is. WebAssembly on the server is the future of computing. - Solomon Hykes (co-founder of Docker) https://twitter.com/solomonstre/status/1111004913222324225

This sounds incredible, as if the co-founder of Docker fails to understand the crucial value proposition of Docker (hence Docker's financial troubles, maybe). The point of Docker is the ability to take the existing Rube-Goldberg-machine configurations of software, in any and many languages (including the gluing bash scripts), and put it basically unchanged into a controlled, isolated, replicated, shippable environmen…

> The point of Docker is the ability to take the existing Rube-Goldberg-machine configurations of software, in any and many languages

Well, Docker is not good at this, your Dockerimage can be as non-reproducible as it gets, it just pushes the problem to a different level. Nix and other package managers are the actual solution to this issue.

Re: WebAssembly: Docker Without Containers

#294

Post by pjmlp »

acdha wrote: post #278
pjmlp wrote: post #165

Earlier quoted context omitted.

Ah the typical only others are bad coders.

“Bad” is a value judgement. I’d go more with “taking on problems we don’t have” - J2EE made more sense if you were in a business like Atlassian’s where you sell an app to customers who wants to be able to run in it a bunch of different ways and configure many things without access to the source code. That especially made sense in the older era where apps were managed by sysadmins who didn’t have compilers and wouldn’…

How is that any different from having Kubernetes experts keeping a cluster alive?

Re: WebAssembly: Docker Without Containers

#295

Post by kaba0 »

rapidlua wrote: post #259
vermaden wrote: post #232

Earlier quoted context omitted.

Docker only uses namespaces and cgoups. Docker does not provide and security or isolation. To have security and isolation with Docker you must use something external like SELinux or AppArmor. Hope that helps. Regards.

> Docker only uses namespaces and cgroups. How is that not isolation?

The docker daemon has basically root over your system, so any escape can end very badly.

Re: WebAssembly: Docker Without Containers

#296

Post by kaba0 »

orf wrote: post #8
pjmlp wrote: post #5

Earlier quoted context omitted.

Well, those that act like WebAssembly is reinvinting the world kind of do. And applications get tied to the WebAssembly ecosystem, it is also a single one.

While it’s true that it somewhat locks you into a single VM type (WASM), that’s very different from being locked into the JVM. For one, the idea is that it should be fairly simple to compile an arbitrary program to WASM, allowing you to use a far wider variety of languages. In this case, it’s more akin to “docker with extra steps” as opposed to “docker but you can only hire Java devs”

Making a big byte array and using some very basic jvm instructions will give you a very low-level compilation target for basically any language.

Re: WebAssembly: Docker Without Containers

#297

Post by _0w8t »

lc5G wrote: post #243
_0w8t wrote: post #52

Despite the sandboxing one still cannot run untrsuted WASM code in the same process as trusted code due to hardware bugs. CPU vendors are not going to fix those anytime soon. Their message is to always use separated address space for security isolation. And since one need an external process in any case, native containers wins as they are faster by factor of two over WASM. EDIT: It does not even make sense to use WAS…

Could you give some examples of hardware bugs that CPU vendors are not going to fix and would break this security model?

Spectre is not going to be fixed for code within the same address space and allows to read all process memory from untrusted code. Google in V8 tried to protect against that, but they mostly gave up as there were way too many ways to affect the cache.

Re: WebAssembly: Docker Without Containers

#298

Post by ridruejo »

blacklion wrote: post #207
et1337 wrote: post #121

Earlier quoted context omitted.

The biggest missing thing in my mind is threading support. Great performance isn’t very useful if it only runs on one core.

The biggest missing thing (for production) is observability. Look at old-good JVM. It has tons of tools to analyze and understand behavior of your production system. You could have thread dumps (stack traces of all existing threads) at any moment with negligible performance impact, you could dump heap and analyze it off-site, you could have tons of metrics, about each dark corner of mutexes, GC process, about JIT, in…

Completely agree. Observability and debugging are some areas where the ecosystem is quite immature or inexistent. My take is that wasm is more or less where the web was in 97-98 Lots of excitement and possibilities but also lots of technical challenges and experimentation

Re: WebAssembly: Docker Without Containers

#299

Post by tinyspacewizard »

agent281 wrote: post #253
tinyspacewizard wrote: post #246

This totally missed the point. I use Docker where the compilation story (and cross-compilation story) is a mess (looking at you, Python) and I don't have the resources to figure it all out. With Docker, I can get a portable image working in a few hours. It's a hack, but it's a convenient one. WASM does not offer this.

This seems backwards to me. Docker is built on Linux process controls and requires the Linux kernel. I believe Docker on MacOS/Windows requires a Linux VM. > Unfortunately, one of the challenges of running Docker on macOS or Windows is that these Linux primitives are unavailable. Docker Desktop goes to great lengths to emulate them without modifying the user experience of running containers. It runs a (light) Linux V…

> you could compile to an architecture and syscall interface that is platform agnostic

The issue is that I cannot easily compile.

Re: WebAssembly: Docker Without Containers

#300

Post by acdha »

pjmlp wrote: post #294
acdha wrote: post #278

Earlier quoted context omitted.

“Bad” is a value judgement. I’d go more with “taking on problems we don’t have” - J2EE made more sense if you were in a business like Atlassian’s where you sell an app to customers who wants to be able to run in it a bunch of different ways and configure many things without access to the source code. That especially made sense in the older era where apps were managed by sysadmins who didn’t have compilers and wouldn’…

How is that any different from having Kubernetes experts keeping a cluster alive?

Part of that is scope (Kubernetes does so much more) but most of it is the benefits of decades of experience and having a clean design. Java application servers were designed by and for Java applications so they blur a lot of lines whereas a Java (or Python or Node, etc.) developer can use Kubernetes without learning any Go tools.
Post reply on HN