Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My VM is lighter (and safer) than your container (2017)

dl.acm.org

Post reply on HN
Print view View original

11–20 of 184 posts

Re: My VM is lighter (and safer) than your container (2017)

#11

Post by iamstan23 »

d3m0t3p wrote: post #7
_joel wrote: post #6

Earlier quoted context omitted.

What, like https://firecracker-microvm.github.io/ ?

I think it's from the AWS team, they made firecracker (micro VM) So it does exist. Funnily that's what fly does: take your container uncompress it to a full micro VM and run it on their infra

fly.io uses Firecracker. Firecracker is Open Sourced with an Apache 2 license. It's faster than LightVM mentioned in the post.

Firecracker also has containerd support (https://github.com/firecracker-microvm/firecracker-container...).

There are a few ways to run Kubernetes with Firecracker, including FireKube.

Re: My VM is lighter (and safer) than your container (2017)

#13

Post by brabel »

andix wrote: post #9

I think containers are often misunderstood: The main benefit is not isolation and security, it's defined and reproducible environments and builds. If there is some additional isolation required, just run the container in a VM.

But if you can get isolation, security AND reproducible environments using a VM, specially one that's nearly as fast as a OS process, the case for using containers instead pretty much disappears. I don't know this LiteVM thing but I will definitely investigate that, specially given that on my Mac I need to use a VM anyway to run containers!

Re: My VM is lighter (and safer) than your container (2017)

#15

Post by dweekly »

andix wrote: post #9

I think containers are often misunderstood: The main benefit is not isolation and security, it's defined and reproducible environments and builds. If there is some additional isolation required, just run the container in a VM.

If this were true, then wouldn't folks just need an application binary that statically links all of its required libraries and resources into a giant, say, ELF? Why even bother with a container?

Re: My VM is lighter (and safer) than your container (2017)

#18

Post by shawabawa3 »

dweekly wrote: post #15
andix wrote: post #9

I think containers are often misunderstood: The main benefit is not isolation and security, it's defined and reproducible environments and builds. If there is some additional isolation required, just run the container in a VM.

If this were true, then wouldn't folks just need an application binary that statically links all of its required libraries and resources into a giant, say, ELF? Why even bother with a container?

people would absolutely love to do that, but it's difficult, and the UX sucks

so people use containers instead (even if the container literally only contains a single statically linked binary)

Re: My VM is lighter (and safer) than your container (2017)

#19

Post by Cthulhu_ »

dweekly wrote: post #15
andix wrote: post #9

I think containers are often misunderstood: The main benefit is not isolation and security, it's defined and reproducible environments and builds. If there is some additional isolation required, just run the container in a VM.

If this were true, then wouldn't folks just need an application binary that statically links all of its required libraries and resources into a giant, say, ELF? Why even bother with a container?

That's exactly the summary of this.

That said, it makes sense from a developer POV; if, during development, you don't need the isolation you can run multiple containers (with on paper fast boot times and minimal overhead) on your development box.

There's plenty of cases to imagine where you need the containerization but not necessarily the isolation.

Re: My VM is lighter (and safer) than your container (2017)

#20

Post by Cthulhu_ »

codedokode wrote: post #16

"VM" means it has its own kernel? Why have 2 kernels on the same machine? All processes in a proper OS are already isolated and there is no need for VM.

Isolated, but are they isolated enough? The article states that containers offer weaker isolation than VMs. (it doesn't quantify it though and I don't know this kind of thing offhand)
Post reply on HN