Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My VM is lighter (and safer) than your container (2017)

dl.acm.org

Post reply on HN
Print view View original

81–90 of 184 posts

Re: My VM is lighter (and safer) than your container (2017)

#81

Post by jchw »

nimbius wrote: post #70
andix wrote: post #9

I think containers are often misunderstood: The main benefit is not isolation and security, it's defined and reproducible environments and builds. If there is some additional isolation required, just run the container in a VM.

we arguably already had this with things like python venv. the articles main point still remains, containers are a slow and bloated answer to this problem. I concede youll need containers for Kubernetes, and Kubernetes on the surface is a very good idea, but this level of infrastructure automation exists already in things like foreman and openstack. designs like shift-on-stack trade simplicity of traditional hardware…

Python venv is language specific, doesn't handle the interpreter version and doesn't handle C libraries.

I really don't understand why people do this: I get having a distaste for containers but some people, seeing the massive success of OCI images, mainly seem content on trying to figure out how to discredit its popularity, rather than trying to understand why it's popular. The former may be good for contrarian Internet forums, but the latter is more practically useful and interesting.

I say this with some level of understanding as I also have a distaste for containers and Docker is not my preferred way to do "hermetic" or "reproducible" (I am a huge Nix proponent.) I want to get past the "actually it was clearly useless from the start" because it wasn't...

Re: My VM is lighter (and safer) than your container (2017)

#82

Post by jbverschoor »

nimbius wrote: post #70
andix wrote: post #9

I think containers are often misunderstood: The main benefit is not isolation and security, it's defined and reproducible environments and builds. If there is some additional isolation required, just run the container in a VM.

we arguably already had this with things like python venv. the articles main point still remains, containers are a slow and bloated answer to this problem. I concede youll need containers for Kubernetes, and Kubernetes on the surface is a very good idea, but this level of infrastructure automation exists already in things like foreman and openstack. designs like shift-on-stack trade simplicity of traditional hardware…

Not really, you'd still need a proper chroot / etc.

Check out https://github.com/jrz/container-shell

Re: My VM is lighter (and safer) than your container (2017)

#83

Post by jbverschoor »

Cthulhu_ wrote: post #19
dweekly wrote: post #15

Earlier quoted context omitted.

If this were true, then wouldn't folks just need an application binary that statically links all of its required libraries and resources into a giant, say, ELF? Why even bother with a container?

That's exactly the summary of this. That said, it makes sense from a developer POV; if, during development, you don't need the isolation you can run multiple containers (with on paper fast boot times and minimal overhead) on your development box. There's plenty of cases to imagine where you need the containerization but not necessarily the isolation.

That what I do. I use https://github.com/jrz/container-shell so my projects are contained, and I'm a little bit protected against supply chain attacks

Re: My VM is lighter (and safer) than your container (2017)

#84

Post by [deleted] »

Aardwolf wrote: post #42
jsheard wrote: post #4

From 2017, before rootless containers caught on I think. The conclusions on safety might be due for re-evaluating.

Why weren't containers rootless from the start anyway? What did they need that user space doesn't provide? Wine, emulators and VMs didn't require it either (with the exception of some VMs needing a kernel module for performance reasons like memory management, which I also find stupid, the OS should provide all the performance in user space).

[deleted]

Re: My VM is lighter (and safer) than your container (2017)

#85

Post by cesarb »

bluGill wrote: post #60
andix wrote: post #9

I think containers are often misunderstood: The main benefit is not isolation and security, it's defined and reproducible environments and builds. If there is some additional isolation required, just run the container in a VM.

There is no such thing as a reproducible build environment anymore. You can get a temporary reproducible build environment, but any sane security policy will have certificates that expire and that in turn means that in a couple years your build environment won't be reproducible anymore.

> but any sane security policy will have certificates that expire and that in turn means that in a couple years your build environment won't be reproducible anymore.

"Reproducible" is usually defined as "identical output except for the cryptographic signature at the end" (and that should be the only use for a certificate in your build environment, a high-quality build environment should be self-contained and have no network access). That is, once you remove the signature, the built artifacts should be bit-by-bit identical.

Re: My VM is lighter (and safer) than your container (2017)

#86

Post by k8sToGo »

zerof1l wrote: post #80

Docker has a big community, lots of guides, and ready-to-use containers. It became pretty much a de facto standard for self-hosting things. You also have a very high chance of getting a piece of software to work out of the box as intended with Doker. The only way this or some other way of running stuff will overtake Doker is if it will match the Docker in these aspects. As much as I'd love to try this lightweight VM…

Especially with something like linuxserver.io

Re: My VM is lighter (and safer) than your container (2017)

#87

Post by brap »

codedokode wrote: post #30
Cthulhu_ wrote: post #20

Earlier quoted context omitted.

Isolated, but are they isolated enough? The article states that containers offer weaker isolation than VMs. (it doesn't quantify it though and I don't know this kind of thing offhand)

Processes run in a userspace and cannot do anything without OS approval.

Everything you said is correct, in theory. In practice, however...

Re: My VM is lighter (and safer) than your container (2017)

#89

Post by jeltz »

zerof1l wrote: post #80

Docker has a big community, lots of guides, and ready-to-use containers. It became pretty much a de facto standard for self-hosting things. You also have a very high chance of getting a piece of software to work out of the box as intended with Doker. The only way this or some other way of running stuff will overtake Doker is if it will match the Docker in these aspects. As much as I'd love to try this lightweight VM…

The ready-to-use is only true for the most popular software like PostgreSQL. Anything else is often broken and/or unmaintained.

Re: My VM is lighter (and safer) than your container (2017)

#90

Post by jve »

zerof1l wrote: post #80

Docker has a big community, lots of guides, and ready-to-use containers. It became pretty much a de facto standard for self-hosting things. You also have a very high chance of getting a piece of software to work out of the box as intended with Doker. The only way this or some other way of running stuff will overtake Doker is if it will match the Docker in these aspects. As much as I'd love to try this lightweight VM…

Ahem, this is a research paper. You should look at this stuff as "Innovation" and someone may just consider building a tool or product on the idea... or not.
Post reply on HN