Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My VM is lighter (and safer) than your container (2017)

dl.acm.org

Post reply on HN
Print view View original

111–120 of 184 posts

Re: My VM is lighter (and safer) than your container (2017)

#111

Post by flanked-evergl »

andix wrote: post #9

I think containers are often misunderstood: The main benefit is not isolation and security, it's defined and reproducible environments and builds. If there is some additional isolation required, just run the container in a VM.

Here are some projects that run docker containers on top of micro/lightweight VMs:

- https://github.com/firecracker-microvm/firecracker-container...

- https://github.com/kuasar-io/kuasar

- https://github.com/kata-containers/kata-containers

- https://github.com/QuarkContainer/Quark

- https://github.com/google/gvisor

- https://github.com/containers/libkrun

Re: My VM is lighter (and safer) than your container (2017)

#112

Post by uticus »

OS: I provide isolation where needed, handle safely interacting with outside world, and abstract away all the pesky stuff so programmers can just get stuff done.

Container / VM: I provide isolation where needed, handle safely interacting with outside world, and abstract away all the pesky stuff so programmers can just get stuff done.

I get that a dev machine (OS) isn't usually suitable for deployment or shared development (Container/VM). But seems to me the promise of the Operating System has fallen short, if we are striving to meet so many of the same goals of the OS, with something on the OS that tries to abstract away the OS.

Re: My VM is lighter (and safer) than your container (2017)

#113

Post by FridgeSeal »

fhuici wrote: post #96
zerof1l wrote: post #80

Docker has a big community, lots of guides, and ready-to-use containers. It became pretty much a de facto standard for self-hosting things. You also have a very high chance of getting a piece of software to work out of the box as intended with Doker. The only way this or some other way of running stuff will overtake Doker is if it will match the Docker in these aspects. As much as I'd love to try this lightweight VM…

Maybe try out kraft.cloud: we take Dockerfiles as input and automatically convert to lightweight VMs/unikernels when deploying (disclaimer: I'm one of the paper's authors and one of the people behind KraftCloud).

Wow!

I came across Unikraft a while ago and went “wow that’s cool, but I have no idea how to use this”, cloud offering and docs you have up there now look amazing! Will 100% be giving this a go first thing tomorrow!!

Re: My VM is lighter (and safer) than your container (2017)

#114

Post by andix »

brabel wrote: post #13
andix wrote: post #9

I think containers are often misunderstood: The main benefit is not isolation and security, it's defined and reproducible environments and builds. If there is some additional isolation required, just run the container in a VM.

But if you can get isolation, security AND reproducible environments using a VM, specially one that's nearly as fast as a OS process, the case for using containers instead pretty much disappears. I don't know this LiteVM thing but I will definitely investigate that, specially given that on my Mac I need to use a VM anyway to run containers!

Where is the tooling to build and distribute lightweight vms like containers? How can I copy one html file into an nginx VM, built this vm image with multiple architectures (I have arm and x64 servers), publish it, pull it, and run it multiple times?

Once again: Containers are not about isolation or security, they are a package format for shipping applications. The packages are easy to build, distribute, multiarch, ...

And requiring a Linux-VM on macOS to run Linux containers, is not particularly surprising.

Re: My VM is lighter (and safer) than your container (2017)

#115

Post by BobbyTables2 »

Aardwolf wrote: post #42
jsheard wrote: post #4

From 2017, before rootless containers caught on I think. The conclusions on safety might be due for re-evaluating.

Why weren't containers rootless from the start anyway? What did they need that user space doesn't provide? Wine, emulators and VMs didn't require it either (with the exception of some VMs needing a kernel module for performance reasons like memory management, which I also find stupid, the OS should provide all the performance in user space).

You mean for the container launcher to not require root?

Root isn’t required — look at Podman.

Docker spent so much on marketing, the world is too blind to pivot to a superior alternative!

Re: My VM is lighter (and safer) than your container (2017)

#116

Post by internetter »

fhuici wrote: post #53
brabel wrote: post #13

Earlier quoted context omitted.

But if you can get isolation, security AND reproducible environments using a VM, specially one that's nearly as fast as a OS process, the case for using containers instead pretty much disappears. I don't know this LiteVM thing but I will definitely investigate that, specially given that on my Mac I need to use a VM anyway to run containers!

Check out kraft.cloud and the accompanying LF OSS project www.unikraft.org :) (disclaimer: I'm one of the authors of the paper and one of the people behind that cloud offering). On KraftCloud we use Dockerfiles so users can conveniently specify the app/filesystem, and then at deploy time transparently convert that to a unikernel (specialized VMs). With this in place, NGINX cold starts in 20 millis, and even heavier a…

Is the entire kraft stack open source? Can I run this on my own hardware?

Re: My VM is lighter (and safer) than your container (2017)

#117

Post by andix »

scarby2 wrote: post #109
cduzz wrote: post #97

Earlier quoted context omitted.

I tell people "An OCI container is a way to turn any random runtime into a statically linked binary." It is very useful for managing dependency hell, or at least moving it into "API dependencies" not "Library dependencies", it is handy for pickling a CI/CD release engineering infrastructure. It's not a security boundary. (I'm 100% agreeing with parent, in case I sound contentious)

> It's not a security boundary. It is a security boundary, just not necessarily the best one.

I would even claim it's a pretty good security boundary, good enough for most applications.

Re: My VM is lighter (and safer) than your container (2017)

#118

Post by fhuici »

kevincox wrote: post #38
nailer wrote: post #31

Earlier quoted context omitted.

> If there is some additional isolation required, just run the container in a VM. No. Running a container in a VM gets you no additional isolation. Containers share kernel space and as such have limited isolation to VMs, which have isolated kennels. In exchange for this Lack of additional isolation, you’ve added a Bunch of extra Complexity. Pardon the extra caps I am using iOS voice dictation.

I think they mean run a VM with one container inside. So you do get strong isolation. This is similar to how managed container IaaS works. They launch a VM and run your container in it. It is extra complexity but has a few advantages. 1. People already have a convenient workflow for building container images. 2. The base OS can manage hardware, networking and whatever other low-level needs so that the container doesn…

The model of a single container within a VM just adds overhead. The ideal case would be to remove the container layer and have the application(s) within the container run directly in the VM (which hopefully only includes the libs and OS modules needed for the app to run, and nothing more).

This is the approach we take at kraft.cloud (based on the LF Unikraft project): use Dockerfiles to specify app/filesystem, and at deploy automatically convert to a lightweight VM (unikernel) without the container runtime/layer.

Post reply on HN