Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Building a Linux Container Runtime from Scratch

edera.dev

Post reply on HN
Print view View original

21–30 of 70 posts

Re: Building a Linux Container Runtime from Scratch

#21

Post by kubafu »

Brian_K_White wrote: post #12
pss314 wrote: post #5

I loved this hands-on presentation Containers From Scratch by Liz Rice from few years ago https://www.youtube.com/watch?v=8fi7uSYlOdc . Today, Linux containers in (less than) 100 lines of shell by Michael Kerrisk was published https://www.youtube.com/watch?v=4RUiVAlJE2w .

On my birthday while attending Arisia January 2010 I wrote a single rc script with about 30 non-boilerplate lines of bash (the 3 functions) that does: * start all enabled containers on boot * stop all running containers at shutdown (ie gracefully wait for them all to shut themselves down before letting the host proceed to shut itself down) * start/stop/status any specified container on command * list all containers (…

> I think I just always want to stop at the 90/10 place where you get 90% of the functionality with 10% of the code, and the remaining 10% of the functionality requires 10x the initial code.

And that should be the right approach 90% of the time. Thanks for your comment!

Re: Building a Linux Container Runtime from Scratch

#23

Post by Brian_K_White »

pss314 wrote: post #5

I loved this hands-on presentation Containers From Scratch by Liz Rice from few years ago https://www.youtube.com/watch?v=8fi7uSYlOdc . Today, Linux containers in (less than) 100 lines of shell by Michael Kerrisk was published https://www.youtube.com/watch?v=4RUiVAlJE2w .

That bash/busybox demo is awesome. The code is at: https://man7.org/tlpi/code/ (/tlpi-dist/consh/ in the tar)

I still used lxc-utils in my rc script which now seems like positively cheating and may as well use docker.

Re: Building a Linux Container Runtime from Scratch

#24

Post by klysm »

Joker_vD wrote: post #19

> Importantly, we designed Styrolite with full awareness that Linux namespaces were never intended as hard security boundaries—a fact that explains why container escape vulnerabilities continue to emerge. Our approach acknowledges these limitations while providing a more robust foundation. So what do you do, exactly?

Say “it’s probably fine” and hope that the people building the foundational systems are protecting us

Re: Building a Linux Container Runtime from Scratch

#25

Post by Joker_vD »

klysm wrote: post #24
Joker_vD wrote: post #19

> Importantly, we designed Styrolite with full awareness that Linux namespaces were never intended as hard security boundaries—a fact that explains why container escape vulnerabilities continue to emerge. Our approach acknowledges these limitations while providing a more robust foundation. So what do you do, exactly?

Say “it’s probably fine” and hope that the people building the foundational systems are protecting us

No, I mean, what do the Edera developers do differently, in order to provide more robust foundation with this new container runtime called Styrolite? They still use Linux namespaces, as far as I can tell from TFA.

Re: Building a Linux Container Runtime from Scratch

#26

Post by z3t4 »

Joker_vD wrote: post #19

> Importantly, we designed Styrolite with full awareness that Linux namespaces were never intended as hard security boundaries—a fact that explains why container escape vulnerabilities continue to emerge. Our approach acknowledges these limitations while providing a more robust foundation. So what do you do, exactly?

Once you have set up the namespaces you drop all capabilities so if the program gets hacked while it's running it can do very little.

Re: Building a Linux Container Runtime from Scratch

#27

Post by shortrounddev2 »

pjmlp wrote: post #18
shortrounddev2 wrote: post #9

I've seen many examples of people creating containers for Linux; I wish it were comparably easier to create containers for Windows. The fundamental software exists on Windows (AppContainers are how UWP apps work) but the documentation around AppContainers is very sparse/opaque because Microsoft doesn't want you to use AppContainers to make a general purpose sandbox environment like Snap or Flatpak; they want you to w…

Windows containers exist, their are based on the jobs, and Microsof took the approach to use the same APIs docker world expects to have as means to integrate with the DevOps container world expectations. https://learn.microsoft.com/en-us/virtualization/windowscont... You missed GDI+, Direct2D API is a COM mess that we only put up with because DirectX, and DirectX team doesn't like .NET, thus nothing like XNA or Manag…

While windows containers exist, the documentation surrounding them at the API level is sparse. Anything from Azure just tells you to use docker.

As far as I can tell GDI+ is still software rendered? DirectX Com objects aren't difficult to work with at all, ive never understood why people hate them so much. The point of using direct2d would be to provide hardware rendering for winforms.

Wpf is OK compared to winui 3 but it still suffers from xaml.

Re: Building a Linux Container Runtime from Scratch

#29

Post by denhamparry »

Joker_vD wrote: post #25
klysm wrote: post #24

Earlier quoted context omitted.

Say “it’s probably fine” and hope that the people building the foundational systems are protecting us

No, I mean, what do the Edera developers do differently, in order to provide more robust foundation with this new container runtime called Styrolite? They still use Linux namespaces, as far as I can tell from TFA.

Edera developer here, we use Styrolite to run containers with Edera Protect. Edera Protect creates Zones to isolate processes from other Zones so that if someone were to break out of a container, they'd only see the zone processes. Not the host operating system or the hardware on the machine. The key difference here between us and other isolation implementations is that there is no performance degradation, you don't have to rebuild your container images, and that we don't require specific hardware (e.g. you can run Edera Protect on bare metal or on public cloud instances and everything else in-between).

Re: Building a Linux Container Runtime from Scratch

#30

Post by denhamparry »

cedws wrote: post #17

Isn’t the gold standard of containerisation gVisor? Can’t get much more restrictive than proxying and filtering syscalls. As far as I remember it’s the default runtime on GKE.

Edera developer here. gVisor is restrictive, but its at a cost of performance. Personally, I'd say Edera Protect is one level deeper. We create Edera Protect Zones to provide isolation, so we create a Zone that is isolated from the OS and hardware of the machine running the container. So we don't proxy or filter syscalls, as the isolation is a layer deeper. We are also focused on ensuring that Edera Protect is as performant (if not better) as running a container today with containerd.

Finally, if you wanted to, you could run gVisor within Edera Protect, but we feel that Edera Protect would already provide the security benefits that gVisor offer.

Post reply on HN