Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Interview with Eric Brewer

medium.com

Post reply on HN
Print view View original

111–120 of 142 posts

Re: Interview with Eric Brewer

#111

Post by jacquesm »

bcantrill wrote: post #110
jacquesm wrote: post #51

Earlier quoted context omitted.

How do you see this delivering on the security component of the isolation? (Not that VMs are perfect in this respect but it seems to me that containers are a lot less solid)

Well, you need to get specific. Speaking for SmartOS[1], we've been running containers in production for over a decade; while security is never solved per se (that is, there is always the possibility that defects will result in future vulnerabilities), the reality is that there is a lot of experience running this system in multi-tenant, internet-facing production and that CVEs against the Solaris-based zones technolo…

Ok, thanks for the clarification, all of my exposure to date has been playing around with some Linux offerings and it felt pretty rickety at best.

Re: Interview with Eric Brewer

#112

Post by vidarh »

jesstaa wrote: post #105

Containers, like virtual machines before them, aren't the future of computing. They're how we manage legacy apps. The future of computing is not this horrible kludge.

No matter what, we will want more isolation, not less.

But I sort-of agree in that we're just starting to make the transition from whole-os VMs to app containers, with a rare few going further. But cgroup/jails type isolation is lightweight enough that we can easily apply it at a much finer-grained level.

Re: Interview with Eric Brewer

#113

Post by vidarh »

bcantrill wrote: post #110
jacquesm wrote: post #51

Earlier quoted context omitted.

How do you see this delivering on the security component of the isolation? (Not that VMs are perfect in this respect but it seems to me that containers are a lot less solid)

Well, you need to get specific. Speaking for SmartOS[1], we've been running containers in production for over a decade; while security is never solved per se (that is, there is always the possibility that defects will result in future vulnerabilities), the reality is that there is a lot of experience running this system in multi-tenant, internet-facing production and that CVEs against the Solaris-based zones technolo…

Cgroups is "much more relatively immature", but it's predecessors, such as OpenVz have been around for about a decade.

Re: Interview with Eric Brewer

#114

Post by vidarh »

15thandwhatever wrote: post #95
mbesto wrote: post #67

Earlier quoted context omitted.

> See: chef, configuration management and various deployment services A chef script is basically the automation of "I need to copy every library of the OS and every line of code for the kernel and redeploy it every time I add a node?" I'm sorry if you didn't pick up on my implied remark. Two problems are then introduced when automating those actions: (1) it doesn't negate the fact that I need to store and deploy a 70…

What I do on our app servers is create a new user for each app (via configuration management). That gives me both environment separation (A needs Ruby 1.9, B needs Ruby 2.0), resource accounting on a per-app basis, and a repeatable foundation in case I need to re-deploy the server or spin up new instances.

That is only true if you use no parts (e.g. shared libraries etc.) of the host environment. That guarantee that you're not inadvertently depending on something on the host system that might change is what containers give you.

Re: Interview with Eric Brewer

#115

Post by bcantrill »

vidarh wrote: post #113
bcantrill wrote: post #110

Earlier quoted context omitted.

Well, you need to get specific. Speaking for SmartOS[1], we've been running containers in production for over a decade; while security is never solved per se (that is, there is always the possibility that defects will result in future vulnerabilities), the reality is that there is a lot of experience running this system in multi-tenant, internet-facing production and that CVEs against the Solaris-based zones technolo…

Cgroups is "much more relatively immature", but it's predecessors, such as OpenVz have been around for about a decade.

This is definitely true, and to be honest, it's something of a mystery to me why the OpenVZ work has been essentially a second-class citizen for that decade. If Linux had taken path lit by OpenVZ (which is to say, if Linux had taken back the OpenVZ changes), the security gap between Linux and FreeBSD/SmartOS/illumos might have been closed much more quickly -- but as it stands (with the OpenVZ work essentially discarded in favor of the much more immature namespaces), Linux isn't on a trajectory to offer multi-tenant security via containers in the foreseeable future...

Re: Interview with Eric Brewer

#116

Post by tachion »

otterley wrote: post #80
kayman wrote: post #61

I love the idea of using containers. Due to linux popularity and google's backing, containers will be next. But FREEBSD had jails since back in the day. What's the benefit of containers over bsd jails?

Linux has copy-on-write block devices that make it possible to efficiently layer container filesystems. FreeBSD has no such thing as far as I know; the best you can do involves hard links (correct me if I'm wrong).

You are incorrect, FreeBSD has ZFS file system as a first class citizen and that allows all these things (and much more). Check out tools like iocage[1] that are using it in very user friendly manner.

[1] https://github.com/iocage/iocage

Re: Interview with Eric Brewer

#117

Post by dunkelheit »

Can someone explain or provide an educated guess about what is the google's strategy with kubernetes here? Surely containers are hot now and it is nice to have a stake in the game but borg has been one of their key competitive advantages. What is the profit in making an open-source alternative?

Re: Interview with Eric Brewer

#118

Post by collyw »

liveoneggs wrote: post #66
jacquesm wrote: post #9

Earlier quoted context omitted.

I'd like a real explanation for why containers and unikernels are better than regular run-of-the-mill applications running on dedicated servers. It's almost as if the wild west of the web isn't quite enough and we now need to add another explosion of layers-of-abstraction but this time on the server in order to pretend we have infinite hardware which then becomes it's own reason for existence rather than to simply ru…

Because rails app 1 needs version x.y.z and rails app 2 needs version a.b.c and RVM sucks and managing gems sucks. This is, literally, the reason. You can replace rails with any similarly bad technology. I got this explanation a few weeks ago at my job: the java build process (I'm not kidding) has such a complex dependency graph that it must spin up full containers to do each build. ---- If dynamic languages supporte…

Does Ruby not have a virtualenv equivalent?

(I am reading through the comments trying to work out if I should learn Docker. I already know how to use a virtualenv and I already know how to use a VM.)

Re: Interview with Eric Brewer

#119

Post by marktangotango »

jeswin wrote: post #81
nickpsecurity wrote: post #49

One thing that bothers me about the article is that it shows a recurring problem: IT not knowing what it knows. The NoSQL movement didn't notice that NonStop Architecture scaled linearly to thousands of cores with strong-consistency, five 9's, and SQL support. In the mid-80's. Instead of making a low-cost knockoff, like cluster movement did for NUMA's, they ditched consistency altogether and launched NoSQL movement.…

> The NoSQL movement didn't notice that NonStop Architecture scaled linearly to thousands of cores with strong-consistency, five 9's, and SQL support. Also incredibly expensive. Take this case, Google took off because they were able to scale-out with off-the-shelf hardware, compared to the millions banks were pouring in for scale-up configurations which handled much less load. Scale-up can quickly hit hard limits, be…

>> Many large apps are significantly de-normalized and have many foreign-key less tables, often filled up by scheduled jobs. That's fine for most apps; NoSQL architectures recognize that and users consider that in design.

There's a boat load of assumed knowledge in this quote, how likely is it that someone not familiar with rdbms would know what a foreign key is, for example? Not very likely I think. I posit you give developers too much credit.

Re: Interview with Eric Brewer

#120

Post by marktangotango »

nickpsecurity wrote: post #63
zobzu wrote: post #57

Earlier quoted context omitted.

thats a pretty good comment actually. there's quite a bit of similarity. we generally tend to jump into these as "omg awesome new tech" with a very narrow view. But it also helps boosting more though-out techs (even thus it feels less efficient to go through that route first, its perhaps the only route that works with human: try, fail, try again, etc.)

Yeah we do. My only guess is it's two things: (a) our industry is horrendous at communicating previous generation's wisdom in a usable way; (b) a social phenomenon. Quick example of the first are industry pro's locking up their good advice in obscure, expensive books and cutting edge research silo'd into ACM, IEEE, etc. The other is a social thing that leads to the "network" effect. People flock to something for what…

I pimp this quote from Alan Kay regularly:

"Computing spread out much, much faster than educating unsophisticated people can happen. In the last 25 years or so, we actually got something like a pop culture, similar to what happened when television came on the scene and some of its inventors thought it would be a way of getting Shakespeare to the masses. But they forgot that you have to be more sophisticated and have more perspective to understand Shakespeare. What television was able to do was to capture people as they were. So I think the lack of a real computer science today, and the lack of real software engineering today, is partly due to this pop culture." [1]

[1] http://queue.acm.org/detail.cfm?id=1039523

Post reply on HN