Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comparing Triton containers to VMs and bare metal servers

joyent.com

Post reply on HN
Print view View original

21–23 of 23 posts

Re: Comparing Triton containers to VMs and bare metal servers

#21

Post by gtirloni »

jclulow wrote: post #5
gtirloni wrote: post #3

Containers hosting hardware virtual machines running Windows, FreeBSD, or others Can't we just describe VMs as VMs and be done with it? So it's a container that has a VM inside it?

Yes, the QEMU process that underpins the hardware virtual machine lives within a container on the host. It means that a vulnerability in QEMU that allows for guest escape will land you in an otherwise empty container, rather than out on the host where other tenants are accessible. But Triton is first and foremost about _container-based_ virtualisation: which involves no HVM at all!

Ah, that's something I hadn't considered. Good point. I guess the overhead will be minimum in that scenario.

Re: Comparing Triton containers to VMs and bare metal servers

#22

Post by bahamat »

mrbill wrote: post #16
bahamat wrote: post #14

Earlier quoted context omitted.

It's not a different architecture. SmartOS is x86 based, as are the Linux binaries. What lx-brand zones do is present an alternate system call table to the binaries executed inside the zone. Those "lx" calls are compatible with the Linux system call table and get mapped and/or translated to illumos kernel system calls. Binaries don't know the difference.

So Triton is basically (simplifying) Solaris / SmartOS zones with the LX stuff installed?

It's that, plus cloud orchestration (i.e., SmartDataCenter) which includes sdc-docker, providing the Docker API and image management.

Re: Comparing Triton containers to VMs and bare metal servers

#23

Post by xenophonf »

jclulow wrote: post #5
gtirloni wrote: post #3

Containers hosting hardware virtual machines running Windows, FreeBSD, or others Can't we just describe VMs as VMs and be done with it? So it's a container that has a VM inside it?

Yes, the QEMU process that underpins the hardware virtual machine lives within a container on the host. It means that a vulnerability in QEMU that allows for guest escape will land you in an otherwise empty container, rather than out on the host where other tenants are accessible. But Triton is first and foremost about _container-based_ virtualisation: which involves no HVM at all!

Is it possible to do the same thing with cgroups or jails?
Post reply on HN