I really like a lot of things about FreeBSD and would love to try it in the cloud but I feel like I'm missing something? Running FreeBSD on top of ZFS seems to be the smart way to go and yet this requires 1GB of ram minimum. If I spin up an instance of Ubuntu using ext4 by default, the OS uses around 50Mb of ram total. I feel like only the big kids who run on dedicated servers or who are paying for a larger instance get to use FreeBSD.
Docker on FreeBSD
61–69 of 69 posts
Re: Docker on FreeBSD
#62Earlier quoted context omitted.
To be honest, I think OpenBSD is ahead on some fronts (research on security mechanisms, for instance), but the reason that I tend to use FreeBSD is that it actually works with software packages. So the computers are based on FreeBSD (which manages the hypervisor -- and soon container daemon!), and appliances only are based on OpenBSD. Compatibility ftw.
> research on security mechanisms, for instance) Citation(s) requested.
Re: Docker on FreeBSD
#63I just assumed we would not do docker because we have had jails for so long. In fact, ZFS and jail is docker no? I admit no familiarity with docker (played with LXC years ago and thought - gosh it's like jail! :-)
Docker is a management tool for the underlying jail-like features implemented by the kernel (cgroups, mainly). There's no reason why it can't be used to manage *BSD jails, ie., create jails from Dockerfiles, download jail templates from a public repository, etc.
> Docker is a management tool for the underlying jail-like features implemented by the kernel...
ezjail[1] manages FreeBSD jails quite nicely too. Paired with ZFS, the GP makes a solid case IMHO.
Re: Docker on FreeBSD
#64Earlier quoted context omitted.
Canaries and other techniques that leverage volatiles do not prevent an overflow; they just try to cope with the consequences of an overflow which has happened. (This is why they're generally lumped together as "mitigation".) The canary tries to detect the case of an overflow which overwrites the return address in a stack frame. Data Execution Prevention (DEP) takes this idea a step further, it assumes that the retur…
Thank you very much, Gonzo. This is one of the most insightful comments i have read here on HN.
You are welcome, and thank you!
Re: Docker on FreeBSD
#65I really like a lot of things about FreeBSD and would love to try it in the cloud but I feel like I'm missing something? Running FreeBSD on top of ZFS seems to be the smart way to go and yet this requires 1GB of ram minimum. If I spin up an instance of Ubuntu using ext4 by default, the OS uses around 50Mb of ram total. I feel like only the big kids who run on dedicated servers or who are paying for a larger instance…
There's nothing wrong with UFS+SUJ. FreeBSD is awesome for a lot more reasons than just ZFS, and it works well in low memory environments (assuming that you're willing to tweak the kernel/installation a little bit---for example, see https://www.freebsd.org/doc/en/articles/nanobsd/index.html). That said, the smallest current generation instance from Amazon comes with 1 GB RAM, which is more than enough memory to experiment with everything FreeBSD has to offer.
Re: Docker on FreeBSD
#66Earlier quoted context omitted.
> research on security mechanisms, for instance) Citation(s) requested.
https://marc.info/?l=openbsd-tech&m=143725996614627&w=2
As noted below, Theo seems to be cautiously boarding the capabilities train with tame. That said, there appear to be some rather large issues with the implementation as it stands.
Re: Docker on FreeBSD
#67I really like a lot of things about FreeBSD and would love to try it in the cloud but I feel like I'm missing something? Running FreeBSD on top of ZFS seems to be the smart way to go and yet this requires 1GB of ram minimum. If I spin up an instance of Ubuntu using ext4 by default, the OS uses around 50Mb of ram total. I feel like only the big kids who run on dedicated servers or who are paying for a larger instance…
There's nothing wrong with UFS+SUJ. FreeBSD is awesome for a lot more reasons than just ZFS, and it works well in low memory environments (assuming that you're willing to tweak the kernel/installation a little bit---for example, see https://www.freebsd.org/doc/en/articles/nanobsd/index.html ). That said, the smallest current generation instance from Amazon comes with 1 GB RAM, which is more than enough memory to expe…
Good point - I just wanted to try out BSDploy - http://docs.bsdploy.net/en/latest/ - and found I had to use ZFS
Re: Docker on FreeBSD
#68Earlier quoted context omitted.
https://marc.info/?l=openbsd-tech&m=143725996614627&w=2
As noted below, Theo seems to be cautiously boarding the capabilities train with tame. That said, there appear to be some rather large issues with the implementation as it stands.
tame(2) seems really ad-hoc. Also, isn't the path checking, like
strncmp(path, "/tmp/", 5) == 0) {
Re: Docker on FreeBSD
#69Earlier quoted context omitted.
There's nothing wrong with UFS+SUJ. FreeBSD is awesome for a lot more reasons than just ZFS, and it works well in low memory environments (assuming that you're willing to tweak the kernel/installation a little bit---for example, see https://www.freebsd.org/doc/en/articles/nanobsd/index.html ). That said, the smallest current generation instance from Amazon comes with 1 GB RAM, which is more than enough memory to expe…
Good point - I just wanted to try out BSDploy - http://docs.bsdploy.net/en/latest/ - and found I had to use ZFS
Hey, that's neat. Thanks for the link!