Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My VM is lighter (and safer) than your container (2017)

dl.acm.org

Post reply on HN
Print view View original

101–110 of 111 posts

Re: My VM is lighter (and safer) than your container (2017)

#101

Post by egberts1 »

mmcnl wrote: post #71
duskwuff wrote: post #60

Earlier quoted context omitted.

What turned me off from Vagrant was that Vagrant machines were never fully reproducible. Docker took the approach of specifying images in terms of how to create them from scratch. Vagrant, on the other hand, took the approach of specifying certain details about a machine, then trying to apply changes to an existing machine to get it into the desired state. Since the Vagrantfile didn't (and couldn't) specify everythin…

Docker is not fully reproducible either. Try building a Docker image from two different machines and then pushing it to a registry. It will always overwrite.

Ooooh, “it will always overwrite.”: this is like saying an indirect way of saying that your executable will behave exactly the same if it got overwritten (by a same set of bytes).

Good one.

Re: My VM is lighter (and safer) than your container (2017)

#102

Post by zonethundery »

lstodd wrote: post #74
pojzon wrote: post #64

Earlier quoted context omitted.

How differently LXD manages isolation in comparison to docker ? I suppose both create netns, bridge, ifs ?

It's the same stuff - namespaces, etc. But it doesn't shove greasy fingers into network config like docker. More a tooling question/approach than tech.

Have similar feelings about docker. LXD containers through a bridged interface fit my mental model/use case.

Re: My VM is lighter (and safer) than your container (2017)

#103

Post by ParetoOptimal »

egberts1 wrote: post #101
mmcnl wrote: post #71

Earlier quoted context omitted.

Docker is not fully reproducible either. Try building a Docker image from two different machines and then pushing it to a registry. It will always overwrite.

Ooooh, “it will always overwrite.”: this is like saying an indirect way of saying that your executable will behave exactly the same if it got overwritten (by a same set of bytes). Good one.

Dockerfiles pervasively use things like `apt-update` and that makes them not reproducible.

Even of your image pins apt or yum, images you depend on likely don't.

Docker is repeatable, not reproducible.

Re: My VM is lighter (and safer) than your container (2017)

#104

Post by ParetoOptimal »

liftm wrote: post #11
1MachineElf wrote: post #7

Earlier quoted context omitted.

While a flawed comparison, WSL does use a VM in conjunction with the 9p protocol to achieve folder sharing.

9p-based folder sharing is (used to be?) possible with qemu, too.

Yep, can confirm.

NixOS configurations can be built and run as a qemu VM.

I very recently was using one and found they automatically make a 9p mount to /tmp.

Re: My VM is lighter (and safer) than your container (2017)

#105

Post by xahrepap »

llllIIIIllll wrote: post #84
xahrepap wrote: post #41

This reminds me: in 2015 I went to Dockercon and one booth that was fun was VMWare's. Basically they had implemented the Docker APIs on top of VMWare so that they could build and deploy VMs using Dockerfiles, etc. I've casually searched for it in the past and it seems to not exist anymore. For me, one of the best parts of Docker is building a docker-image (and sharing how it was done via git). It would be cool to be…

https://github.com/weaveworks/ignite can apparently do this. It looks exciting!

This is really cool! Thanks for sharing.

Though the naming is strange since Apache Ignite exists already. But I’m definitely going to play with this.

Re: My VM is lighter (and safer) than your container (2017)

#106

Post by egberts1 »

ParetoOptimal wrote: post #103
egberts1 wrote: post #101

Earlier quoted context omitted.

Ooooh, “it will always overwrite.”: this is like saying an indirect way of saying that your executable will behave exactly the same if it got overwritten (by a same set of bytes). Good one.

Dockerfiles pervasively use things like `apt-update` and that makes them not reproducible. Even of your image pins apt or yum, images you depend on likely don't. Docker is repeatable, not reproducible.

Yep

Re: My VM is lighter (and safer) than your container (2017)

#107

Post by laurencerowe »

Morgawr wrote: post #83
gavinray wrote: post #39

The issue with unikernels and things like Firecracker are that you can't run them on already-virtualized platforms I researched Firecracker when I was looking for an alternative to Docker for deploying FaaS functions on an OpenFaaS-like clone I was building It would have worked great if the target deployment was bare metal but if you're asking a user to deploy on IE an EC2 or Fargate or whatnot, you can't use these t…

> The issue with unikernels and things like Firecracker are that you can't run them on already-virtualized platforms I'm not sure about Firecrackers and it has to be enabled on the platform level but there are tricks you can use to run pseudo-nested VMs that look like they are nested without actually incurring into any nested virtualization overhead. This is something that some of us (crosvm) are exploring and playin…

Firecracker runs in hosts that support nested virtualization. GCP and Github Codespaces do, but unfortunately EC2 and Macs don't.

Re: My VM is lighter (and safer) than your container (2017)

#108

Post by kazen44 »

pjmlp wrote: post #99
lamontcg wrote: post #55

Containers should really be viewed as an extension of packages (like RPM) with a bit of extra sauce with the layered filesystem, a chroot/jail and cgroups for some isolation between different software running on the same server. Back in 2003 or so we tried doing this with microservices that didn't need an entire server with multiple different software teams running apps on the same physical image to try to avoid givi…

Back in 2000 we were doing this with HP-UX Vaults, IT keeps going in circles.

ASlso, docker to me seems quite leaky in terms of abstractions (especially the networking side) compared to something like a freeBSD jail.

why does docker networking need to be infinitely complex? freebsd solved this issue far more cleanly two decades ago without having to emulate entirely new networking spaces.

Re: My VM is lighter (and safer) than your container (2017)

#109

Post by kazen44 »

wongarsu wrote: post #16
r3mc0 wrote: post #6

Containers and VMs are totally not the same thing. They serve a complete other purpose , as multiple containers can be combined to create an application/service , VMs always use a complete os etc etc anyway the internet is full of the true purpose of containers , they were never meant to use as a "VM" and about security.. meh everything is insecure until proven differently

VMs can have private networks between each other just as containers do. That's pretty much what EC2 is about.

heck, when running something in production with multiple underlying servers, you need a system that builds an overlay network regardless if you use containers or Vm's..

Re: My VM is lighter (and safer) than your container (2017)

#110

Post by xbfivhvu »

ParetoOptimal wrote: post #103
egberts1 wrote: post #101

Earlier quoted context omitted.

Ooooh, “it will always overwrite.”: this is like saying an indirect way of saying that your executable will behave exactly the same if it got overwritten (by a same set of bytes). Good one.

Dockerfiles pervasively use things like `apt-update` and that makes them not reproducible. Even of your image pins apt or yum, images you depend on likely don't. Docker is repeatable, not reproducible.

No post body was provided.
Post reply on HN