Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tiny Linux distro that runs the entire OS as Docker containers

github.com

Post reply on HN
Print view View original

121–130 of 177 posts

Re: Tiny Linux distro that runs the entire OS as Docker containers

#121

Post by digi_owl »

gtrevorjay wrote: post #15

This is clearly a trend, though it remains to see if it will garner enough acceptance to actually be "the future". systemd supports launching container-based services via nspawn and already namespaces "legacy" services very heavily. In fact, systemd et al were among the heaviest early drivers of cgroup technology for cleaner starting and stopping of groups of processes.

It very much is a trend, a trend of by developers, for developers. All this is so that some primadonna developer somewhere can use the latest languages and frameworks to build his "app" without some sysadmin or other uses of available computing resources gets in his way.

It's about kicking the question of static vs dynamic can up the stack, as now you have something that is a hodgepodge of dynamic bindings that seems to behave like something static as long as you do not look behind the curtains. Oh, and don't mind the turtles...

Re: Tiny Linux distro that runs the entire OS as Docker containers

#122

Post by digi_owl »

yebyen wrote: post #113
throwaway2048 wrote: post #67

Earlier quoted context omitted.

Great job proving the second part of what he said

Put up a sentence or two of informative discussion, or links or any kind, this is not any kind of way to advance the state of a thread. "Go on, try it" doesn't help me in any way. I believe that Docker has more attention, you might call it hype. I'd say "eyes" instead. We have here a way to shown to run everything in Docker, parent link of thread (RancherOS.) That's great, I already went ahead and tried it. I'm still…

Docker also is less invasive. You do not need to build the distro around docker to use docker...

Re: Tiny Linux distro that runs the entire OS as Docker containers

#123

Post by digi_owl »

B1tchard0 wrote: post #105

I don't understand why running software on bare metal is viewed as a problem to be solved. how many layers of abstraction are necessary, and why? Obviously virtualizing serves a valuable purpose. Making development more accessible is great. Simplistic dev services like this mean reliance on others infrastructure, and being bound to cloud. Doesn't seem forward thinking. Can you imagine if Google had decided to run the…

The basic thing is that we have ended up with a world of rock star code monkeys. And those rock stars can't be held back by some admin or exec saying no to using some hot new language or framework...

Re: Tiny Linux distro that runs the entire OS as Docker containers

#124

Post by digi_owl »

hobarrera wrote: post #52

I'd really love to see some of this stuff transition to the desktop too. Like, for example, containerize Skype, so that it can't read my home. Or contain Firefox to just read `~/.mozilla` and `~/downloads`. For binary blobs I don't trust that much, I'd really value this. For FLOSS stuff, it still provides protection from bugs.

Firejail.

Re: Tiny Linux distro that runs the entire OS as Docker containers

#125

Post by digi_owl »

derefr wrote: post #101
dkarapetyan wrote: post #85

Earlier quoted context omitted.

http://man7.org/linux/man-pages/man7/capabilities.7.html There are several capabilities in that list to address your problem. Since your question is concerned about memory you can search for "memory" in that page and note the exact capabilities you will need. OpenBSD has even more features ( https://en.wikipedia.org/wiki/OpenBSD_security_features ) alongside the capability model. My gripe is that instead of learning…

Note that my point wasn't about how "your process" can be non-isolated in certain ways using capabilities, such that you could , in theory, sandbox both of those processes individually and have them still do whatever IPC you want; yes, this is certainly possible, and obviously more sensible if one of those processes isn't so much "your" process as it is some other process managed by some other party that you're inter…

Ugh, "apps". If ever there is a tortured term in computing these days it's that one.

Re: Tiny Linux distro that runs the entire OS as Docker containers

#126

Post by coldtea »

dkarapetyan wrote: post #98
wmf wrote: post #92

Earlier quoted context omitted.

Because either there is no RPM or the RPM conflicts with other RPMs on the machine.

Sounds like then you should learn what a chroot is. All the existing linux platforms already provide the solution to your exact problem with much less overhead than docker.

Only that chroot wont also run on the development machine, running a totally different OS.

Re: Tiny Linux distro that runs the entire OS as Docker containers

#127

Post by developer2 »

dkarapetyan wrote: post #111
elcritch wrote: post #108

Earlier quoted context omitted.

Rather it's replacing systems like systemd and various other system daemons with the docker equivalents. For example why run a network supervision daemon if dockerd or equivalent handle all the important complex pieces of networking via container orchestration? Why have a local package manager, or system port mapper.

I'm pretty horrified by the argument you're making. The reason all those things are separate things is because they serve orthogonal functions. By bundling all of that into a single binary how have you improved things? You've increased the attack surface, reduced stability, increased complexity, and made things a lot harder to test and verify.

Have you ever used Rancher OS? Not trying to sound like a judgemental jerk, but the arguments you are making are clearly from someone who is commenting based on a preconceived notion of what it is, without knowing what it really is. Instead of combating others in comments because they can't succinctly describe it to you, go research it instead. If you don't care enough to look into it, you shouldn't be caring to argue in the comments.

Re: Tiny Linux distro that runs the entire OS as Docker containers

#128

Post by hehheh »

pikzen wrote: post #17
gtrevorjay wrote: post #15

This is clearly a trend, though it remains to see if it will garner enough acceptance to actually be "the future". systemd supports launching container-based services via nspawn and already namespaces "legacy" services very heavily. In fact, systemd et al were among the heaviest early drivers of cgroup technology for cleaner starting and stopping of groups of processes.

Unfortunately, systemd/nspawn does not benefit from the hype Docker garners, despite being infinitely better. This industry is becoming more and more hype and cargo-cult driven, instead of making sane technological choices

I feel exactly the same way about systemd as you seem to feel about docker.

Re: Tiny Linux distro that runs the entire OS as Docker containers

#129

Post by dkarapetyan »

developer2 wrote: post #127
dkarapetyan wrote: post #111

Earlier quoted context omitted.

I'm pretty horrified by the argument you're making. The reason all those things are separate things is because they serve orthogonal functions. By bundling all of that into a single binary how have you improved things? You've increased the attack surface, reduced stability, increased complexity, and made things a lot harder to test and verify.

Have you ever used Rancher OS? Not trying to sound like a judgemental jerk, but the arguments you are making are clearly from someone who is commenting based on a preconceived notion of what it is, without knowing what it really is. Instead of combating others in comments because they can't succinctly describe it to you, go research it instead. If you don't care enough to look into it, you shouldn't be caring to argu…

Not to sound like a judgmental and experienced jerk back but how many container orchestration systems have you built and run in production? Since I have first hand experience in building, hacking, and working around all the limitation of a few such systems deployed into production environments I think I know all there is to know about RancherOS.

By all means continue to run RancherOS and let me know how that goes when you're managing a few hundred to maybe upwards of a thousand VMs and then layering a container orchestration system with the underlying VMs coming and going on an on-demand basis. I remember thinking "I really wish I had more of this docker stuff in the OS itself. Because dealing with all the caching, volume mounting, and instability in userspace is so much fun".

I'll await your report because clearly my experience with these systems and all the ways they fail is too combative for your taste. There are a few things they don't tell you on the brochure when you're drinking the kool-aid.

Re: Tiny Linux distro that runs the entire OS as Docker containers

#130

Post by derefr »

digi_owl wrote: post #125
derefr wrote: post #101

Earlier quoted context omitted.

Note that my point wasn't about how "your process" can be non-isolated in certain ways using capabilities, such that you could , in theory, sandbox both of those processes individually and have them still do whatever IPC you want; yes, this is certainly possible, and obviously more sensible if one of those processes isn't so much "your" process as it is some other process managed by some other party that you're inter…

Ugh, "apps". If ever there is a tortured term in computing these days it's that one.

Okay, how about "a purchased software product launched through a GUI"? There's no guarantee that it's a single process, but there's an assumption that it's a single security context.
Post reply on HN