Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Slim – Build and run tiny VMs from Dockerfiles

github.com

Post reply on HN
Print view View original

121–130 of 144 posts

Re: Show HN: Slim – Build and run tiny VMs from Dockerfiles

#121

Post by dhritzkiv »

xienze wrote: post #107
ManuelKiessling wrote: post #69

Earlier quoted context omitted.

Yesterday a friend of mine told me about how they got a Node.js application from a vendor that was about 3 MiB, and after running npm install, it was over 1 GiB. I half-jokingly said that Node apps are the new ZIP bombs.

Isn’t that because every Node dependency stores its own dependencies within itself? So you could literally end up with multiple copies of the exact same version of the same library. I’ve never understood why they didn’t go with the Maven approach: all dependencies stored in a central location, separated by version.

I believe the same version (within a specified semver range) are hoisted and stored in the root of ./node_modules. Differing versions are nested within the consuming packages and therefore duplicated.

This can be particularly bad when a popular package has a semver major change (even if, for example, support for an outdated version of node is dropped), many libraries will lag behind in updating to the latest major version and you will have many duplicated copies of a popular package.

Re: Show HN: Slim – Build and run tiny VMs from Dockerfiles

#122

Post by mav3rick »

Bombthecat wrote: post #103
buildbuildbuild wrote: post #42

Earlier quoted context omitted.

Docker containers do not yet offer the same security or “bring your own kernel” flexibility of full VMs, such as access to a CPU’s VT-x features.

You think they will, one day?

You can tighten containers but at the end of the day they are running as native processes on the same kernel. Any vulnerability and game is over. VM offers an easier (maybe heavy) mental model of security. Between guests and between guest and host.

Re: Show HN: Slim – Build and run tiny VMs from Dockerfiles

#123

Post by shaklee3 »

hedora wrote: post #7

I’d love to see an orchestrator that made switching between bare metal, vm and containers a simple configuration option. This is a step in that direction. Cool stuff!

Kubevirt will deploy vms on kubernetes. No bare metal option though.

Re: Show HN: Slim – Build and run tiny VMs from Dockerfiles

#124

Post by dharmab »

Bombthecat wrote: post #103
buildbuildbuild wrote: post #42

Earlier quoted context omitted.

Docker containers do not yet offer the same security or “bring your own kernel” flexibility of full VMs, such as access to a CPU’s VT-x features.

You think they will, one day?

Docker- probably not. Other runtimes like Kata and Firecracker? Probably.

Re: Show HN: Slim – Build and run tiny VMs from Dockerfiles

#125

Post by freedomben »

root_axis wrote: post #95
lwb wrote: post #50

Wait a minute. I thought Docker was useful because you didn't want to run a whole VM. But this project turns a Dockerfile into a VM specification? Have we come full circle?

Docker can replace a VM for many use-cases, but there are times when a VM is still preferable. If you find yourself in such a situation, this tool allows you to leverage declerative Dockerfiles to build your VM. Pretty handy.

Yep, I could see this being a nice option if you're running something very security sensitive and want some extra defense by isolating the kernel.

Re: Show HN: Slim – Build and run tiny VMs from Dockerfiles

#126

Post by freedomben »

kristianp wrote: post #114
ajsharp wrote: post #104

This is cool. For dev, the docker runtime consumes an enormous amount of host system resources. Even with a 16gb RAM host machine, docker is really resource heavy for a development environment. If this can cut down on host system resource usage, that's a major win.

Are you on a non linux host? I assume docker is a lot less heavy on resources on linux than on mac&win.

they have to be. Docker is extremely light weight on a linux host.

Re: Show HN: Slim – Build and run tiny VMs from Dockerfiles

#128

Post by tylerl »

untog wrote: post #119
tylerl wrote: post #118

Earlier quoted context omitted.

This is exactly why we don't allow our employees to use Node.js for company software development, even though in theory a fair chunk of the runtime is our own software that we maintain. But the npm ecosystem has a really awful signal-to-dogturd ratio, and developers appear to put very little effort into critically analyzing their dependencies. The topic has come up, but I'm generally against it; sure, we could spend…

I'm glad I don't work at your company. "developers appear to [...] I strongly suspect"... I hope the decision to exclude an entire programming language that's popular almost everywhere is based on serious study rather than appearances and suspicions.

No, don't be silly; responsible companies don't pick and choose languages to exclude based on suspicions.

No... responsible companies exclude ALL programming languages except those that they can responsibly support -- you don't want the new guy writing some a critical piece of infrastructure in Haskell or Ada or Lisp or something because they feel it's morally superior, and then find out it can't integrate with some critical management system because it doesn't have the right bindings, or that it doesn't run on your upgraded production environment, or whatever. When you have tens of thousands of programmers, it's guaranteed to happen unless you proactively prevent it.

No, we have a handful of programming languages where we can guarantee that everything works, that the important infrastructure is accessible, that every library will remain supported until we replace it, that every vulnerability can be patched within a given timeframe, that code will run correctly on every machine, and so forth. Taking on a new language means dedicating a whole team of engineers to maintaining support for that language, indefinitely.

Some companies may be able to YOLO their way through decisions based on what what's popular at any given moment, but when you operate at any serious scale you have to be a bit more... responsible.

Re: Show HN: Slim – Build and run tiny VMs from Dockerfiles

#129

Post by eeZah7Ux »

tssva wrote: post #21
peterwwillis wrote: post #8

If this works, this is fantastic. Getting away from the stupidly complex abstractions around Docker is a welcome change, especially if we can still package and deploy immutable images. We already manage containers like tiny VMs, so ditching the abstractions should simplify life a bit.

Have you looked at LXD/LXC? I find it to be a great compromise between the high overhead of VMs and the complex abstractions around Docker.

SystemD does that.

Re: Show HN: Slim – Build and run tiny VMs from Dockerfiles

#130

Post by eeZah7Ux »

yjftsjthsd-h wrote: post #83
JustSomeNobody wrote: post #78

Are we just going in circles now? Why not just start with a tiny vm and call it a day?

Tooling matters. Building and managing VMs has, historically, been more work.

Debootstrap has been doing the work with pretty much one command for 10+ years.
Post reply on HN