Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The What, Why and How of Containers

annwan.me

Post reply on HN
Print view View original

131–132 of 132 posts

Re: The What, Why and How of Containers

#131

Post by ahepp »

sltkr wrote: post #95
ahepp wrote: post #76

Earlier quoted context omitted.

Are you saying that two containers running the same image will share their common libraries in the host kernel's memory? Based on my understanding of cgroups, that seems unintuitive to me. Are you certain that's the case? I may try testing this out when I get a chance.

Yes. And even containers running different images will share the libraries so long as they come from shared layers.

I guess thinking about it more, that does check out. The kernel loads shared libraries, and containers share the kernel.

Re: The What, Why and How of Containers

#132

Post by CoolCold »

otabdeveloper4 wrote: post #22
kqr wrote: post #7

I wish I had read this article a decade ago. For many years I have been wondering "why the heck would I use containers when I have chroot, cgroups and namespaces?" Turns out that's exactly what containers are a packaging of! And I only found out about two years ago. Although this article doesn't go into it, the benefits I've found of using containers rather than rolling isolation by hand is that a lot of semi-standar…

> Turns out that's exactly what containers are a packaging of! Well, no. When people say "containers", they always mean "Docker". And Docker also comes with a daemon with full root permissions and ridiculous security policies. (Like, for example, forcefully turning off your machine's firewall, #yolo. WTF!) P.S. I actually run systemd-nspawn in production, but I am probably the only person on earth to do so.

> P.S. I actually run systemd-nspawn in production, but I am probably the only person on earth to do so.

Mind sharing some good practical introduction article or set of articles for using VEs (virtual environments) with it? I'm tied to LXD at this moment which manages to provide both ease of operational and ease of configuration fine tunings be needed. I.e. I understand and tested for the projects I do taking care about on how to have network bridges, resources limiting, snapshot/rollback/create new image for VEs, storage profiles (say some I want to put on BTRFS some on ZFS some ...), simple `lxc ls` and `lxc shell ` interfaces - may be systemd has all this kind of stuff as well. Or may be it shines in different area?

Post reply on HN