Live data from Hacker News

Tiny Linux distro that runs the entire OS as Docker containers

github.com

171–177 of 177 posts

Re: Tiny Linux distro that runs the entire OS as Docker containers

#171

Earlier quoted context omitted.

Rather it's replacing systems like systemd and various other system daemons with the docker equivalents. For example why run a network supervision daemon if dockerd or equivalent handle all the important complex pieces of networking via container orchestration? Why have a local package manager, or system port mapper.

I'm pretty horrified by the argument you're making. The reason all those things are separate things is because they serve orthogonal functions. By bundling all of that into a single binary how have you improved things? You've increased the attack surface, reduced stability, increased complexity, and made things a lot harder to test and verify.

Well can't speak to the horror of the design as I'm not a really proponent of that particular design. Just clarifying the parent's statement a little. Though the rancheros design is not particularly worse than what systemd does now, based on my recent experiences. It's all one giant (poorly?) implemented binary either way. From a pragmatic standpoint I don't see a difference. What's the difference between one opaque binary vs another, except possibly one's written in Go which I find easier to read if needed and is less likely to have buffer overruns. Really cutting out one crapshoot seems logical as at least there's only one system you'd need to learn. Still I'd like a non-either of those options approach.

Personally I prefer running SmartOS and Triton containers. Their system seem much more stable than any of the Linux containers and/or systemd setups I've tried. It sticks a bit more to traditional unix design which makes sense to me. Items like the caching layer for containers build on ZFS snapshots, a well tested file system layer, rather than ad hoc userland tools. Triton also runs all of the orchestration layers in separate zones (containers) like RancherOS is trying to build. But each component is a simple(ish) service, it's easy to `zfs list` and check on a container's file system or fix it or backup, etc. Same with SVC or VM machine management which both have small simple tools that do one thing pretty well.

To that note, docker has been moving towards breaking out and using smaller daemons haven't they? If that continues it might turn out more modular in the end wherein RancherOS would end up being more modular than systemd Linux setups. Imho, that'd be great.

Re: Tiny Linux distro that runs the entire OS as Docker containers

#172
post #152

Earlier quoted context omitted.

I disagree. Just google "doesn't work in chroot" and you'll be reminded of a litany of issues that come up when trying to build/run things in a chroot, and a container containing a linux distro makes a tidy little sandbox which generally avoids those issues. It's somewhere on a spectrum between a chroot and a VM, which I think a lot of people find value in. And I'm not confusing containers and Docker, I'm just speaki…

> Just google "doesn't work in chroot" and you'll be reminded of a litany of issues that come up when trying to build/run things in a chroot Yeah, some newbie forgot to mount-bind a necessary directory like /proc or /dev, didn't provide sensible /etc/resolv.conf, or messed up host's and chroot's paths, either in request or in configuration. Nothing that would render chroot unviable. Is this what you meant?

Why would anyone want to get all that right manually when containers manage all that automatically?

Re: Tiny Linux distro that runs the entire OS as Docker containers

#173
post #168

Earlier quoted context omitted.

systemd's documentation is second to none: https://www.freedesktop.org/wiki/Software/systemd/

Only if one sets the bar quite low, and has very lax standards for doco. Unfortunately, people often do set the bar low in the Linux world. But to those from other worlds the descriptions that come to mind are "acceptable" and "mediocre". As people have pointed out passim over the years, the expected as the norm quality of doco for the worlds of the BSDs and the commercial Unices is noticeably a higher standard than…

Can you give an example of a better-documented open-source project that is less than 5 years old and has the same level of complexity of the systemd family?

Re: Tiny Linux distro that runs the entire OS as Docker containers

#174
post #152

Earlier quoted context omitted.

> Just google "doesn't work in chroot" and you'll be reminded of a litany of issues that come up when trying to build/run things in a chroot Yeah, some newbie forgot to mount-bind a necessary directory like /proc or /dev, didn't provide sensible /etc/resolv.conf, or messed up host's and chroot's paths, either in request or in configuration. Nothing that would render chroot unviable. Is this what you meant?

Why would anyone want to get all that right manually when containers manage all that automatically?

Good question. Why anyone presented with fancy and fashionable third party software would use a mechanism that has been present for decades, ships with the operating system, works reliably and predictably, doesn't change substantially every quarter, doesn't do any magical things to network configuration, and is easy to inspect, debug, and adjust for an outsider? Why indeed?

Re: Tiny Linux distro that runs the entire OS as Docker containers

#175

I'd really love to see some of this stuff transition to the desktop too. Like, for example, containerize Skype, so that it can't read my home. Or contain Firefox to just read `~/.mozilla` and `~/downloads`. For binary blobs I don't trust that much, I'd really value this. For FLOSS stuff, it still provides protection from bugs.

Look at http://flatpak.org for precisely that.

Nope, it does a lot more: it re-packages software, and basically shoves a second package manager down my throat; one that actually bundles dependencies within in package, carrying along all the issues that that flow brings with it.

I want to isolate data, no libraries. Libraries are there to be shared.

Re: Tiny Linux distro that runs the entire OS as Docker containers

#176

I'd really love to see some of this stuff transition to the desktop too. Like, for example, containerize Skype, so that it can't read my home. Or contain Firefox to just read `~/.mozilla` and `~/downloads`. For binary blobs I don't trust that much, I'd really value this. For FLOSS stuff, it still provides protection from bugs.

Qubes ( https://www.qubes-os.org/ ) is a good fit for this.

Yeah, creating a new OS/distribution will never fix the problem. You can't tell people "Oh, just wipe everything clean and installing this other OS".

It needs to build on top of what we have, otherwise adoption will never take place.

Re: Tiny Linux distro that runs the entire OS as Docker containers

#177
post #158

Earlier quoted context omitted.

The reason a new layer is being built is because people don't want vendor lock in and VM's aren't portable anymore. You can't take an AWS VM and fire it up on DigitalOcean without trial by fire. VM's should be portable but they're not because cloud providers don't want them to be. For a while everyone was locked into AWS but now that there's other options some companies want to hedge their bets, or even run parts of…

"You can't take an AWS VM and fire it up on DigitalOcean without trial by fire. VM's should be portable but they're not because cloud providers don't want them to be." You can't ? I have never used DO, but I have deployed linux and FreeBSD systems on EC2 and moving them to bare metal was just a tar command away ... you can even pipeline 'dd' over ssh if you want to be fancy ...

You could say that it's as easy as using 'rsync'...
Post reply on HN