Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebAssembly: Docker Without Containers

wasmlabs.dev

Post reply on HN
Print view View original

231–240 of 313 posts

Re: WebAssembly: Docker Without Containers

#231

Post by holografix »

mdeeks wrote: post #202
ridruejo wrote: post #132

Earlier quoted context omitted.

Solomon is no longer at Docker (hasn’t been for a while) and Docker Inc is doing extremely well financially after the split and renewed focus on developers. This Wasm release also shows they are very forward looking… I am very positive on the company and what they are doing (no affiliation other than like Scott and the team over there)

Genuine question: How much of that financial improvement is due to them requiring companies to now pay for Docker Desktop on macOS? We found ourselves essentially with no option but to pay up for a full year on short notice. We want nothing of their other paid offerings like builds or repo hosting. The sales rep basically confirmed we're just paying for the thing we used to get for free now. The whole call was a gian…

Genuine question: do you think people creating software that’s incredibly valuable for you should’t get paid?

You had it for free for a long time? Lucky you!

Re: WebAssembly: Docker Without Containers

#232

Post by vermaden »

erk__ wrote: post #185
cmeacham98 wrote: post #87

Earlier quoted context omitted.

There are serious attempts at secure container runtimes (see gVisor) and runtimes that run container images in a real VM (see Firecracker). This meme that containers are inherently insecure just because Docker doesn't attempt to be a security product needs to die. Docker hasn't been the only player in the container runtime space for a long time.

I think that security has always been a goal of FreeBSD jails and I believe they are a bit more hardened than docker

Docker only uses namespaces and cgoups.

Docker does not provide and security or isolation.

To have security and isolation with Docker you must use something external like SELinux or AppArmor.

Hope that helps.

Regards.

Re: WebAssembly: Docker Without Containers

#233

Post by cma »

angelmm wrote: post #198
nashashmi wrote: post #188

I once imagined a time in a far, faraway land where the new OS secretly in development was nothing more than a thin interface between the hardware and the software. And the software was a VM. And this was codenamed Fuchsia. And was being worked on by Google. They took away the lessons learned from CHromeOS with its LXC containers and Android Container. And realized the new OSs of the future can be anything and everyt…

Actually, Wasm goes into the direction you are pointing. A Wasm runtime should add a little overhead to the requirements of the Wasm module. However, it's true Wasm is not on that point yet. There are open threads about deallocate Wasm memory [1]. However, I expect these features, as well as Garbage Collection [2] will come to the stardard over time. This will allow modules and runtimes to properly manage memory usag…

If I run two programs with the same shared libraries, the nonrelocated parts are not duplicated in memory (and if I fork, the relocated parts aren't either). Does wasm map shared memory from disk like this, for the translated executable code?

Re: WebAssembly: Docker Without Containers

#234

Post by mainframed »

angelmm wrote: post #192
nikeee wrote: post #190

One important thing about containers is that they isolate the process and it can not access files it is not explicitly allowed to. If I'm getting this right, WASI is basically just POSIX for WASM. This means that it does not provide some level of sandboxing that - for example - Deno has done. When running a Deno program, you have to actively allow network access or write access to the disk. It uses the built-in stuff…

That's how WASI is designed. You need to specifically mount a specific folder so it can be accessed by the module. The sockets support is not ready yet, that's the reason there's no specific limitation around networking. For me, the most interesting part is the component-model. It's still a proposal, but it will allow developers to specify the permissions for other modules (libraries) a main Wasm module may use. With…

But couldn't that lead to a lot of permission errors?

If I have a complex program with a lot of dependencies.

What happens if one of the dependencies suddenly tries to write to `~/.local/dep_name/cache.raw` and I did not explicitly allow it to do so, since I didn't know it needs that location? In docker it would just create that folder in its own volume and the volume is deleted after the container is removed (if the volume is not named).

If I understood correctly from your comment, each WASI-runtime does not have a corresponding filesystem/volume.

But what does it do then? Will it simply crash?

Re: WebAssembly: Docker Without Containers

#235

Post by dathinab »

kllrnohj wrote: post #134
jeroenhd wrote: post #117

What I'm missing in these articles is a performance comparison. All WASMed tools I've tried were really cool proofs of concept, but the performance was always lacking at the very least. I see several languages moving towards more and more WASM but on a technical level I don't see the benefit of WASM over something like Firecracker. Docker and other sandboxes have to deal with shared kernels and all the risks associat…

> Fast - it can offer native-like speed via the JIT/AOT capabilities of most runtimes. No cold starts, unlike booting a VM or starting a container. What do you mean? This bullet point had a rocket emoji! Surely you don't actually want evidence to support a rocket emoji?!?

It's native-like speed for some programs.

But it also depends a bit on the application.

Some applications can benefit a a lot from CPU specific instructions combinations which are not available to wasm (with available I mean implicitly, i.e. your wasm code gets compiled to them).

Luckily for a lot of use-cases this doesn't matter much(1) and some degree of SIMD support is often(2) available.

(1): Without micro-optimizations which most times aren't done as due to their maintenance/development cost.

(2): I'm not quite up to date. I think 128bit SIMD is available in most (all?) relevant WASI runtimes and at least some browsers.

Re: WebAssembly: Docker Without Containers

#236

Post by cogman10 »

spreiti wrote: post #223
blacklion wrote: post #207

Earlier quoted context omitted.

The biggest missing thing (for production) is observability. Look at old-good JVM. It has tons of tools to analyze and understand behavior of your production system. You could have thread dumps (stack traces of all existing threads) at any moment with negligible performance impact, you could dump heap and analyze it off-site, you could have tons of metrics, about each dark corner of mutexes, GC process, about JIT, in…

This a 1000 times. People like to hate on Java but when there are problems to diagnose on production systems it is second to none. But from my experience most people don't know these tools even exist so the only thing they do is restarting and guessing where the problem might be if it persists.

Flight recorder is a godsend and I've not seen it's equal in any other language/ecosystem.

Any JVM anywhere can answer the question "why am I running slow" with a quick run of flight recorder. Memory, CPU, socket time, GC impact, TLB, thread dumps, etc. It's all there in one file that imposes something like a 1->2% performance impact if you run it constantly.

It's just so good.

Re: WebAssembly: Docker Without Containers

#237

Post by xvector »

buu700 wrote: post #208
nine_k wrote: post #65

Earlier quoted context omitted.

This sounds incredible, as if the co-founder of Docker fails to understand the crucial value proposition of Docker (hence Docker's financial troubles, maybe). The point of Docker is the ability to take the existing Rube-Goldberg-machine configurations of software, in any and many languages (including the gluing bash scripts), and put it basically unchanged into a controlled, isolated, replicated, shippable environmen…

This is what initially confused me about comparisons between Docker and wasm, as someone who's long been a fan of both. As far as I know, wasm won't let me apt-get install a bunch of stuff, set up cron jobs, glue together miscellaneous bash scripts, and magically run it without containers or VMs on any host architecture. That's the use case I'm most familiar with for Docker; wasm as I knew it was just a neat way to r…

It’s absolutely wild to me that Solomon so fundamentally misunderstands the appeal of Docker.

Re: WebAssembly: Docker Without Containers

#238

Post by cogman10 »

holografix wrote: post #231
mdeeks wrote: post #202

Earlier quoted context omitted.

Genuine question: How much of that financial improvement is due to them requiring companies to now pay for Docker Desktop on macOS? We found ourselves essentially with no option but to pay up for a full year on short notice. We want nothing of their other paid offerings like builds or repo hosting. The sales rep basically confirmed we're just paying for the thing we used to get for free now. The whole call was a gian…

Genuine question: do you think people creating software that’s incredibly valuable for you should’t get paid? You had it for free for a long time? Lucky you!

I don't think anyone has a problem with that.

The problem is really more one of "we operated so long without paying and now, blam, everyone pays next year".

It'd be sort of like if github deciding "You know what, everyone now needs to pay $7 a month/user for github". Perfectly within their right, but also a little bit of whiplash for a large number of people.

The next question is if this will last. There's already competitors to docker (rancher/podman/various k8s on my box things).

Re: WebAssembly: Docker Without Containers

#239

Post by xvector »

vermaden wrote: post #232
erk__ wrote: post #185

Earlier quoted context omitted.

I think that security has always been a goal of FreeBSD jails and I believe they are a bit more hardened than docker

Docker only uses namespaces and cgoups. Docker does not provide and security or isolation. To have security and isolation with Docker you must use something external like SELinux or AppArmor. Hope that helps. Regards.

Docker also uses seccomp.

Re: WebAssembly: Docker Without Containers

#240

Post by jcelerier »

buu700 wrote: post #208
nine_k wrote: post #65

Earlier quoted context omitted.

This sounds incredible, as if the co-founder of Docker fails to understand the crucial value proposition of Docker (hence Docker's financial troubles, maybe). The point of Docker is the ability to take the existing Rube-Goldberg-machine configurations of software, in any and many languages (including the gluing bash scripts), and put it basically unchanged into a controlled, isolated, replicated, shippable environmen…

This is what initially confused me about comparisons between Docker and wasm, as someone who's long been a fan of both. As far as I know, wasm won't let me apt-get install a bunch of stuff, set up cron jobs, glue together miscellaneous bash scripts, and magically run it without containers or VMs on any host architecture. That's the use case I'm most familiar with for Docker; wasm as I knew it was just a neat way to r…

for me the only use of docker is "quickly reproduce whatever $LINUX_DISTRO my users run and make sure that my stuff builds & run on it without having to install a complete VM in virtualbox" ; I also don't really understand how WASM would help with this in any way
Post reply on HN