About Containers and VMs • Hacker News Board

Re: About Containers and VMs

#41

Post by pxc » Thu, Aug 28, 2025, 5:36 AM UTC

jiggawatts wrote: post #5

weikju wrote: post #3

Earlier quoted context omitted.

On incus/lxd is true there containers can only be Linux.. Not sure about the one app thing but that’s the general design of those ad well I suppose.

Which just validates my point that a generic-sounding domain is the wrong place to host content that even within the Linux ecosystem is a relatively minor player.

Not only is this project website older than Docker, early versions of Docker literally used LXC as the backend, which was supported in Docker for the first two years of its life.

The Docker folks could have done their work under this umbrella and (maybe for good reasons) chose not to. For later container runtimes, idk the story.

But this project/community definitely laid the groundwork for all of those later Linux container runtimes.

Re: About Containers and VMs

#42

Post by Kudos » Thu, Aug 28, 2025, 5:43 AM UTC

9dev wrote: post #10

cyberge99 wrote: post #8

Earlier quoted context omitted.

I’m not sure I follow. Are you suggesting OP has an incorrect apex domain name?

It’s like selling Pepsi exclusively on soda.org.

For that analogy to hold, Pepsi would have also invented sodas.

Re: About Containers and VMs

#43

Post by johncolanduoni » Thu, Aug 28, 2025, 5:44 AM UTC

eru wrote: post #33

01HNNWZ0MV43FF wrote: post #28

Earlier quoted context omitted.

In my experience TCG (or any method that doesn't require root / admin power) is pretty slow. But I'd be happy to be wrong about that, for an odd project I have

It depends a bit on your workload. If you have a pure computation workload, without much IO, TCG etc doesn't need to be slow.

It also depends on the architectures. x86 on ARM is tough to do efficiently because of the memory model differences. One of the keys to Rosetta 2 being so good was being able to make the underlying ARM processor obey the x86 memory model (even though it was still executing ARM instructions).

Re: About Containers and VMs

#44

Post by jeltz » Thu, Aug 28, 2025, 5:46 AM UTC

9dev wrote: post #10

cyberge99 wrote: post #8

Earlier quoted context omitted.

I’m not sure I follow. Are you suggesting OP has an incorrect apex domain name?

It’s like selling Pepsi exclusively on soda.org.

Only if Pepsi had always been called Soda Co and was older than Coca Cola.

Re: About Containers and VMs

#45

Post by johncolanduoni » Thu, Aug 28, 2025, 5:50 AM UTC

reilly3000 wrote: post #21

Can someone explain how a system container is more secure than an application container, if that is indeed the case?

It mostly isn't. Almost all Linux container escapes only require the ability to make system calls to the shared kernel from processes inside the container. The system container doesn't really restrict this ability. It also increases surface area to compromise the container before attacking the host system, since there's now a bunch of extra software running inside the container.

If privilege isolation is a priority but you want to use containers, gVisor and Firecracker are way ahead of anything else. The Linux kernel API has proved to be very hard to secure, and not for lack of trying.

Re: About Containers and VMs

#46

Post by mdaniel » Thu, Aug 28, 2025, 5:52 AM UTC

paulhart wrote: post #15

skywhopper wrote: post #12

What is this? Docker containers can host more than one process/service/app. And why is some product called “Incus” using “linuxcontainers.org” as a domain name?

According to their Github page, they _are_ linuxcontainers (in a way), and Incus is Apache licensed: Incus, which is named after the Cumulonimbus incus or anvil cloud started as a community fork of Canonical's LXD following Canonical's takeover of the LXD project from the Linux Containers community. The project was then adopted by the Linux Containers community, taking back the spot left empty by LXD's departure. Inc…

Supported by Colima, too: https://github.com/abiosoft/colima/blob/main/README.md#incus

Re: About Containers and VMs

#47

Post by pjmlp » Thu, Aug 28, 2025, 6:59 AM UTC

jiggawatts wrote: post #2

It's a bad sign that the first table on the page is full of errors. "Can only host Linux" -- Windows Containers are a thing too: https://learn.microsoft.com/en-us/virtualization/windowscont... "Can host a single app" -- not true either. It's just bad practice to host multiple apps in a single container, but it's definitely possible . IMHO it's not very nice to use the generic-sounding "linuxcontainers.org" domain exc…

Not only that, containers predate Linux implementations, I was using HP-UX Vaults in 1999.

Re: About Containers and VMs

#48

Post by 9dev » Thu, Aug 28, 2025, 7:00 AM UTC

Kudos wrote: post #42

9dev wrote: post #10

Earlier quoted context omitted.

It’s like selling Pepsi exclusively on soda.org.

For that analogy to hold, Pepsi would have also invented sodas.

Like that matters to consumers? Regardless of who invented sodas, the market has changed and people connect more brands to the kind of drink now, so equating Pepsi to Soda is factually incorrect.

Re: About Containers and VMs

#49

Post by scottyeager » Thu, Aug 28, 2025, 7:02 AM UTC

Incus is really nice. It manages to provide a rather container-like experience for VMs. Having the ability to grab a shell on or copy files to/from a VM with the ease of using Docker is a great quality of life improvement. This requires an agent running in the VM but it's already included in the images from the project repo.

Re: About Containers and VMs

#50

Post by aitchnyu » Thu, Aug 28, 2025, 7:25 AM UTC

skywhopper wrote: post #12

What is this? Docker containers can host more than one process/service/app. And why is some product called “Incus” using “linuxcontainers.org” as a domain name?

Are (self hosting) people putting multiple services like Django app, Postgres, Redis etc into a single container/lightweight VM instead of using Docker Compose with single-purpose containers?