Drawbridge • Hacker News Board

Re: Drawbridge

#41

Post by StillBored » Thu, Sep 04, 2014, 5:43 AM UTC

markbnj wrote: post #3

Seems like Microsoft's response to docker, although I have no idea if it actually is, in terms of precedence. But certainly aimed at the same idea.

I'm not sure that is true. Beside App-v, windows has a number of mature 3rd party application virtualization/sandbox/container products as well.

What does docker do, that app-v can't?

Re: Drawbridge

#42

Post by wslh » Fri, Sep 05, 2014, 2:21 PM UTC

StillBored wrote: post #40

wslh wrote: post #9

It is important to note how this will shake the current state of the application virtualization market. There is no docker like solution for Windows. All the big players (VMware, Microsoft, Symantec, etc) do tricks to isolate the applications. The tricks are instrumenting API calls and adding filtering drivers. With these solutions only less than 70% can be virtualized and the process can be really difficult.

Hu? Can you elaborate on what you mean by this (app-v, and other windows sandbox/package tools) not being as complete as docker? Because from what I've seen of the current state of docker, non trivial linux applications seem to have issues in docker as well because they depend on specific things which are not being namespaced well (say /sys manipulations for example, ioctls, or even use filesystem specific APIs). Doc…

Yes, it is very simple. Docker.io uses LXC where the virtualization layer occurs at the kernel space while applications such as VMware ThinApp and others occur at the user level intercepting Windows APIs which are at a higher level than the kernel. App-V and SWV adds a filtering driver as a way to sandbox registry and filesystem.

One difference in the approach is that, for example, with Docker.io you can have your own isolate network interface while with the current Windows approach this is not possible.

Re: Drawbridge

#43

Post by wslh » Fri, Sep 12, 2014, 7:32 PM UTC

StillBored wrote: post #41

markbnj wrote: post #3

Seems like Microsoft's response to docker, although I have no idea if it actually is, in terms of precedence. But certainly aimed at the same idea.

I'm not sure that is true. Beside App-v, windows has a number of mature 3rd party application virtualization/sandbox/container products as well. What does docker do, that app-v can't?

I discussed that here https://news.ycombinator.com/item?id=8258032

Re: Drawbridge

#44

Post by shaurz » Sat, Sep 13, 2014, 1:51 PM UTC

iNate2000 wrote: post #20

shaurz wrote: post #15

Earlier quoted context omitted.

I would welcome a new Windows API to replace Win32. Not sure if they would ever expose it or continue with the old legacy crap.

I thought that Microsoft intended WinRT to replace Win32...

I had the impression that you couldn't make desktop apps with WinRT?

Re: Drawbridge

#45

Post by markbnj » Sat, Sep 13, 2014, 7:58 PM UTC

justincormack wrote: post #37

jpgvm wrote: post #34

Earlier quoted context omitted.

Docker is not anything, Docker is a wrapper for cgroups and namespaces - also utilized by LXC. Infact, Docker started as a wrapper around LXC. It literally configured and shelled out to lxc-start in order to orchestrate containers. This however, is much much different to cgroups/namespaces. What the Drawbridge paper describes is a full user-mode kernel . If you want the analagous implementation on Linux look at User…

Or look at the netbsd rump kernel ( http://rumpkernel.org ) which also runs under Linux or standalone.

Thanks for this comment. I had some time to read through this pdf (http://lib.tkk.fi/Diss/2012/isbn9789526049175/isbn9789526049...) and I have a much better understanding of the differences between a user-space kernel and containers now.