Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS EC2 Container Service

aws.amazon.com

Post reply on HN
Print view View original

41–50 of 90 posts

Re: AWS EC2 Container Service

#41

Post by SEJeff »

shykes wrote: post #40
SEJeff wrote: post #33

Earlier quoted context omitted.

Don't worry Solomon, we still love Docker and will continue to use it :) That being said, if they do somehow manage to get hardware assisted containment for containers, I see it as a no-brainer for docker to adopt it as soon as it is reasonably possible. Are there any plans (that you can speak of) regarding something like this, or are you waiting for LXD to be more than vaporware at this point?

I can say that there are employees of major silicon companies already working on contributing all of this to upstream Docker. I was shown a real proof of concept already, it's very promising and not at all vaporware :)

Perhaps once the pax guys (spender in specific) will stop trolling docker and containers in general for once! We can hope.

Re: AWS EC2 Container Service

#42

Post by dividuum »

kalgen wrote: post #18
St-Clock wrote: post #7

Security-wise, if I understand correctly, this is a very interesting offering. 1. The containers live on "your" VMs so you get the isolation of a virtual machine and do not worry about the other tenants' containers. 2. The VMs are part of a "private cloud", i.e., the internal network is not accessible by other tenants' VMs and containers. #2 is what worried me the most in other container service offerings. It's easy…

These are also properties of Google Container Engine. Which other container service offerings were you thinking of?

Digital Ocean has something called "Private Networking" that's internal to the data center but shared with all other customers. It's not obvious from reading the website that this is the case.

Re: AWS EC2 Container Service

#43

Post by Animats »

"All problems in computer science can be solved by another level of indirection" - David Wheeler

That's what "containers" are, of course. There's so much state in OS file namespaces that running any complex program requires "installation" first. That's such a mess that virtual machines were created to allow a custom OS environment for a program. Then that turned into a mess, with, for example, a large number of canned AWS instances to choose from. So now we have another level of indirection, "containers".

Next I expect we'll have container logistics management startups. These will store your container in a cloud-based "warehouse", and will continuously take bids for container execution resources. Containers will be automatically moved around from Amazon to Google to Rackspace, etc. depending on who's offering the lowest bid right now.

Re: AWS EC2 Container Service

#45

Post by tjbiddle »

Animats wrote: post #43

"All problems in computer science can be solved by another level of indirection" - David Wheeler That's what "containers" are, of course. There's so much state in OS file namespaces that running any complex program requires "installation" first. That's such a mess that virtual machines were created to allow a custom OS environment for a program. Then that turned into a mess, with, for example, a large number of canne…

It's amazing to me how much easier the process is for this nowadays. We really live in an exciting time.

Re: AWS EC2 Container Service

#46

Post by eldavido »

Animats wrote: post #43

"All problems in computer science can be solved by another level of indirection" - David Wheeler That's what "containers" are, of course. There's so much state in OS file namespaces that running any complex program requires "installation" first. That's such a mess that virtual machines were created to allow a custom OS environment for a program. Then that turned into a mess, with, for example, a large number of canne…

It's more like a ping-pong. Things start off simply, but over time as the layers of abstraction pile up, things become brittle and unworkable.

I view containers as more of a reworking of a key computational abstraction (VMs) than an evolution of them. We finally have operating systems with enough inter-process isolation, sufficiently capable filesystems (layering), etc. that we can throw out 80% of the other unnecessary junk of VMs like second kernels, duplicate schedulers, endless duplication of standard system libraries, etc.

So it's more like we've hacked/refactored virtualization into a more usable state, and gotten rid of a lot of useless garbage that it turns out we didn't actually need. It's a lot like how a big software system evolves, now that I think about it.

Re: AWS EC2 Container Service

#47

Post by gecko »

rsync wrote: post #37
SEJeff wrote: post #20

Earlier quoted context omitted.

Incorrect, docker is built ontop of Linux kernel namespaces and cgroups. The first backend was LXC (notice the C and not D). The current backend is libcontainer, which is a native golang re-implementation (more or less) of LXC. There is a docker backend for LXC, but it is not the default and is likely not used super heavily. Note that there isn't really a Linux kernel feature called LXC. The LXC userspace just ties a…

Is there a point-by-point (and detailed) comparison somewhere between FreeBSD jail and LXC (or libcontainer) ... it would be very helpful to see that comparison.

I just asked that on Twitter, because I also am not getting it. It seems to me that ZFS and Jails provide identical functionality, but without Docker's networking headache.

That said, even if my simplistic synopsis is correct, brining a Jails-like experience to Linux would still be a really solid step forward. Besides which, Jails have been underutilized at shops I've worked at. If Docker popularized the concept, that's still a huge win.

Re: AWS EC2 Container Service

#48

Post by teacup50 »

Animats wrote: post #43

"All problems in computer science can be solved by another level of indirection" - David Wheeler That's what "containers" are, of course. There's so much state in OS file namespaces that running any complex program requires "installation" first. That's such a mess that virtual machines were created to allow a custom OS environment for a program. Then that turned into a mess, with, for example, a large number of canne…

In this case, the problem isn't being solved -- solving the problem would mean moving away from dependencies on the global OS namespace by relearning how to write self-contained applications (some people never forgot).

Containers are just a big wad of duct tape holding together the ball of mud that comprises most web applications' server-side components.

Add containers, and you haven't solved the problem, you've just made two problems.

Re: AWS EC2 Container Service

#50

Post by SEJeff »

rsync wrote: post #37
SEJeff wrote: post #20

Earlier quoted context omitted.

Incorrect, docker is built ontop of Linux kernel namespaces and cgroups. The first backend was LXC (notice the C and not D). The current backend is libcontainer, which is a native golang re-implementation (more or less) of LXC. There is a docker backend for LXC, but it is not the default and is likely not used super heavily. Note that there isn't really a Linux kernel feature called LXC. The LXC userspace just ties a…

Is there a point-by-point (and detailed) comparison somewhere between FreeBSD jail and LXC (or libcontainer) ... it would be very helpful to see that comparison.

This is actually a pretty reasonable comparison. It is somewhat obvious the guy knows more about BSD Jails and elaborates a bit more on it, but overall, this is pretty accurate:

http://unix.stackexchange.com/a/141595

Post reply on HN