Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RancherOS: An OS for Docker Containers

rancher.com

Post reply on HN
Print view View original

41–50 of 66 posts

Re: RancherOS: An OS for Docker Containers

#41

Post by zwischenzug »

kylek wrote: post #16

Curious if anyone has come up with a way to run X11 itself in a container? (there are numerous articles on running GUI apps in containers that simply need a way to talk to Xauthority or X socket, or using VNC or xpra). I'd imagine it would need to run privileged with access to device files, or something like that. I've kicked around the idea of a "workstation" set of containers to run on top of CoreOS, but this is th…

Here's an example of X11 in a container, with VNC'ing in.

https://zwischenzugs.wordpress.com/2015/02/01/win-at-2048-wi...

original link:

https://zwischenzugs.wordpress.com/2014/05/09/docker-shutit-...

Re: RancherOS: An OS for Docker Containers

#42

Post by vidarh »

progman wrote: post #38

Quote: "At 20MB, RancherOS is two orders of magnitude smaller than a typical Linux distribution, and an order of magnitude smaller than even other minimalist Linux distributions." This claim is incorrect. Linux kernels can actually be as small as around 2 MB. The rest of a working Linux system (GNU, GUI etc.) does not belong to the kernel. http://superuser.com/questions/370586/how-can-a-linux-kernel... A Debian Linux…

Our X "workstations" running Slackware back in the day used to have 16MB RAM. I don't remember how much disk space it had, but probably 300MB-400MB - I do remember 500MB drives were not that common yet.

I've run Linux in embedded systems with 4MB flash and 4MB RAM too.

It's harder to keep Linux slim these days without sacrificing all kinds of things we've gotten accustomed to, but yeah, it's pretty much down to how minimalist you are willing to go rather than how small it is possible to get.

Re: RancherOS: An OS for Docker Containers

#43

Post by vidarh »

tristanz wrote: post #36
akerl_ wrote: post #4

"Systemd and Docker don’t work well together as they both attempt to manage control groups." Has anybody hit actual issues with this? Having used Docker and systemd concurrently for a while, I can't say this has every caused conflicts, any more than the fact that both myself and my guests manage drinks in my fridge.

In my experience it works, but is a mess. You end up with really crazy unit files that aren't actually managing the docker daemon, they're managing the docker client. CoreOS created Rocket in part because the match between docker and systemd is so bad. Rancher seems to be going in the other direction by making Docker support fully native. I do wonder how much this really buys you over a higher level framework like Me…

I wouldn't say the unit files end up "really crazy", but I do agree it is a bit of a mismatch and we lose out on a bit of the advantages of systemd.

Re: the post you refer to, I really don't like his proposed solution of "docker attach | docker start | docker run". I usually do this:

    ExecStartPre=-docker kill %P
    ExecStartPre=-docker rm %P
    ExecStart=docker run --rm --name %p ...
    ExecStop=docker stop %p
Of course that would not apply to any containers used to export volumes, but I tend to mount volumes from the host anyway. But I explicitly want a clean slate when I restart containers.

Re: RancherOS: An OS for Docker Containers

#44

Post by LewisJEllis »

progman wrote: post #38

Quote: "At 20MB, RancherOS is two orders of magnitude smaller than a typical Linux distribution, and an order of magnitude smaller than even other minimalist Linux distributions." This claim is incorrect. Linux kernels can actually be as small as around 2 MB. The rest of a working Linux system (GNU, GUI etc.) does not belong to the kernel. http://superuser.com/questions/370586/how-can-a-linux-kernel... A Debian Linux…

Let's interpret the claim precisely before calling it incorrect.

What it asserts is that there exist some minimalist Linux distros around a few hundred megabytes in size, and this can be shown true merely by example.

The claim notably does not use "all" or "every", so the existence of something smaller does not create a contradiction.

Re: RancherOS: An OS for Docker Containers

#45

Post by vidarh »

jdub wrote: post #14
tipiirai wrote: post #8

How does this differ from CoreOS?

Besides the guts of how the OS platform itself is built and runs, the major feature difference is that it doesn't have all the cluster co-ordination bits like etcd, fleet, and so on.

You can easily run etcd in containers. In fact, at work our etcd deployment are all the official coreos/etcd docker images. Fleet is majorly tied to systemd so that's a different matter.

Re: RancherOS: An OS for Docker Containers

#48

Post by mrmondo »

lclarkmichalek wrote: post #46
mrmondo wrote: post #10

Is SELinux or GRSecurity built in and enabled?

Highly unlikely, given this is a product coming out of the Docker ecosystem.

We run SELinux on all our docker hosts and are about to roll out GRSecurty as well, at present this is one of the best lines of defence you have against running code so close to root.

Re: RancherOS: An OS for Docker Containers

#49

Post by lclarkmichalek »

mrmondo wrote: post #48
lclarkmichalek wrote: post #46

Earlier quoted context omitted.

Highly unlikely, given this is a product coming out of the Docker ecosystem.

We run SELinux on all our docker hosts and are about to roll out GRSecurty as well, at present this is one of the best lines of defence you have against running code so close to root.

A hypervisor is the best defense you can have against running code so close to root
Post reply on HN