Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tiny Linux distro that runs the entire OS as Docker containers

github.com

Post reply on HN
Print view View original

51–60 of 177 posts

Re: Tiny Linux distro that runs the entire OS as Docker containers

#51

Post by gtrevorjay »

wmf wrote: post #43
frik wrote: post #20

Earlier quoted context omitted.

I am starting to wonder, why not just execute processes directly with cgroups commands? $ cgcreate -g memory,cpu:groupname/foo $ cgexec -g memory,cpu:groupname/foo bash https://wiki.archlinux.org/index.php/cgroups It's the bare basic that libvirt and Docker et al are based anyway. So if you want to run just one process per "container" it seems rather logical to keep it simple and use cgroups commands directly. (Simil…

systemd already puts each service in a separate cgroup AFAIK, so commands like cgexec aren't even needed. I suspect people are more interested in namespace separation, but recent versions of systemd can also do that [1]. I don't think systemd has image management so that's still a reason to use Docker. [1] https://www.freedesktop.org/software/systemd/man/systemd.exe...

In the case of system services, it is probably acceptable (perhaps even ideal) to leave the image management up to deb, RPM, or ostree. systemd shouldn't do everything :) .

Re: Tiny Linux distro that runs the entire OS as Docker containers

#52

Post by hobarrera »

I'd really love to see some of this stuff transition to the desktop too.

Like, for example, containerize Skype, so that it can't read my home. Or contain Firefox to just read `~/.mozilla` and `~/downloads`.

For binary blobs I don't trust that much, I'd really value this.

For FLOSS stuff, it still provides protection from bugs.

Re: Tiny Linux distro that runs the entire OS as Docker containers

#53

Post by mschuster91 »

cookiecaper wrote: post #25
gtirloni wrote: post #13

Earlier quoted context omitted.

Could you elaborate on the instability concerns? What kind of workload are you running on containers?

Sure. Here's one example that I've dealt with in the last week. We have a server that receives the logs from our kubernetes cluster via fluentd and parses/transforms them before shipping them out to a hosted log search backend thingy. This host has 5 Docker containers running fluentd receivers. This works OK most of the time, but in some cases, particularly cases when the log volume is high and/or when a bug causes e…

> You get to pay for space in a Docker Registry?

Nonsense. You can run your private Docker registry or if you want to support stuff like authentication and access control use Sonatype Nexus. Both open source.

> but you can also do this just fine without Docker

Not as easily. You'd need to use VMs with all their associated costs (especially if you use VMware) to provide proper isolation, and the hosting department usually will have day-long phone calls with the devs to get the software to reproducibly run, and god forbid there's an upgrade in a OS library. No problem there with Docker, as the environment to the software is complete and consistent (and if done right, immutable).

Re: Tiny Linux distro that runs the entire OS as Docker containers

#54

Post by eikenberry »

cookiecaper wrote: post #41
eikenberry wrote: post #35

Earlier quoted context omitted.

I think you are suffering a bit from the over-engineering of Kubernetes and Docker and throwing the baby out with the bath water. Containers in general are great for simplifying deployment, development and testing. We use docker currently and it works great, but we are using just docker and using it only as a way to simplify the above. We are deploying 1 application to 1 system (EC2 via ASG). There is also nothing ke…

Sure, I agree that both Docker and k8s (at some level, k8s probably had to have a lot of that complexity to interface with Docker) are overengineered, and that there are better containerization processes/runtimes. But I still don't think containers are what most people want. People need/want ultra-lightweight VMs with atomized state. NixOS looks promising but I haven't used it yet. It seems to give you a way to deter…

All I want is a way to encapsulate an application and its dependencies as a single artifact that I can run, test and deploy. Right now containers are the best way to achieve this but I'll probably be happy with any solution to this problem.

NixOS does look interesting and I've considered playing with it for personal projects, but IMO it is still to fringe for use at work where you need both technical usefulness and a general consensus that it is appropriate (i.e. mindshare).

Re: Tiny Linux distro that runs the entire OS as Docker containers

#55

Post by wasted_intel »

hobarrera wrote: post #52

I'd really love to see some of this stuff transition to the desktop too. Like, for example, containerize Skype, so that it can't read my home. Or contain Firefox to just read `~/.mozilla` and `~/downloads`. For binary blobs I don't trust that much, I'd really value this. For FLOSS stuff, it still provides protection from bugs.

Look at http://flatpak.org for precisely that.

Re: Tiny Linux distro that runs the entire OS as Docker containers

#56

Post by mmrezaie »

Probably it was not the vision of these types of projects, but this reminds me a lot of Qubes OS[1]. I actually have occasionally used docker (lxc) to run some applications that I was not trusting, and I was controlling them using cgroups. Right now my chrome browser is running like that.

[1] https://www.qubes-os.org/

Re: Tiny Linux distro that runs the entire OS as Docker containers

#57

Post by rhizome »

cookiecaper wrote: post #27
frik wrote: post #23

Earlier quoted context omitted.

The concept itself is simple. The complexity is added by the API layer. https://en.wikipedia.org/wiki/Cgroups https://en.wikipedia.org/wiki/FreeBSD_jail https://en.wikipedia.org/wiki/Solaris_Containers (more general: https://en.wikipedia.org/wiki/Security-Enhanced_Linux , https://en.wikipedia.org/wiki/Sandbox_(computer_security) )

Yeah, I agree and I think that FreeBSD jails in particular are much better (to be fair, I am not very well informed on Solaris Zones, so maybe they're the best). They are certainly much less ostentatious and do not try to redo everything for their own little subworld like Kubernetes does. I sat down one day to try to write down what would make Linux containers/orchestration usable and good, and realized after about 2…

What people really want are true VMs nearly as lightweight and efficient as containerized systems

Like what QubesOS is trying to do?

Re: Tiny Linux distro that runs the entire OS as Docker containers

#58

Post by darren0 »

rcarmo wrote: post #45
darren0 wrote: post #39

Creator of RancherOS here. Thanks for the interest in our tiny distro. RancherOS was created the beginning of 2015 and at the time was quite a novel concept. We strived to not just use container technologies in a Linux distro but actually package everything as standard Docker containers. Fast forward two years, what we were doing back then is now becoming the accepted practice. Most major distro are adopting more con…

Will there be an ARM version?

We released some versions for ARM but in the end ARM requires too much effort to support right now. As ARM64 matures and Docker gets full multi arch image support we'll revisit this.

Re: Tiny Linux distro that runs the entire OS as Docker containers

#60

Post by dkarapetyan »

I have to say this enrages me. The system services are still privileged containers and we are now basically emulating a micro-kernel (very badly I might add with a monolithic kernel). If you want to use a micro-kernel then use a fucking micro-kernel. Hacking a micro-kernel with docker is not the right approach, especially given the stability track record of docker itself. It's a hack and aesthetically unpleasant on all sorts of levels. Not the least of which is that docker itself is one giant hack.
Post reply on HN