Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Execute Docker Containers as QEMU MicroVMs

mergeboard.com

Post reply on HN
Print view View original

51–60 of 66 posts

Re: Execute Docker Containers as QEMU MicroVMs

#51

Post by tptacek »

tyingq wrote: post #27
handrous wrote: post #12

Earlier quoted context omitted.

A while back I did some looking at FreeBSD jails to try to figure out why they don't have more mindshare (especially when paired with the nigh-superpower-granting ZFS). I came away baffled that they weren't more widely-promoted, compared with Docker and friends. After thinking about it for a while, all I can figure is they're so straightforward to use and well-documented that there's no room to make one's name, or to…

If technically best in the container space mattered, Illumos would be everywhere...

People say this a lot too, but Illumos also uses shared-kernel isolation. Linux + gVisor is probably (significantly) superior to it as far as security goes.

Re: Execute Docker Containers as QEMU MicroVMs

#52

Post by rkeene2 »

monocasa wrote: post #43
ashishbijlani wrote: post #24

Earlier quoted context omitted.

No, gVisor is from Google. They emulate system calls in user-space and use VMs, which increases runtime performance overhead. We use hardware virtualization to directly run containers -- no I/O emulation, no expensive VM exits, scale as needed. Initial comparison with FC/GVisor/Xen here: https://github.com/ashishbijlani/kwarantine

I'm not sure gvisor requires vm exits. Their first backend used ptrace very similarly to how user mode Linux worked. Minor quip though since ptrace might even be slower than vm exits; your core point stands.

User Mode Linux is still around and works well. I use it when I need a "fakeroot" without any special privileges on the host.

https://rkeene.org/viewer/tmp/fakeroot.sh.htm

Re: Execute Docker Containers as QEMU MicroVMs

#55

Post by hardwaresofton »

eatonphil wrote: post #2

There are a few existing projects out there like this (running Docker images as virtual machines, specifically) if folks are interested. Slim [0] is the one I can remember off the top of my head. I think there are a couple more. Still, neat to have the walkthrough here in this post. https://github.com/ottomatica/slim

A couple more:

https://github.com/containers/krunvm

https://github.com/weaveworks/ignite

Re: Execute Docker Containers as QEMU MicroVMs

#57

Post by yjftsjthsd-h »

tptacek wrote: post #51
tyingq wrote: post #27

Earlier quoted context omitted.

If technically best in the container space mattered, Illumos would be everywhere...

People say this a lot too, but Illumos also uses shared-kernel isolation. Linux + gVisor is probably (significantly) superior to it as far as security goes.

90%+ of Docker users aren't using gVisor; I don't disagree that it's good, but it feels like an aside.

Re: Execute Docker Containers as QEMU MicroVMs

#59

Post by XorNot »

riobard wrote: post #5

A few years ago I invested in a small startup called `hyper.sh`. It open sourced a container runtime called `runV` which provided exactly this: security of virtual machines plus convenience of containers. The project later merged with Intel Clear Container to become what's now called Kata Containers ( https://katacontainers.io/ ) and is now widely used by several Internet giants like Alibaba and Baidu. The startup wa…

I used runV with drone.io (on top of Media) to run distributed on-demand VM builders for GitHub enterprise (we were building physical machine images to deploy so needed VM isolation).

It actually worked great, and I've struggled to get as quite a flexible CI system at other jobs since then (the big advantage was it looked like Docker, so with compose you could either spin a metal-like nested VM or just pull in some DB containers in your build instance).

Post reply on HN