Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Build a Container Image from Scratch

danishpraka.sh

Post reply on HN
Print view View original

51–60 of 60 posts

Re: Build a Container Image from Scratch

#51

Post by godelski »

prmoustache wrote: post #29
godelski wrote: post #19

Earlier quoted context omitted.

Sorry. I agree, but that's a different question. I'll circle back to that then. Why don't technical people make these interfaces, giving the same love to user experience that something like Docker gets. As you said, it is scriptable, and I think -- us all being programmers here -- we all know that means you can just make the interface easier.

Are you implying that docker or podman hasn't been made by _technical people_?

No? I'm not sure I follow. I wouldn't say Apple wasn't made by technical people either. Saying technical people frequently ignore the importance of design does not mean that anyone who recognizes the importance of design is non technical

Re: Build a Container Image from Scratch

#52

Post by godelski »

magicalhippo wrote: post #47
godelski wrote: post #7

I often wonder, why isn't systemd-nspawn[0] used more often? It's self-described as "chroot on steroids". IME it pretty much lives up to that name. Makes it really easy to containerize things and since it integrates well with systemd you basically don't have to learn new things. I totally get these are different tools and I don't think nspawn makes docker or podman useless, but I do find it interesting that it isn't…

> Say, your random self-hosted server thing that isn't escaping your LAN (e.g. Jellyfin or anything like this) I tried reading your link but I'm none the wiser, so perhaps you could provide the docker-equivalent one-liner to start a Jellyfin instance using systemd-nspawn?

There isn't a one liner because no one has built it. Which you be clear, this also had to be done for docker.

I'll admit, the documentation to really anything systemd kinda sucks but awareness can help change that

Re: Build a Container Image from Scratch

#54

Post by godelski »

bionsystem wrote: post #32
godelski wrote: post #7

I often wonder, why isn't systemd-nspawn[0] used more often? It's self-described as "chroot on steroids". IME it pretty much lives up to that name. Makes it really easy to containerize things and since it integrates well with systemd you basically don't have to learn new things. I totally get these are different tools and I don't think nspawn makes docker or podman useless, but I do find it interesting that it isn't…

What is the advantage of nspawn vs lxc ? I use lxc extensively at the moment to test ansible recipes and it works pretty well even though I'm constrained on an old version.

It uses the host kernel so you can get better performance. You can also do all the resource and capability management that you can do with systemd, so you have a bit more control over the level of consainerization and resource management

Re: Build a Container Image from Scratch

#55

Post by magicalhippo »

godelski wrote: post #52
magicalhippo wrote: post #47

Earlier quoted context omitted.

> Say, your random self-hosted server thing that isn't escaping your LAN (e.g. Jellyfin or anything like this) I tried reading your link but I'm none the wiser, so perhaps you could provide the docker-equivalent one-liner to start a Jellyfin instance using systemd-nspawn?

There isn't a one liner because no one has built it. Which you be clear, this also had to be done for docker. I'll admit, the documentation to really anything systemd kinda sucks but awareness can help change that

Ok, so I misread your question.

You're asking why hasn't anyone made something like Docker but with systemd-nspawn as the runtime or "engine".

edit: Found this article[1], which tries to do just that. Still not as convenient as Docker, but doesn't look terrible either.

[1]: https://benjamintoll.com/2022/02/04/on-running-systemd-nspaw...

Re: Build a Container Image from Scratch

#56

Post by godelski »

magicalhippo wrote: post #55
godelski wrote: post #52

Earlier quoted context omitted.

There isn't a one liner because no one has built it. Which you be clear, this also had to be done for docker. I'll admit, the documentation to really anything systemd kinda sucks but awareness can help change that

Ok, so I misread your question. You're asking why hasn't anyone made something like Docker but with systemd-nspawn as the runtime or "engine". edit: Found this article[1], which tries to do just that. Still not as convenient as Docker, but doesn't look terrible either. [1]: https://benjamintoll.com/2022/02/04/on-running-systemd-nspaw...

Yeah, definitely there is a big difference between something being technically better (or worse) and the actual usability of a thing. We have a long history of products that are not technically better winning out (for many reasons). I'm confident nspawn doesn't have nearly the attention and even few people know about it. Docs definitely suck. But we're also on a very technical forum, not a general audience one, so I kinda assume a context that people here are not as concerned about the user interface.

Re: Build a Container Image from Scratch

#57

Post by magicalhippo »

godelski wrote: post #56
magicalhippo wrote: post #55

Earlier quoted context omitted.

Ok, so I misread your question. You're asking why hasn't anyone made something like Docker but with systemd-nspawn as the runtime or "engine". edit: Found this article[1], which tries to do just that. Still not as convenient as Docker, but doesn't look terrible either. [1]: https://benjamintoll.com/2022/02/04/on-running-systemd-nspaw...

Yeah, definitely there is a big difference between something being technically better (or worse) and the actual usability of a thing. We have a long history of products that are not technically better winning out (for many reasons). I'm confident nspawn doesn't have nearly the attention and even few people know about it. Docs definitely suck. But we're also on a very technical forum, not a general audience one, so I…

> But we're also on a very technical forum, not a general audience one, so I kinda assume a context that people here are not as concerned about the user interface.

I think that's a common mistake. I'm fairly highly technical compared to your average user, but I don't have that much higher tolerance to friction for stuff that's not my core concern.

Poor UX is definitely friction, and system administration is seldom my core concern. I'm fairly certain I'm not unique.

Re: Build a Container Image from Scratch

#58

Post by m463 »

mdaniel wrote: post #8
m463 wrote: post #4

Earlier quoted context omitted.

I learned about $_ echo abc && echo $_ abc abc except it's used with wget... wget URL && tar -xvf $_ does this work? Shouldn't tar take a filename? hmm... also, it says there is an alpine layer with "FROM scratch"??

It's not an alpine layer, it's a Dockerfile construct representing basically an empty tar file layer: https://docs.docker.com/build/building/base-images/#create-a... > and https://github.com/moby/moby/pull/8827 >

He says:

  FROM scratch

  COPY ./hello /root/

  ENTRYPOINT ["./hello"]
> Here, our image contains 2 layers. The first layer comes from the base image, the alpine official docker image i.e. the root filesystem with all the standard shell tools that come along with an alpine distribution.

But I thought "FROM scratch" was an empty container, while "FROM alpine" is a container with alpine libs/executables.

otherwise using "FROM scratch" to populate for example an ubuntu image would pollute the container.

Re: Build a Container Image from Scratch

#59

Post by godelski »

magicalhippo wrote: post #57
godelski wrote: post #56

Earlier quoted context omitted.

Yeah, definitely there is a big difference between something being technically better (or worse) and the actual usability of a thing. We have a long history of products that are not technically better winning out (for many reasons). I'm confident nspawn doesn't have nearly the attention and even few people know about it. Docs definitely suck. But we're also on a very technical forum, not a general audience one, so I…

> But we're also on a very technical forum, not a general audience one, so I kinda assume a context that people here are not as concerned about the user interface. I think that's a common mistake. I'm fairly highly technical compared to your average user, but I don't have that much higher tolerance to friction for stuff that's not my core concern. Poor UX is definitely friction, and system administration is seldom my…

I definitely explained that poorly. I was in the middle of some other work and typed too quickly. I'm sorry.

I more mean that technical people tend to be more willing to slug through a poor UX if the tool is technically better. I mean we are all programmers here, right? Programming is a terrible UX, but it is the best thing we got to accomplish the things we want. I'm saying that these people are often the first adopters, more willing to try new things. Of course, this doesn't describe every technical person, but the people willing to do these things are a subset of the technical group.

I definitely see UX as a point of friction and I do advocate for building good interfaces. I actually think it is integral to building things that are also performant and better from a purely technical perspective. I feel that as engineers/developers/researchers we are required to be a bit grumpy. Our goal is to improve things, to make new things, right? One of the greatest means of providing direction to that is being frustrated by existing things lol. Or as Linus recently said: "I'm just fixing potholes." If everything is alright then there's nothing to improve, so you gotta be a little grumpy. It's just about being the right kind of grumpy lol

Re: Build a Container Image from Scratch

#60

Post by guappa »

mdaniel wrote: post #49
guappa wrote: post #42

Earlier quoted context omitted.

I see you're not aware of `mknod`? > Is it possible to do container escapes on occasion? Yes, but each of those is a bug in the Linux kernel that is assigned a CVE and fixed. No bug, if you have permissions to run mknod it's an entirely by design escape that docker lets you do :) I wasn't talking about kernel bugs, of course there have been a lot of those causing escapes. I am talking about the default configuration…

> I see you're not aware of `mknod`? Try harder, friend, those require granted capabilities $ PAGER=cat man 7 capabilities | grep -C1 MKNOD CAP_MKNOD (since Linux 2.4) Create special files using mknod(2). $ docker run --rm -it public.ecr.aws/docker/library/ubuntu:24.04 /usr/bin/mknod fred b 252 4 /usr/bin/mknod: fred: Operation not permitted

It'd be interesting to know what's in your /etc docker configuration :)
Post reply on HN