Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RancherOS: An OS for Docker Containers

rancher.com

Post reply on HN
Print view View original

51–60 of 66 posts

Re: RancherOS: An OS for Docker Containers

#51

Post by akerl_ »

jdub wrote: post #29
zaius wrote: post #28

Regarding the "Ideal for Production" tagline - how would I go about running this in production? Specifically on linode - would I have to run a "regular" linux and then use kvm to run the rancheros iso?

I don't think you can install and run arbitrary stuff on Linode, so you'd have to convince Linode to provide an OS image for RancherOS. (Or goof around copying stuff onto a disk image.)

You can certainly run arbitrary stuff on a Linode; I'm currently running a custom-built read-only Arch image.

You do have to put it there yourself, but if RancherOS is billing itself as small and easy to update, that seems like it shouldn't be hard.

Re: RancherOS: An OS for Docker Containers

#52

Post by mrmondo »

lclarkmichalek wrote: post #49
mrmondo wrote: post #48

Earlier quoted context omitted.

We run SELinux on all our docker hosts and are about to roll out GRSecurty as well, at present this is one of the best lines of defence you have against running code so close to root.

A hypervisor is the best defense you can have against running code so close to root

It's not quite that simple, an insecure or vulnerable hypervisor can actually make it easier to exploit a system. (Note: I'm not suggesting that running Docker as PID1 or similar is a good idea)

Re: RancherOS: An OS for Docker Containers

#53

Post by carlos22 »

kylek wrote: post #24
Animats wrote: post #22

It's not quite an OS for Docker containers yet. It's a distro with special middleware. The next question is how much can be thrown out of the Linux kernel. Or can it be replaced with something more secure? What would it take to run this in Xen without Linux?

I think running linux containers without linux would be difficult! You probably want Mirage OS or OSv. http://www.openmirage.org/ http://osv.io/

The Joyent guys are running docker in smartos by so called "branded zones". They emulate the Linux Kernel ABI. This works surprisingly well, as they say. See: https://www.joyent.com/developers/videos/docker-and-the-futu...

The cool thing is, that they open sourced the SDC in November 2014.

Re: RancherOS: An OS for Docker Containers

#54

Post by lclarkmichalek »

mrmondo wrote: post #52
lclarkmichalek wrote: post #49

Earlier quoted context omitted.

A hypervisor is the best defense you can have against running code so close to root

It's not quite that simple, an insecure or vulnerable hypervisor can actually make it easier to exploit a system. (Note: I'm not suggesting that running Docker as PID1 or similar is a good idea)

I think it's fair to say that it's easier to secure a hypervisor than it is to secure a Docker daemon. Lord knows we've had a lot more experience securing hypervisors.

Re: RancherOS: An OS for Docker Containers

#55

Post by ehazlett »

titrate wrote: post #34

I've been using Docker since forever and I think I grasp the architecture here. But, my question is, what does this bring to the table that isn't possible with Docker + Machine + Swarm? That's a super important question to ask, because adding another layer to deployments is not something people are wont to do to a system (Docker) that's supposed to put the simplicity back into deployments. Also, since this isn't unde…

I've only played with RancherOS for a very short amount of time so keep that in mind :) I don't think we quite know exactly what it will turn out to be or exactly where it would be most effective. Without going into the technical details (because I'm not the person for that - I'll leave that to rancher), RancherOS isn't just a Docker image. It runs Docker at the core. Not just an OS with Docker in it. This gives it the potential to have an update mechanism similar to CoreOS etc.

You are correct in that it is very similar to boot2docker. boot2docker is also a very light distro with docker (and by "very light" I mean awesome slim -- steeve is amazing :) The main difference, as I see it, is in updating / extending / packages. With TCL, you need to either find the package and include it in your build or create the package with a build chain etc. which isn't trivial. In the RancherOS route, you could simply pull a new docker image.

The interesting thing to me is it offers choice. If you want to run systemd, etcd you can without changing an entire system (i.e. today, if I want Fedora with systemd I have to configure the Docker daemon opts differently than say with Ubuntu).

Re: RancherOS: An OS for Docker Containers

#58

Post by kylek »

TheDong wrote: post #39
kylek wrote: post #16

Curious if anyone has come up with a way to run X11 itself in a container? (there are numerous articles on running GUI apps in containers that simply need a way to talk to Xauthority or X socket, or using VNC or xpra). I'd imagine it would need to run privileged with access to device files, or something like that. I've kicked around the idea of a "workstation" set of containers to run on top of CoreOS, but this is th…

Many people already have run X in a container with no trouble. They often just vnc it out. The hard part is not running X, but running X and having it display to your hardware. This is a massive distinction. You need to passthrough your graphics device so that X can write to its framebuffer and all that bizzazz, and that's the question you really should be asking. "How do I pass my graphics device / display device in…

Right, this is what I actually meant

Re: RancherOS: An OS for Docker Containers

#59

Post by kordless »

labianchin wrote: post #56

I am curious about one thing: how System Docker as PID 1 deals with reaping zombie processes?

From the discussion last night at the Docker meetup, the System Docker is responsible for the reaping of child processes. The comment from the presenter was basically "we sorta expect this (systemd) to be stable and not crash". That said, he also mentioned that it's early work and their actively thinking about solutions to this problem and the ones related to security.

Re: RancherOS: An OS for Docker Containers

#60

Post by kordless »

kylek wrote: post #16

Curious if anyone has come up with a way to run X11 itself in a container? (there are numerous articles on running GUI apps in containers that simply need a way to talk to Xauthority or X socket, or using VNC or xpra). I'd imagine it would need to run privileged with access to device files, or something like that. I've kicked around the idea of a "workstation" set of containers to run on top of CoreOS, but this is th…

Jess at Docker has some examples of setting this up and running various applications using VNC: https://blog.jessfraz.com/posts/docker-containers-on-the-des.... Scroll down a bit toward the middle.
Post reply on HN