Not surprising that VMs running unikernels are as nimble as containers, but not quite useful either, at least in general. Much easier to just use a stock docker image.
My VM is lighter (and safer) than your container (2017)
61–70 of 111 posts
Re: My VM is lighter (and safer) than your container (2017)
#62I'm quite interested in seeing where slim VM's go. Personally I don't use Kubernetes, it just doesn't fit my client work which is nearly all single-server and it makes more sense to just run podman systemd units or docker-compose setups. So from that perspective, when I've peeked at firecracker, kata containers, etc, the "small dev dx" isn't quite there yet, or maybe never will get there since the players target othe…
I've been using containers since 2007 for isolating workloads. I don't really like Docker for production either because of the network overhead with the "docker-way" of doing things.
LXD is definetly my favorite container tool.
Re: My VM is lighter (and safer) than your container (2017)
#63Earlier quoted context omitted.
They went to trash because containers are more convenient to use and saving few MBs of disk/memory is not what most users care. The whole idea was pretty much either use custom kernel (which inevitably have way less info on how to debug anything in it), and re-do all of the network and storage plumbing containers already do via the OS they are running one. OR just very slim linux one which at least people know how to…
Virtualization is not just "perceived" security over containerization. From CPU rings on down, it offers dramatically more isolation for security than containerization does. This isn't about 'what most users care' about either. Most users don't really care about 99% of what container orchestration platforms offer. The providers do absolutely care that malicious users cannot punch out to get a shell on an Azure AKS co…
With eBPF there is really not much to argue about in security space.
You can do everything.
New toolset for containers covers pretty much every possible use-case you could even imagine.
The trend will continue in favor of containers and k8s.
Re: My VM is lighter (and safer) than your container (2017)
#64I'm quite interested in seeing where slim VM's go. Personally I don't use Kubernetes, it just doesn't fit my client work which is nearly all single-server and it makes more sense to just run podman systemd units or docker-compose setups. So from that perspective, when I've peeked at firecracker, kata containers, etc, the "small dev dx" isn't quite there yet, or maybe never will get there since the players target othe…
I've been using containers since 2007 for isolating workloads. I don't really like Docker for production either because of the network overhead with the "docker-way" of doing things. LXD is definetly my favorite container tool.
How differently LXD manages isolation in comparison to docker ?
I suppose both create netns, bridge, ifs ?
Re: My VM is lighter (and safer) than your container (2017)
#65Why is a 5yr old article being posted now? If this were to catch on, it would've. I just dont see it being used anywhere.
Having a full Linux kernel available is a major benefit that you lose, right?
Re: My VM is lighter (and safer) than your container (2017)
#66Title is kinda clickbaity (wha-? how can a VM be lighter than a container). It's about unikernels.
> how can a VM be lighter than a container It's still clickbaity, but the title implies a comparison between a very lightweight VM and a heavy-weight container (presumably a container based on a full Linux distro). You could imagine an analogous article about a tiny house titled "my house is smaller than your apartment".
Not to mention, in the paper, the lightvm only had an advantage on boot times. Menory usage was marginally worse than docker, even with the unikernel, and debian on lightvm was drastically worse for cpu usage than docker (the unikernel cpu usage was neck and neck with the debian docker contaner).
I could see it being an improvement over other VM control planes, but docker still wins in performance for any equivalant comparisons.
Re: My VM is lighter (and safer) than your container (2017)
#67Earlier quoted context omitted.
Virtualization is not just "perceived" security over containerization. From CPU rings on down, it offers dramatically more isolation for security than containerization does. This isn't about 'what most users care' about either. Most users don't really care about 99% of what container orchestration platforms offer. The providers do absolutely care that malicious users cannot punch out to get a shell on an Azure AKS co…
in a related vein, most of the distinctions that are being brought up around containers vs vms (pricing, debugability, tooling, overhead) are nothing fundamental at all. they are both executable formats that cut at different layers, and there is really no reason why features of one can't be easily brought to the other. operating above these abstractions can save us time, but please stop confusing the artifacts of imp…
Bringing the features of one to the other is exactly what microvms means.
Re: My VM is lighter (and safer) than your container (2017)
#68Earlier quoted context omitted.
Virtualization is not just "perceived" security over containerization. From CPU rings on down, it offers dramatically more isolation for security than containerization does. This isn't about 'what most users care' about either. Most users don't really care about 99% of what container orchestration platforms offer. The providers do absolutely care that malicious users cannot punch out to get a shell on an Azure AKS co…
With eBPF there is really not much to argue about in security space. You can do everything. New toolset for containers covers pretty much every possible use-case you could even imagine. The trend will continue in favor of containers and k8s.
Let me know when eBPF can probe into ring-1 hypercalls into a different kernel other than generically watching timing from vm_enter and vm_exit.
Yes, there is a difference between "eBPF can probe what is happening in L0 of the host kernel" and "you can probe what is happening in other kernels in privileged ring-1 calls".
No, this is not what you think it is.
Re: My VM is lighter (and safer) than your container (2017)
#69Earlier quoted context omitted.
Virtualization is not just "perceived" security over containerization. From CPU rings on down, it offers dramatically more isolation for security than containerization does. This isn't about 'what most users care' about either. Most users don't really care about 99% of what container orchestration platforms offer. The providers do absolutely care that malicious users cannot punch out to get a shell on an Azure AKS co…
With eBPF there is really not much to argue about in security space. You can do everything. New toolset for containers covers pretty much every possible use-case you could even imagine. The trend will continue in favor of containers and k8s.
I'm not sure what you mean with regards to eBPF but the difference between a container and a VM is massive with regards to security. Incidentally, my company just published a writeup about Firecracker: https://news.ycombinator.com/item?id=32767784
Re: My VM is lighter (and safer) than your container (2017)
#70This reminds me: in 2015 I went to Dockercon and one booth that was fun was VMWare's. Basically they had implemented the Docker APIs on top of VMWare so that they could build and deploy VMs using Dockerfiles, etc. I've casually searched for it in the past and it seems to not exist anymore. For me, one of the best parts of Docker is building a docker-image (and sharing how it was done via git). It would be cool to be…
You are talking about declarative configuration of VMs. Vagrant offers that, right?