Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My VM is lighter (and safer) than your container (2017)

dl.acm.org

Post reply on HN
Print view View original

71–80 of 111 posts

Re: My VM is lighter (and safer) than your container (2017)

#71

Post by mmcnl »

duskwuff wrote: post #60
hinkley wrote: post #56

Earlier quoted context omitted.

What is your theory for why Docker won and Vagrant didn't? Mine is that all of the previous options were too Turing Complete, while the Dockerfile format more closely follows the Principle of Least Power. Power users always complain about how their awesome tool gets ignored while 'lesser' tools become popular. And then they put so much energy into apologizing for problems with the tool or deflecting by denigrating th…

What turned me off from Vagrant was that Vagrant machines were never fully reproducible. Docker took the approach of specifying images in terms of how to create them from scratch. Vagrant, on the other hand, took the approach of specifying certain details about a machine, then trying to apply changes to an existing machine to get it into the desired state. Since the Vagrantfile didn't (and couldn't) specify everythin…

Docker is not fully reproducible either. Try building a Docker image from two different machines and then pushing it to a registry. It will always overwrite.

Re: My VM is lighter (and safer) than your container (2017)

#72

Post by tptacek »

pojzon wrote: post #63
evol262 wrote: post #49

Earlier quoted context omitted.

Virtualization is not just "perceived" security over containerization. From CPU rings on down, it offers dramatically more isolation for security than containerization does. This isn't about 'what most users care' about either. Most users don't really care about 99% of what container orchestration platforms offer. The providers do absolutely care that malicious users cannot punch out to get a shell on an Azure AKS co…

With eBPF there is really not much to argue about in security space. You can do everything. New toolset for containers covers pretty much every possible use-case you could even imagine. The trend will continue in favor of containers and k8s.

It is pretty obviously not the case that eBPF means shared-kernel containers are comparably as secure as VMs; there have been recent Linux kernel LPEs that no system call scrubbing BPF code would have caught, without specifically knowing about the bug first.

Re: My VM is lighter (and safer) than your container (2017)

#73

Post by P5fRxh5kUvp2th »

mmcnl wrote: post #70
xahrepap wrote: post #41

This reminds me: in 2015 I went to Dockercon and one booth that was fun was VMWare's. Basically they had implemented the Docker APIs on top of VMWare so that they could build and deploy VMs using Dockerfiles, etc. I've casually searched for it in the past and it seems to not exist anymore. For me, one of the best parts of Docker is building a docker-image (and sharing how it was done via git). It would be cool to be…

You are talking about declarative configuration of VMs. Vagrant offers that, right?

eeeeeh.......

yes, but then again ... no.

I mean ... yes Vagrant does offer that, but no would I ever consider Vagrant configuration anything approaching a replacement for docker configuration.

Re: My VM is lighter (and safer) than your container (2017)

#74

Post by lstodd »

pojzon wrote: post #64
NorwegianDude wrote: post #62

Earlier quoted context omitted.

I've been using containers since 2007 for isolating workloads. I don't really like Docker for production either because of the network overhead with the "docker-way" of doing things. LXD is definetly my favorite container tool.

How differently LXD manages isolation in comparison to docker ? I suppose both create netns, bridge, ifs ?

It's the same stuff - namespaces, etc. But it doesn't shove greasy fingers into network config like docker. More a tooling question/approach than tech.

Re: My VM is lighter (and safer) than your container (2017)

#76

Post by antod »

pojzon wrote: post #64
NorwegianDude wrote: post #62

Earlier quoted context omitted.

I've been using containers since 2007 for isolating workloads. I don't really like Docker for production either because of the network overhead with the "docker-way" of doing things. LXD is definetly my favorite container tool.

How differently LXD manages isolation in comparison to docker ? I suppose both create netns, bridge, ifs ?

LXC/LXD use the same kernel isolation/security features Docker does - namespaces, cgroups, capabilities etc.

After all, it is the kernel functionality lets you run something as a container. Docker and LXC/LXD are different management / FS packaging layers on top of that.

Re: My VM is lighter (and safer) than your container (2017)

#77

Post by staticassertion »

antod wrote: post #76
pojzon wrote: post #64

Earlier quoted context omitted.

How differently LXD manages isolation in comparison to docker ? I suppose both create netns, bridge, ifs ?

LXC/LXD use the same kernel isolation/security features Docker does - namespaces, cgroups, capabilities etc. After all, it is the kernel functionality lets you run something as a container. Docker and LXC/LXD are different management / FS packaging layers on top of that.

I assume it's not using seccomp, which Docker uses, although seccomp is not Docker specific and you can go grab their policy.

Re: My VM is lighter (and safer) than your container (2017)

#78

Post by nikokrock »

lamontcg wrote: post #55

Containers should really be viewed as an extension of packages (like RPM) with a bit of extra sauce with the layered filesystem, a chroot/jail and cgroups for some isolation between different software running on the same server. Back in 2003 or so we tried doing this with microservices that didn't need an entire server with multiple different software teams running apps on the same physical image to try to avoid givi…

I don’t remember where i read it but as far as i know when using Fargate to run containers (with k8s or ecs) AWS will just allocate an ec2 instance for you. Your container will never run on the same vm as other customer. This explain i think the latency you can have to start a container. To improve that you need to handle your own ec2 cluster with an autoscaling group

Re: My VM is lighter (and safer) than your container (2017)

#79

Post by eyberg »

gavinray wrote: post #39

The issue with unikernels and things like Firecracker are that you can't run them on already-virtualized platforms I researched Firecracker when I was looking for an alternative to Docker for deploying FaaS functions on an OpenFaaS-like clone I was building It would have worked great if the target deployment was bare metal but if you're asking a user to deploy on IE an EC2 or Fargate or whatnot, you can't use these t…

This is a very common misunderstanding in how these actually get deployed in real life.

Disclosure: I work with the OPS/Nanos toolchain so work with people that deploy unikernels in production.

When we deploy them to AWS/GCP/Azure/etc. we are not managing the networking/storage/etc. like a k8s would do - we push all that responsibility back onto the cloud layer itself. So when you spin up a Nanos instance it spins up as its own EC2 instance with only your application - no linux, no k8s, nothing. The networking used is the networking provided by the vpc. You can configure it all you want but you aren't managing it. Now if you have your own infrastructure - knock yourselves out but for those already in the public clouds this is the preferred route. We essentially treat the vm as the application and the cloud as the operating system.

This allows you to have a lot better performance/security and it removes a ton of devops/sysadmin work.

Re: My VM is lighter (and safer) than your container (2017)

#80

Post by bgm1975 »

faeriechangling wrote: post #58

What I see happening now on the cloud is containers from different companies and different security domain running on the same VM. I have to think this is fundamentally insecure and that VMs are underrated. I hear people advocate QubesOS for security which is based on XEN when it comes to running my client. They say my banking should be done in a different VM than my email for instance. Well if that’s the case, why d…

Doesn’t AWS use firecracker with its Fargate container service (and lambda too)?
Post reply on HN