Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux containers in a few lines of code

zserge.com

Post reply on HN
Print view View original

1–10 of 87 posts

Re: Linux containers in a few lines of code

#2

Post by lidHanteyk »

Nice work. I'm reminded of bocker [0], which also implements this sort of functionality in only a few dozen lines of code. The function which corresponds to this post [1] is relatively short and readable.

[0] https://github.com/p8952/bocker

[1] https://github.com/p8952/bocker/blob/master/bocker#L61-L90

Re: Linux containers in a few lines of code

#4

Post by dmayle »

A little bit of education about container systems in linux[1]. A container system is typically made up a number of components:

isolation layer: the piece that limits privileges and resource usage. (On linux, this is usually handled by cgroups and the kernel, but could also be handled by something like kvm for vm-based containers)

raw container configuration: Given an image and some metadata (like cpu limits), launch an isolated process. (On linux, this is usually handled by runc when working with cgroups)

container api daemon: Manage the list of container processes and available images. Provide a unix socket based API for manipulating isolated processes, launching, deleting, connecting, etc. (In the case of docker, they provide a daemon which abstracts the containerd daemon, or you can use containerd alone without docker)

container command line tool: Provide a user/developer interface to the three things above. This is the docker command. When you install containerd without docker this is the ctr command.

Docker, which is probably the most famous container distribution, pairs the docker command with the docker daemon to abstract away the containerd daemon, runc, and cgroups.

If you use containerd alone, you get ctr/containerd/runc/cgroups.

There's a standalone command line tool (crictl) which replaces both ctr and docker and can be used on top of either the docker daemon or containerd.

[1] Container systems seem to have a relatively complex abstraction over what is a relatively simple architecture.

Re: Linux containers in a few lines of code

#5

Post by ShorsHammer »

DIY Containers on Linux is probably a better term here given that Linux Containers is already heavily in use around the world and included in ubuntu by Canonical?

For me this is enough to get a container running:

    lxd init
    lxc launch ubuntu mycontainer
    lxc exec mycontainer bash
https://linuxcontainers.org/

Re: Linux containers in a few lines of code

#8

Post by throwaway55554 »

ShorsHammer wrote: post #5

DIY Containers on Linux is probably a better term here given that Linux Containers is already heavily in use around the world and included in ubuntu by Canonical? For me this is enough to get a container running: lxd init lxc launch ubuntu mycontainer lxc exec mycontainer bash https://linuxcontainers.org/

I don't know, I find "Linux Containers" to be sufficiently generic as Linux has native support for them. LXD/LXC, Docker, etc, are simply tools built upon that.

Re: Linux containers in a few lines of code

#9

Post by faizshah »

benjaminjosephw wrote: post #3

I love minimal code like this as a way of really understanding how something works. The author is pretty consistent too - he's got some great projects like an ultra-minimal electron alternative: https://github.com/zserge/webview

Same, I really like the book 500 Lines or Less for this as well: https://github.com/aosabook/500lines

I’ve personally been getting in to writing minimal code because I’ve grown frustrated with how simple tasks can result in complex code that’s difficult to maintain. Minimal code is easier to come back to. A 100 line script can be easier to understand than a 500 line script.

Re: Linux containers in a few lines of code

#10

Post by devxpy »

While this is interesting, it doesn't really show how containers actually work, only lists the specific syscall flags to tell Linux create one.

A similar snippet[1] exists for go, and it doesn't do anything particularly special either.

I don't know, maybe David beazley has altered my sense of what "from scratch" means.

[1] https://gist.github.com/lizrice/a5ef4d175fd0cd3491c7e8d71682...

Post reply on HN