Show HN: Jetpack, a FreeBSD Jail/ZFS-based container runtime

#1

Post by mpasternacki » Thu, Jan 15, 2015, 5:00 PM UTC

Show HN: Jetpack, a FreeBSD Jail/ZFS-based container runtime
github.com

Re: Show HN: Jetpack, a FreeBSD Jail/ZFS-based container runtime

#2

Post by gaalze » Thu, Jan 15, 2015, 9:39 PM UTC

The best alternative: http://www.7he.at/freebsd/vps/

Jails aren't that great: https://aboutthebsds.wordpress.com/2013/01/13/freebsd-jails-...

But there is Capsicum too: http://lwn.net/Articles/482858/

Re: Show HN: Jetpack, a FreeBSD Jail/ZFS-based container runtime

#3

Post by contingencies » Thu, Jan 15, 2015, 9:52 PM UTC

I'm still working on a generalized system (not OS specific), with ZFS support in there and working. Have begun discussions about open sourcing this with management. In theory it will let people go 'show me this thing on platform and platform, benchmarked'. Platform strengths will then speak for themselves, and platform maintainers will have the same version/build/evaluate loop that regular service developers use. http://stani.sh/walter/pfcts/

Re: Show HN: Jetpack, a FreeBSD Jail/ZFS-based container runtime

#4

Post by mpasternacki » Thu, Jan 15, 2015, 9:57 PM UTC

gaalze wrote: post #2

The best alternative: http://www.7he.at/freebsd/vps/ Jails aren't that great: https://aboutthebsds.wordpress.com/2013/01/13/freebsd-jails-... But there is Capsicum too: http://lwn.net/Articles/482858/

VPS seems to require VIMAGE, which currently is a no-go for me (I experience kernel panic on boot if I compile it in), and the second link… well… the tinfoil hat of the author's blog has to be impressive. I've tried to read this and some other rants (they pop up quite high in search results), and couldn't find any actual content or any sources for the statements.

Capsicum and rctl are definitely on my list of things to look into (especially capsicum, it seems to be enabled in the GENERIC kernel configuration).

Re: Show HN: Jetpack, a FreeBSD Jail/ZFS-based container runtime

#5

Post by Freaky » Thu, Jan 15, 2015, 10:06 PM UTC

gaalze wrote: post #2

The best alternative: http://www.7he.at/freebsd/vps/ Jails aren't that great: https://aboutthebsds.wordpress.com/2013/01/13/freebsd-jails-... But there is Capsicum too: http://lwn.net/Articles/482858/

aboutthebsds.wordpress.com is a well known troll site, don't link to it like it contains anything meaningful.

Re: Show HN: Jetpack, a FreeBSD Jail/ZFS-based container runtime

#6

Post by [deleted] » Thu, Jan 15, 2015, 10:06 PM UTC

[deleted]

Re: Show HN: Jetpack, a FreeBSD Jail/ZFS-based container runtime

#7

Post by derpderp1 » Thu, Jan 15, 2015, 10:07 PM UTC

gaalze wrote: post #2

The best alternative: http://www.7he.at/freebsd/vps/ Jails aren't that great: https://aboutthebsds.wordpress.com/2013/01/13/freebsd-jails-... But there is Capsicum too: http://lwn.net/Articles/482858/

FTR - aboutthebsds.wordpress.com is a well known troll site and nothing on there should be taken seriously..

Re: Show HN: Jetpack, a FreeBSD Jail/ZFS-based container runtime

#8

Post by derpderp1 » Thu, Jan 15, 2015, 10:09 PM UTC

This looks interesting, I'm still holding my breath to see if Joyent are going to bring zfs support to docker though. It looks like they're working on reviving lx branded zones instead which is a bit of a bummer as they are (or were) pretty terrible.

Re: Show HN: Jetpack, a FreeBSD Jail/ZFS-based container runtime

#9

Post by elektronjunge » Thu, Jan 15, 2015, 10:12 PM UTC

gaalze wrote: post #2

The best alternative: http://www.7he.at/freebsd/vps/ Jails aren't that great: https://aboutthebsds.wordpress.com/2013/01/13/freebsd-jails-... But there is Capsicum too: http://lwn.net/Articles/482858/

There's nothing wrong with jails. Its a robust technology that's been battle tested for a decade. They provide lots of awesome features that are useful for reasons other than security. In fact, the primary reason I use jails is not for security at all. And, AFAIK there are no exploits in the wild for jails. Like any containerization or virtualization technology there are theoretical holes. I'd stake a large sum of money that we see major vulnerabilities in LXC/Docker in the next 5 years, we just haven't because they haven't been around as long.

I'd love to see a source for just about anything that blog claims because it reads like FUD and contains some factual inaccuracies like chroot not being in FreeBSD by the time jails were added. It also doesn't seem to understand what the difference between the base and the kernel is in FreeBSD. Jails are implemented similarly to LXC/Docker by having a few syscalls in the kernal for namespace isolation and the bulk of the execution happening in userspace.

Re: Show HN: Jetpack, a FreeBSD Jail/ZFS-based container runtime

#10

Post by duaneb » Thu, Jan 15, 2015, 10:19 PM UTC

gaalze wrote: post #2

The best alternative: http://www.7he.at/freebsd/vps/ Jails aren't that great: https://aboutthebsds.wordpress.com/2013/01/13/freebsd-jails-... But there is Capsicum too: http://lwn.net/Articles/482858/

I would be far more willing to entrust a production DB to a jail than a docker container because it's been audited over the course of >a decade. Furthermore, aboutthebsds is a well-known linux polemicist blog.