6 ms·
Sailor, a native and portable container system for NetBSD and Mac OS X
- Esau 11y agoIt should be pointed out that Pkgin is not installed by default with NetBSD, although you can add it during the installer configuration. The reason I know that is that I manually configure my NetBSD installs, as I do not like the depend on configuration tools.
- noselasd 11y agoWhile neat and useful - is it fair to call this a container ? It seems to only partition/isolate the filesystem(perhaps network interface too) - while (arguably) the benefit of containers is being able to also partition and isolate CPU, memory, network, routing, etc.
- geggam 11y agoThe cpu / memory / network "isolation" is done with cgroups and can be done without containers
- jacques_chester 11y agoSmarter people than me say that "true" containerizing on OS X is not really a thing[1]. [1] https://github.com/vito/houdini https://github.com/vito/houdini
- geofft 11y agoOS X doesn't provide kernel features directly equivalent to Linux's CLONE_* and cgroups. But it does provide Seatbelt, a sandboxing policy layer, which you could use with effort to implement something similar in end result. This is what both iOS apps and desktop App Store apps use for security isolation. Alternatively, you could ship a kernel module that added these features (although that might be ridiculously complicated).
- jacques_chester 11y agoAlex (aka vito) likes implementing things from scratch on weekends. So if you surprised him with a github issue he might just take you up on that challenge.
- INTPenis 11y agoThis brings me back to when we were creating complex scripts to generate jails on FreeBSD. It seems to me that sailor is just a chroot, in other words it's just a jail with a bunch of stuff crammed in there to make it work. Just like 10 years ago on FreeBSD when you created a jail and had to make the system inside the jail to make it work.
- q3k 11y agoSo, the default example for node.js spawns the worker as root in the 'container'. Since this is a simple chroot, the worker could execute a 90's style chroot escape (open; mkdir; chroot; fchdir; chdir ../../../; chroot.) and gain root on the host. Is this a joke?
- geofft 11y agoIf your goal with containerization is to run trusted applications that just need bizarre systemwide configuration (possibly mutually-conflicting configuration), and keep that configuration separate from the host, then no, it's not a joke. This is a super useful use case for containers. There's a strong case to be made that you should not be trusting Docker containers for untrusted code; they're just also for configuration isolation, not security isolation. After all, Docker runs on top of the Linux kernel.... If you want to run untrusted code, put it in a VM (kvm, bhyve, Xen, whatever).
- q3k 11y agoI've never argued against the model of containerization for configuration isolation. I'm arguing against this piece of software and examples it ships. Giving root to a trusted web app is not something sane.
- SwellJoe 11y agoDocker has kernel support from cgroups (and other features). Vastly different from a simple chroot. Maybe not as strong as full virtualization, but if we're worried about kernel bugs that allow privilege escalation, we have to worry about everything running on the system, because it is all surface area for attacking kernel privilege escalation bugs. Comparing Docker (or any Linux container using cgroups, like LXC) to chroot is not accurate.
- geofft 11y agoSure, I agree that Docker is pretty good, and much better at security than a simple chroot. But I think you should be worried about those kernel bugs if you're on Linux, and you should therefore be using actual virtualization (hardware, paravirt, whatever). And therefore, it shouldn't matter how much better Docker is at security than a simple chroot, except as far as defense-in-depth goes: it should not be the single thing you're relying on to sandbox untrusted applications. That is, I am not saying that Docker is bad at security; I am saying that caring about how much security it provides is using the wrong tool for the job.
- scythe 11y agoThere is already a Lua web framework named Sailor: http://sailorproject.org/ http://sailorproject.org/ -- since this is a rather closely related problem domain, it might be nice to avoid name collisions.
- Spiritus 11y agoI fail to see how it's a closely related problem domain.
- geggam 11y agoLOL