3 ms·

> what is the cause of insistence on Docker? Because it targets developers and is based on technology usable on a very popular platform. SmartOS zones have nei

by cyphar 10y ago

> what is the cause of insistence on Docker? Because it targets developers and is based on technology usable on a very popular platform. SmartOS zones have neither of these properties. > show me one problem which GNU/Linux has solved that SmartOS already hasn't Packaging software and software updates. SmartOS uses NetBSD's pkgsrc, which is an interesting choice given the fact that BSDs have a very bad track record for packaging. FreeBSD still doesn't package their base system, and the recommended way of dealing with software on BSD systems is to compile it from source. GNU/Linux has solved this problem such a long time ago that I'm honestly surprised that SmartOS decided to use pkgsrc over something much more powerful like zypper+rpm, dnf+rpm or apt+dpkg. So there's one problem that SmartOS didn't solve first, and I'd argue hasn't solved yet either. To be clear, I have no problem with SmartOS -- it has a lot of very deep technology. But claiming that it's magic pixie dust that has solved every problem that GNU/Linux has solved (and is working on solving) is being facetous and dishonest. Also, as far as I'm aware there isn't nearly as much auditing of SmartOS going on as there is of GNU/Linux. Does SmartOS have support for all the features of grsecurity+PaX? What about support for UEFI? Or even support for many different architectures and hardware drivers? GNU/Linux may have many problems, but it beats every other free software operating system in quite a few areas (and beats a few proprietary operating systems in quite a few other areas too). > SmartOS can do Docker, just so you know, although it doesn't need it to provide containerization, at all, but one does have that choice. Yes, I know that. I currently am working as part of the OCI on container standardisation and am happy to see people working on that from the Solaris camp (we need to work together on standardising the workflows we want to use). But the one thing that people I work with don't do when working on container standards and canonical implementations of those standards is start screaming about how everyone should abandon a very popular platform because "I hate supporting GNU/Linux because it's not the operating system I like". Because that's just childish.

Annatar 10y ago
Packaging software and software updates. SmartOS uses NetBSD's pkgsrc, which is an interesting choice given the fact that BSDs have a very bad track record for packaging. FreeBSD still doesn't package their base system, and the recommended way of dealing with software on BSD systems is to compile it from source. Compiling from source? pkgsrc, and by extension SmartOS, fully supports installing binary packages. The command to do this is called pkg_add. pkg_rm uninstalls a binary package. SmartOS even went a step further and uses pkgin, which works exactly the same way as apt-get. Please read pkg_add's and pkgin's manual pages before arguing further on this point. Also here is a short document which clearly illustrates how a binary package is created and installed with pkgsrc: http://www.perkin.org.uk/posts/creating-local-smartos-packages.html http://www.perkin.org.uk/posts/creating-local-smartos-packag... and here is another document pointing out how SmartOs has a nearly 14,000 package library of the latest version of software which normally runs on Linux; versions of which are usually newer than on Linux, and it is built fresh every day into binary packages, completely automatically: https://www.perkin.org.uk/posts/building-packages-at-scale.html https://www.perkin.org.uk/posts/building-packages-at-scale.h... So there's one problem that SmartOS didn't solve first, and I'd argue hasn't solved yet either. And based on your response, I'd argue that you haven't seen or used anything but Linux. I'm far from being dishonest, and in fact I communicated exactly what my motivation is, and I'm sorry but it's really not my fault you haven't read SmartOS and Solaris documentation. That would be akin to me claiming that Linux is better than FreeBSD but without knowing enough about FreeBSD. For example, your question about grsecurity+pax is nonsensical in the context of SmartOS: being Solaris based, it doesn't need Linux specific technology like grsecurity. That was precisely my point, if you use a well designed system, all of this Linux hacked-up nonsense goes away, because it was nonsense to begin with. SmartOS has a secure kernel by design, and further delineation can be achieved with role based access control. It also doesn't need a lightweight virtual machine consisting of a single application because it has zones, and also because there would be nothing to reap your process at the end, and you'd end up with a zombie, an unreaped orphan process. I'm surprised that you don't know that Docker had to re-invent a kludgy copy of init precisely because of this problem, or else you would not have asked me that. As for insisting on Docker because it's popular, it's flawed picking something based on popularity; if you pick a solution, it should be because it's technically sound and therefore robust, so that you can sleep through the nights when you're on-call without incidents, and read newspapers and drink your espresso during the day because the damn thing just runs and runs without needing any babysitting, like Linux does all the time. To claim that SmartOS has no development tools, when it readily offers all the popular frameworks, languages, and has the most advanced linkers and compilers in existense us beyond obscene, I'm afraid. Please read the manual pages on the link editor, ld, and the Sun Studio compilers to get an inkling of what I'm writing about. It will tremendously help the quality of our discussion.
- cyphar 10y ago
  > your question about grsecurity+pax is nonsensical in the context of SmartOS ... no? Because many of the grsecurity+pax improvements apply to any kernel that runs on a CPU (it provides active protections against certain forms of kernel vulnerabilities caused by bugs). This includes illumos, thus the question is valid. Unless you're claiming the illumos cannot ever have a security bug. > pkgsrc, and by extension SmartOS, fully supports installing binary packages. Apologies, I was thinking of a different packaging system in FreeBSD. However, from my reading of the blog you linked pkgsrc only had support for signatures of packages in 2014. GNU/Linux has had this for a very long time. My impression about package management being a shit-show on other operating systems is that every single podcast or blog post I read about those operating systems is celebrating that "package management is easy now with pkg" -- while it's actually not IMO as good as certain GNU/Linux package managers. > and here is another document pointing out how SmartOs has a nearly 14,000 package library of the latest version of software which normally runs on Linux; versions of which are usually newer than on Linux, Only 14000? Also, what distribution of GNU/Linux, what version of the distribution, how much automated QA happens before releases, etc? > I'd argue that you haven't seen or used anything but Linux. Untrue. > but it's really not my fault you haven't read SmartOS and Solaris documentation. It's not my fault that you haven't read the source code of runC without stating an ignorant opinon about how it works, based on a mix of outdated information and pure fabrication. > That would be akin to me claiming that [...] SmartOS is better than GNU/Linux without knowing about the Linux technology you're arguing about? > I'm surprised that you don't know that Docker had to re-invent a kludgy copy of init precisely because of this problem, or else you would not have asked me that. This is all not true, and you should know better. Docker/runC doesn't have an init process in containers. You _can_ run an init process, but it isn't necessary. In addition, the zombie problem doesn't exist because of sub-reapers which are a Linux kernel feature. You might not accept the existence of such features, but that's your perogative. I asked you because I guessed that you didn't know about the GNU/Linux side of things. Thanks for not letting me down on that one. > As for insisting on Docker because it's popular, it's flawed picking something based on popularity; I answered your question of why Docker was popular, now you're complaining that I am talking about Docker because it's popular? What. In addition, I am a maintainer of runC and actually care much more about the OCI than Docker. There are some cool things coming from the Solaris and illumos folks, too bad that you're stuck in your ways and won't even consider the possibility that any GNU/Linux technology is good. That's just insane*. > To claim that SmartOS has no development tools, ... when did I claim that? I claimed that it doesn't have anything like Linux when it comes to security frameworks like grsecurity+pax, UEFI support, hardware and driver support. You haven't addressed those arguments (claiming that grsecurity+pax isn't useful for SmartOS is showing that you don't know what it is or how it works).

by cyphar 10y ago

Annatar 10y ago

Packaging software and software updates. SmartOS uses NetBSD's pkgsrc, which is an interesting choice given the fact that BSDs have a very bad track record for packaging. FreeBSD still doesn't package their base system, and the recommended way of dealing with software on BSD systems is to compile it from source. Compiling from source? pkgsrc, and by extension SmartOS, fully supports installing binary packages. The command to do this is called pkg_add. pkg_rm uninstalls a binary package. SmartOS even went a step further and uses pkgin, which works exactly the same way as apt-get. Please read pkg_add's and pkgin's manual pages before arguing further on this point. Also here is a short document which clearly illustrates how a binary package is created and installed with pkgsrc: http://www.perkin.org.uk/posts/creating-local-smartos-packages.html http://www.perkin.org.uk/posts/creating-local-smartos-packag... and here is another document pointing out how SmartOs has a nearly 14,000 package library of the latest version of software which normally runs on Linux; versions of which are usually newer than on Linux, and it is built fresh every day into binary packages, completely automatically: https://www.perkin.org.uk/posts/building-packages-at-scale.html https://www.perkin.org.uk/posts/building-packages-at-scale.h... So there's one problem that SmartOS didn't solve first, and I'd argue hasn't solved yet either. And based on your response, I'd argue that you haven't seen or used anything but Linux. I'm far from being dishonest, and in fact I communicated exactly what my motivation is, and I'm sorry but it's really not my fault you haven't read SmartOS and Solaris documentation. That would be akin to me claiming that Linux is better than FreeBSD but without knowing enough about FreeBSD. For example, your question about grsecurity+pax is nonsensical in the context of SmartOS: being Solaris based, it doesn't need Linux specific technology like grsecurity. That was precisely my point, if you use a well designed system, all of this Linux hacked-up nonsense goes away, because it was nonsense to begin with. SmartOS has a secure kernel by design, and further delineation can be achieved with role based access control. It also doesn't need a lightweight virtual machine consisting of a single application because it has zones, and also because there would be nothing to reap your process at the end, and you'd end up with a zombie, an unreaped orphan process. I'm surprised that you don't know that Docker had to re-invent a kludgy copy of init precisely because of this problem, or else you would not have asked me that. As for insisting on Docker because it's popular, it's flawed picking something based on popularity; if you pick a solution, it should be because it's technically sound and therefore robust, so that you can sleep through the nights when you're on-call without incidents, and read newspapers and drink your espresso during the day because the damn thing just runs and runs without needing any babysitting, like Linux does all the time. To claim that SmartOS has no development tools, when it readily offers all the popular frameworks, languages, and has the most advanced linkers and compilers in existense us beyond obscene, I'm afraid. Please read the manual pages on the link editor, ld, and the Sun Studio compilers to get an inkling of what I'm writing about. It will tremendously help the quality of our discussion.

cyphar 10y ago
> your question about grsecurity+pax is nonsensical in the context of SmartOS ... no? Because many of the grsecurity+pax improvements apply to any kernel that runs on a CPU (it provides active protections against certain forms of kernel vulnerabilities caused by bugs). This includes illumos, thus the question is valid. Unless you're claiming the illumos cannot ever have a security bug. > pkgsrc, and by extension SmartOS, fully supports installing binary packages. Apologies, I was thinking of a different packaging system in FreeBSD. However, from my reading of the blog you linked pkgsrc only had support for signatures of packages in 2014. GNU/Linux has had this for a very long time. My impression about package management being a shit-show on other operating systems is that every single podcast or blog post I read about those operating systems is celebrating that "package management is easy now with pkg" -- while it's actually not IMO as good as certain GNU/Linux package managers. > and here is another document pointing out how SmartOs has a nearly 14,000 package library of the latest version of software which normally runs on Linux; versions of which are usually newer than on Linux, Only 14000? Also, what distribution of GNU/Linux, what version of the distribution, how much automated QA happens before releases, etc? > I'd argue that you haven't seen or used anything but Linux. Untrue. > but it's really not my fault you haven't read SmartOS and Solaris documentation. It's not my fault that you haven't read the source code of runC without stating an ignorant opinon about how it works, based on a mix of outdated information and pure fabrication. > That would be akin to me claiming that [...] SmartOS is better than GNU/Linux without knowing about the Linux technology you're arguing about? > I'm surprised that you don't know that Docker had to re-invent a kludgy copy of init precisely because of this problem, or else you would not have asked me that. This is all not true, and you should know better. Docker/runC doesn't have an init process in containers. You _can_ run an init process, but it isn't necessary. In addition, the zombie problem doesn't exist because of sub-reapers which are a Linux kernel feature. You might not accept the existence of such features, but that's your perogative. I asked you because I guessed that you didn't know about the GNU/Linux side of things. Thanks for not letting me down on that one. > As for insisting on Docker because it's popular, it's flawed picking something based on popularity; I answered your question of why Docker was popular, now you're complaining that I am talking about Docker because it's popular? What. In addition, I am a maintainer of runC and actually care much more about the OCI than Docker. There are some cool things coming from the Solaris and illumos folks, too bad that you're stuck in your ways and won't even consider the possibility that any GNU/Linux technology is good. That's just insane*. > To claim that SmartOS has no development tools, ... when did I claim that? I claimed that it doesn't have anything like Linux when it comes to security frameworks like grsecurity+pax, UEFI support, hardware and driver support. You haven't addressed those arguments (claiming that grsecurity+pax isn't useful for SmartOS is showing that you don't know what it is or how it works).