14 ms·
On modern Linux distros every process is running in a cgroup and namespace by default. So these days the main difference between a "container" and a regular pro
by elsonrodriguez 10y ago
On modern Linux distros every process is running in a cgroup and namespace by default. So these days the main difference between a "container" and a regular process is that regular processes are all jumbled together in the same root namespace, and containers are in separate namespaces.
- jjnoakes 10y agoWhich Linux distributions do this? I'd like to read how "most" instances of fork and exec end up with unique networks and file system namespaces.
- elsonrodriguez 10y agoI didn't say unique, I said "jumbled together". Now as far as which distros put processes in a namespace and cgroup by default, I know at least CentOS 7 and Ubuntu 15 do this. And those two distros on their own would qualify for "most". To check if your distro does it, one way of checking is just doing a `cat /proc/1/cgroup`. This will show you what cgroups process 1 is in. By default you will be in the "root" cgroup. To check your namespaces, `ls -l /proc/1/ns/`. You'll see the process is in some randomly generated namespace ID per item. I'm sure you could recompile your kernel to disable this behavior, but the default reality of modern Linux is that everything is already running in a "container". Now the question is whether or not people want to take advantage of that reality, and separate out processes in isolation, or keep running everything on a system in such a way that any single process can impact the whole system.