4 ms·
Or use something like GKE where the containers should be running directly on hardware, so you only have one layer.
by richardwhiuk 10y ago
Or use something like GKE where the containers should be running directly on hardware, so you only have one layer.
- nailer 10y ago"Bare-metal" means running directly on hardware. But yes, GKE would also join Triton and Red Shift (provided it has similar container isolation capabilities).
- nailer 10y agoActually, as 0x74696d mentions below, GKE is also not bare metal. Doing a little research: GKE runs on https://cloud.google.com/container-optimized-os/docs/ https://cloud.google.com/container-optimized-os/docs/ which is designed for GCE, which runs on KVM: https://cloud.google.com/compute/docs/faq https://cloud.google.com/compute/docs/faq So it looks like just Triton and Red Shift. Disclaimer: I used to work at Red Hat, which means I like the people behind Red Shift, but that also means I hate the people behind Triton as part of the early 2000s Linux/Solaris wars.
- 0x74696d 10y agoGKE clusters run on VMs, not on bare metal.
- lima 10y agoContainers don't actually run directly on hardware with GCE - there's still a virtualization layer in-between. I'm 99% sure that Google runs one VM per container because that's the only way to make it safe. Anything else would be insane.
- jakon89 10y ago1 container per VM? What's the point? If you can bypass container sandbox it's very likely that you can do the same with VM.
- lima 10y ago> If you can bypass container sandbox it's very likely that you can do the same with VM. Hypervisors are much, much harder to break out of than a Linux container.
- outworlder 10y ago> I'm 99% sure that Google runs one VM per container I'm 100% sure you are wrong. You might as well just use VMs. Containers are not only about safety, you know.
- lima 10y agoI stand corrected, it's a bunch of VMs per customer but still no multi-tenancy.
- deleted 10y ago[deleted]