3 ms·
Containers don't actually run directly on hardware with GCE - there's still a virtualization layer in-between. I'm 99% sure that Google runs one VM per contain
by lima 10y ago
Containers don't actually run directly on hardware with GCE - there's still a virtualization layer in-between.
I'm 99% sure that Google runs one VM per container because that's the only way to make it safe.
Anything else would be insane.
- jakon89 10y ago1 container per VM? What's the point? If you can bypass container sandbox it's very likely that you can do the same with VM.
- lima 10y ago> If you can bypass container sandbox it's very likely that you can do the same with VM. Hypervisors are much, much harder to break out of than a Linux container.
- outworlder 10y ago> I'm 99% sure that Google runs one VM per container I'm 100% sure you are wrong. You might as well just use VMs. Containers are not only about safety, you know.
- lima 10y agoI stand corrected, it's a bunch of VMs per customer but still no multi-tenancy.