3 ms·

Can't you say the same thing about containers? Each container has its own filesystem, PID and network namespace. I don't see people experiencing containers as b

• pulisse 8y ago
  The issue isn't the mere existence of namespacing or scoping. It's about having explicit and consistent models for how these things work. Container frameworks try very hard to introduce a single boundary that applies to all those resources, and so are straightforward to reason about.
• lmm 8y ago
  Containers are byzantine, but presumably you can at least run your own process inside the container and debug from there? How can you hope to even start to debug if your debugger has a different view of the filesystem from the process you're debugging?
  • LukeShu 8y ago
    You can use the nsenter(1) command to enter the namespace of another process.
• makomk 8y ago
  Containers are a nice clean abstraction: a system within a system, where every process running inside it shares the container's filesystem, PID list, and networking. Things can get a little gnarly when the abstraction leaks, but in principle they're easy to understand. This is a lot uglier precisely because it's not total isolation: the processes that use it share most of their filesystem view, networking, etc with the rest of the system, can interact with everything else on the system, but some of their filesystem view is different and the exact difference depends on when the process was started.