3 ms·
The implication this article makes that "containers" are somehow further from the metal than sandboxed javascript is disingenuous.
by newnewpdro 8y ago
The implication this article makes that "containers" are somehow further from the metal than sandboxed javascript is disingenuous.
- zbentley 8y agoHow so? Context switching has a cost, and the solution outlined within seems to achieve similar functionality while not paying nearly as much. The same is true for quota/resource management (what cgroups etc. would provide you with containers on Linux). I haven't used this, just read the same article you have, but the claim seems reasonable.
- newnewpdro 8y agoYou can run javascript in a container and its distance from the metal is no different than if you just ran the javascript outside of a container. Containers are just processes with limited visibility into the rest of the host, they're nothing like VMs. We've deliberately incurred the context switching costs of using multiple processes for decades because the hardware-enforced isolation of address spaces via the MMU is desirable. Of course you can gain efficiency by throwing away the multiprocess model and running separate security domains in the same address space of a single process, we're not breaking new ground here by going backwards.