4 ms·

What are some container technologies that could be used for this right now?

• cyphar 8y ago
  Namespaces and cgroups (using overlayfs to get page cache sharing for the main process mappings in each container). This is a bit of a coy response, but if you have a usecase where other container solutions have a high start-up cost -- write your own. You can write a basic container runtime in tens of lines of shell script. For existing container glue -- you could probably do this with runc (though unfortunately we are also written in Go) and the architecture is such that runc has no long-running process (only your container continues running after we've set it up). I believe LXC can also produce similar tenancy (and they're written in C which avoids quite a few of the Go problems).
• neilwilson 8y ago
  chroot, cgroup, and the systemd run facilities (systemd-nspawn for example).
  • cyphar 8y ago
    pivot_root, not chroot. chroot is vulnerable to many trivial escapes.