3 ms·

> It doesn't have to be in-place, or even compressed; it just has to be automatic and OS-integrated. With something like squashfs (with or without compression)

> It doesn't have to be in-place, or even compressed; it just has to be automatic and OS-integrated. With something like squashfs (with or without compression) the kernel handles all the paging, mapping, and decompression (if any). Sure, but I don't think you can do that within a self-contained binary, the kernel doesn't really support that. It would have to just be a loopback image, and lose the whole "self-contained binary" angle that makes this different from all sorts of other container tech.

pritambaral 8y ago
> Sure, but I don't think you can do that within a self-contained binary, the kernel doesn't really support that. An executable binary can set up a mount namespace, mount /proc/self/exe or argv[0] (with some offset) as a loopback device within the namespace, and then execute a process within the mount.
- hedora 8y ago
  It would probably only be a few lines of portable shell code. Mounting at an offset is one line; runing the executable is a second. Not sure what you have to do to manually drop into a container. (Though, I think you need to be root to run those lines, and you could put setuid root binaries in the image...)
  - pritambaral 8y ago
    > Though, I think you need to be root to run those lines If you're thinking of mounts, Linux is getting there: https://lwn.net/Articles/697278/ https://lwn.net/Articles/697278/ and https://lwn.net/Articles/755498/ https://lwn.net/Articles/755498/ If you're thinking containerisation, it has been possible for a while, and new improvements are coming up: https://www.youtube.com/watch?v=-PZNF8XDNn8 https://www.youtube.com/watch?v=-PZNF8XDNn8 and https://events.linuxfoundation.org/wp-content/uploads/2017/12/2018-LSS-Europe-Edinburgh-Namespaces-and-Capabilities_Christian-Brauner.pdf https://events.linuxfoundation.org/wp-content/uploads/2017/1...

pritambaral 8y ago

> Sure, but I don't think you can do that within a self-contained binary, the kernel doesn't really support that. An executable binary can set up a mount namespace, mount /proc/self/exe or argv[0] (with some offset) as a loopback device within the namespace, and then execute a process within the mount.

hedora 8y ago
It would probably only be a few lines of portable shell code. Mounting at an offset is one line; runing the executable is a second. Not sure what you have to do to manually drop into a container. (Though, I think you need to be root to run those lines, and you could put setuid root binaries in the image...)
- pritambaral 8y ago
  > Though, I think you need to be root to run those lines If you're thinking of mounts, Linux is getting there: https://lwn.net/Articles/697278/ https://lwn.net/Articles/697278/ and https://lwn.net/Articles/755498/ https://lwn.net/Articles/755498/ If you're thinking containerisation, it has been possible for a while, and new improvements are coming up: https://www.youtube.com/watch?v=-PZNF8XDNn8 https://www.youtube.com/watch?v=-PZNF8XDNn8 and https://events.linuxfoundation.org/wp-content/uploads/2017/12/2018-LSS-Europe-Edinburgh-Namespaces-and-Capabilities_Christian-Brauner.pdf https://events.linuxfoundation.org/wp-content/uploads/2017/1...