3 ms·
Container engine is just a wrapper around couple of Linux APIs mainly cgroups & namespaces & iptables/BPF - there is most of hard work done. A good example how
by imhoguy 8y ago
Container engine is just a wrapper around couple of Linux APIs mainly cgroups & namespaces & iptables/BPF - there is most of hard work done. A good example how trivially it can be implemented is this: https://news.ycombinator.com/item?id=9925896 https://news.ycombinator.com/item?id=9925896
Now, implementing DBMS with even basic SQL query language, is not a trivial job.
- cpuguy83 8y agoThat's funny because getting these things right (without security issues) is quite difficult.
- 013a 8y agoIts very likely that most of the challenging security stuff will continue to move down into the kernel itself. Its important to remember that the entire concept of a container wasn't really a single unified concept in the Kernel until very recently as they've gained popularity; instead, they were a amalgamation of a few different capabilities in the kernel.
- fatherlinnux 8y agoPerhaps, you caught news of something I haven't seen, but AFAIK, "container" is still defined in user space. Talking to Eric Biederman, that's what the kennel team wants - people to experiment in user space, remixing kernel tech together...
- cpuguy83 8y agoThere's a new-ish (from Feb) LWN article about container's as an object in the kernel: https://lwn.net/Articles/780364/ https://lwn.net/Articles/780364/ Reception still doesn't seem great.