5 ms·

Does anyone have a link to an explanation of why they moved to this approach in WSL 2? Edit: more info here: https://devblogs.microsoft.com/commandline/announc

by lmz 7y ago

Does anyone have a link to an explanation of why they moved to this approach in WSL 2? Edit: more info here: https://devblogs.microsoft.com/commandline/announcing-wsl-2/ https://devblogs.microsoft.com/commandline/announcing-wsl-2/

MikusR 7y ago
Probably for the same reason they adopted Chromium as base for their browser.
tyingq 7y ago
Ahh, from your link: "dramatic file system performance increases, and full system call compatibility, meaning you can run more Linux apps in WSL 2 such as Docker." That will be welcome. I use WSL, but it's currently very slow for anything that touches lots of files, like a git clone, rsync, etc.
- gfiorav 7y ago
  I use WSL at work and use windows docker as a server... I use docker client form wsl ubuntu and make it connect to the Docker server running on windows. I do the same thing with databases. I’ve grown fond of this approach, as it integrates well with the Services app in windows. https://nickjanetakis.com/blog/setting-up-docker-for-windows-and-wsl-to-work-flawlessly https://nickjanetakis.com/blog/setting-up-docker-for-windows...
  - DuskStar 7y ago
    That is not the most secure way to run Docker in WSL - IIRC exposing the Docker socket on localhost lets websites start Docker containers. If you use something like npiperelay [0], you can access Docker from WSL without exposing the Docker socket to everything. 0: https://github.com/jstarks/npiperelay https://github.com/jstarks/npiperelay
    - zeusk 7y ago
      Can't docker restrict incoming connections from a whitelist? Or you could use the system firewall to ensure that it does.
      - tsimionescu 7y ago
        What do you mean by a white list? The connections are coming from local host (from your browser). The fact that they were initiated by code which was downloaded from malware.com is not knowable to docker.
        zeusk 7y ago
        oh wait, you mean from client side javascript? I didn't know you could do that. FWIK, only WebSockets are supported within browsers - let me know if you know of a way otherwise.
        DuskStar 7y ago
        I'm pretty sure you can make http POST and GET requests from client side JS, and again IIRC you can start a container in Docker with a single POST - no return info required
        zeusk 7y ago
        Yes, but aren't HTTP requests subject to CORS? I'm pretty sure, otherwise, that is a gaping hole in many security setups right now - if any website could poke local sockets using client JS.
        tsimionescu 7y ago
        CORS applies only to JS code - sites can still issue cross-origin GETs and POSTs via HTML, using Forms for example. Not sure whether there is enough control on the format to actually issue a valid Docker request. Still, it's generally a pretty bad idea to have an unauthenticated service running on localhost which can perform arbitrary operations on the system - you're depending on all other software running on the system not to transform that into a vulnerability.
- mfatica 7y ago
  Not sure if that article touches on it but it also allows docker to be used without a VM
  - gfiorav 7y ago
    You can use docker client from WSL and have it use the Windows docker running in the background. No need for VM https://nickjanetakis.com/blog/setting-up-docker-for-windows-and-wsl-to-work-flawlessly https://nickjanetakis.com/blog/setting-up-docker-for-windows...
    - mfatica 7y ago
      Docker for windows currently still runs in a VM though
    - kyriakos 7y ago
      Docker just runs a lightweight vm in hyperv which uses to run the containers. So yeah a Linux vm is still needed.
- asveikau 7y ago
  It would be nice if they improved their own file system performance. Sidestepping the gap by running a VM gives them less incentive to fix these issues, which are also visible in native Windows applications.
  - crispinb 7y ago
    I agree Windows file access is noticeably slower than on other platforms. But it seems like the issue has quite fundamental roots: https://github.com/Microsoft/WSL/issues/873#issuecomment-425272829 https://github.com/Microsoft/WSL/issues/873#issuecomment-425.... Add to that Windows Defender scanning, and you have death by a thousand cuts rather than something that could be fixed by a single measure like adopting a faster filesystem.
    - asveikau 7y ago
      I used to work at Microsoft doing work that touched filesystem stuff a lot, and every single one of those points was known to me already. But at a certain point they ought to be able to say: the OS is not competitive with the state of the art in this area. It shouldn't matter what organizational or component boundaries create this situation, they should do more to fix it. Blaming the layering is a start I guess, but shouldn't be the end.
      - crispinb 7y ago
        Sure, hard to argue with that. The effects are pronounced enough even from an end-user perspective, and it's clearly Microsoft's job to fix.
- aasasd 7y ago
  Not sure how they could improve filesystem performance, since they have previously explained that the slowness is from going through the Windows FS stack that has hooks at like five different levels. So do they now somehow sidestep the Windows' FS? How would that work?
  - crispinb 7y ago
    As they're using a linux kernel, I wonder if they're using an ext4 filesystem for the wsl stuff, hosted in a file image on NTFS? Windows apps could still get access to the wsl files via the 9P file server.
    - sbisson 7y ago
      Yes they are. It's an ext4 VHD, mounted under WSL.
      - crispinb 7y ago
        Makes sense. Thanks. I quite look forward to checking it out.
      - mehrdadn 7y ago
        Oh man that sucks! Now you have to worry about resizing the partition and disk all the time. It was so awesome not having to worry about that!
vbezhenar 7y ago
For me it seems that they just abandoned their efforts to implement Linux syscalls and decided to build a GUI for Linux VM. Very similar to their new Edge approach: abandon complex task of building browser engine and just build a GUI for Chromium. That's very different from their original goal to have both Windows and Linux processes work together. I don't think that their WSL 2 will allow Linux process to exec into Windows binary. For me, personally, it seems like another failure. I don't see any reason not to use Linux in VirtualBox. It's simpler and it works. Their original approach was something new and interesting. Microsoft started to make very questionable decisions lately.

by lmz 7y ago

MikusR 7y ago

Probably for the same reason they adopted Chromium as base for their browser.

tyingq 7y ago

Ahh, from your link: "dramatic file system performance increases, and full system call compatibility, meaning you can run more Linux apps in WSL 2 such as Docker." That will be welcome. I use WSL, but it's currently very slow for anything that touches lots of files, like a git clone, rsync, etc.

gfiorav 7y ago
I use WSL at work and use windows docker as a server... I use docker client form wsl ubuntu and make it connect to the Docker server running on windows. I do the same thing with databases. I’ve grown fond of this approach, as it integrates well with the Services app in windows. https://nickjanetakis.com/blog/setting-up-docker-for-windows-and-wsl-to-work-flawlessly https://nickjanetakis.com/blog/setting-up-docker-for-windows...
- DuskStar 7y ago
  That is not the most secure way to run Docker in WSL - IIRC exposing the Docker socket on localhost lets websites start Docker containers. If you use something like npiperelay [0], you can access Docker from WSL without exposing the Docker socket to everything. 0: https://github.com/jstarks/npiperelay https://github.com/jstarks/npiperelay
  - zeusk 7y ago
    Can't docker restrict incoming connections from a whitelist? Or you could use the system firewall to ensure that it does.
    - tsimionescu 7y ago
      What do you mean by a white list? The connections are coming from local host (from your browser). The fact that they were initiated by code which was downloaded from malware.com is not knowable to docker.
      - zeusk 7y ago
        oh wait, you mean from client side javascript? I didn't know you could do that. FWIK, only WebSockets are supported within browsers - let me know if you know of a way otherwise.
        DuskStar 7y ago
        I'm pretty sure you can make http POST and GET requests from client side JS, and again IIRC you can start a container in Docker with a single POST - no return info required
        zeusk 7y ago
        Yes, but aren't HTTP requests subject to CORS? I'm pretty sure, otherwise, that is a gaping hole in many security setups right now - if any website could poke local sockets using client JS.
        tsimionescu 7y ago
        CORS applies only to JS code - sites can still issue cross-origin GETs and POSTs via HTML, using Forms for example. Not sure whether there is enough control on the format to actually issue a valid Docker request. Still, it's generally a pretty bad idea to have an unauthenticated service running on localhost which can perform arbitrary operations on the system - you're depending on all other software running on the system not to transform that into a vulnerability.
mfatica 7y ago
Not sure if that article touches on it but it also allows docker to be used without a VM
- gfiorav 7y ago
  You can use docker client from WSL and have it use the Windows docker running in the background. No need for VM https://nickjanetakis.com/blog/setting-up-docker-for-windows-and-wsl-to-work-flawlessly https://nickjanetakis.com/blog/setting-up-docker-for-windows...
  - mfatica 7y ago
    Docker for windows currently still runs in a VM though
  - kyriakos 7y ago
    Docker just runs a lightweight vm in hyperv which uses to run the containers. So yeah a Linux vm is still needed.
asveikau 7y ago
It would be nice if they improved their own file system performance. Sidestepping the gap by running a VM gives them less incentive to fix these issues, which are also visible in native Windows applications.
- crispinb 7y ago
  I agree Windows file access is noticeably slower than on other platforms. But it seems like the issue has quite fundamental roots: https://github.com/Microsoft/WSL/issues/873#issuecomment-425272829 https://github.com/Microsoft/WSL/issues/873#issuecomment-425.... Add to that Windows Defender scanning, and you have death by a thousand cuts rather than something that could be fixed by a single measure like adopting a faster filesystem.
  - asveikau 7y ago
    I used to work at Microsoft doing work that touched filesystem stuff a lot, and every single one of those points was known to me already. But at a certain point they ought to be able to say: the OS is not competitive with the state of the art in this area. It shouldn't matter what organizational or component boundaries create this situation, they should do more to fix it. Blaming the layering is a start I guess, but shouldn't be the end.
    - crispinb 7y ago
      Sure, hard to argue with that. The effects are pronounced enough even from an end-user perspective, and it's clearly Microsoft's job to fix.
aasasd 7y ago
Not sure how they could improve filesystem performance, since they have previously explained that the slowness is from going through the Windows FS stack that has hooks at like five different levels. So do they now somehow sidestep the Windows' FS? How would that work?
- crispinb 7y ago
  As they're using a linux kernel, I wonder if they're using an ext4 filesystem for the wsl stuff, hosted in a file image on NTFS? Windows apps could still get access to the wsl files via the 9P file server.
  - sbisson 7y ago
    Yes they are. It's an ext4 VHD, mounted under WSL.
    - crispinb 7y ago
      Makes sense. Thanks. I quite look forward to checking it out.
    - mehrdadn 7y ago
      Oh man that sucks! Now you have to worry about resizing the partition and disk all the time. It was so awesome not having to worry about that!

vbezhenar 7y ago

For me it seems that they just abandoned their efforts to implement Linux syscalls and decided to build a GUI for Linux VM. Very similar to their new Edge approach: abandon complex task of building browser engine and just build a GUI for Chromium. That's very different from their original goal to have both Windows and Linux processes work together. I don't think that their WSL 2 will allow Linux process to exec into Windows binary. For me, personally, it seems like another failure. I don't see any reason not to use Linux in VirtualBox. It's simpler and it works. Their original approach was something new and interesting. Microsoft started to make very questionable decisions lately.