4 ms·

docker is used for microservices, is firecraker designed for serverless applications? what's the key difference between firecracker and docker? are these two ov

• bennyz 7y ago
  Amazon uses it mainly for Fargate and Lambda (from what I've read). Docker is a container technology (shared kernel), while Firecracker is an actual VM manager so it provides better isolation. It is more comparable with QEMU.
  • solarkraft 7y ago
    Why does FaaS (that's what Lambda is, right?) need more full blown virtualization? I thought you could maybe get away with even lighter separation than Docker?
    • bronxbomber92 7y ago
      I know very little about the actual technology, but I feel like the blurb on their front page explains this succinctly: “ Firecracker enables you to deploy workloads in lightweight virtual machines, called microVMs, which provide enhanced security and workload isolation over traditional VMs, while enabling the speed and resource efficiency of containers” Security of a VM + efficiency of a container.
    • fiddlerwoaroof 7y ago
      Docker isn’t really designed to be a security boundary, so if you’re colocating containers from different customers (e.g. in Fargate), you need to separate them with a real security boundary like a VM. The same thing is true for lambdas: a lambda is just an archive and the code in the archive needs to run somewhere where one customer cannot intercept another customer’s data.
      • scarface74 7y ago
        To add on, AWS has never run Lambdas for different accounts on the same VM. Before Firecracker, they would run multiple Lambdas for the same account on the same VM. Now with Firecracker, they can run each lambda in its own VM.
    • lfischer 7y ago
      AWS needs to separate one customer’s lambda executions from another’s. When you deploy Docker, isolation is guaranteed either because you do it on an underlying dedicated VM, or you give the Docker image to something like Fargate.
  • haberman 7y ago
    I would love to see a high level overview and compare/contrast between different container and virtualization technologies out there. For those if us who have a good understanding of operating systems and hardware, but haven't been keeping up with the plethora of new technologies that are out there. From what I understand, even QEMU can work in different modes, either emulating hardware or a system call interface. So I'm not sure which of those modes you are referring to.
    • bonzini 7y ago
      QEMU cannot emulate a system call interface with KVM, only with just-in-time compilation. In hardware emulation mode however it can provide multiple hardware models, including one that is rather similar to Firecracker.
• ausjke 7y ago
  even questions like this got downvoted, time to leave HN for reddit for good, more and more pathetic here these days indeed.
  • kelnos 7y ago
    It wasn't a terrible question, but your question is answered in the first couple sentences of the main article. I do notice a trend where comments that suggest that the commenter didn't read the article get downvoted. I think in general I'm fine with that, except it's sometimes hard to notice when someone has read it, but just didn't understand.