4 ms·

As far as I'm concerned, this is an obvious truth. Linux containers are processes with better sandboxing -- who would not want this? As kinks in the kernel sup

As far as I'm concerned, this is an obvious truth. Linux containers are processes with better sandboxing -- who would not want this? As kinks in the kernel support and tech get worked out, and OSs deepen support I can't imagine that it will ever make sense to say something like "I could have run the process with cgroup and namespace isolation but I chose not to, choosing to make a new user-level isolation or run everything as root instead". Arguments against containers as the future based on the complexity may have weight but not for long.

arianvanp 7y ago
The runtime and packaging format are orthogonal things . Containers the package format (docker) is completely rubbish in my opinion
sourcesmith 7y ago
"I could have run the process with cgroup and namespace isolation"... using systemd.
- kchr 7y ago
  Or skip the million non-container related dependencies introduced by systemd and focus on a container centric init system...
merb 7y ago
> Linux containers are processes with better sandboxing simply not true: https://github.com/google/gvisor#why-does-gvisor-exist https://github.com/google/gvisor#why-does-gvisor-exist
- hardwaresofton 7y ago
  The word "sandbox" is a bad choice -- "isolation and resource limiting" might have been a better term to use, but the idea that containerization does not sandbox at all is not a fair characterization. It's not a good sandbox, but if we are pedantic about the definition of a sandbox, it fits, especially when we think of the benefits of namespacing (effectively removing access to resources like networks, filesystems, etc). gVisor is a more focused on sandboxing processes specifically, so it's relevant but gVisor is not relevant to the wider discussion about a packaging format -- unless you're suggesting to run gvisor'd processes instead of containerized ones and containerization is still beneficial in that scenario.

arianvanp 7y ago

The runtime and packaging format are orthogonal things . Containers the package format (docker) is completely rubbish in my opinion

sourcesmith 7y ago

"I could have run the process with cgroup and namespace isolation"... using systemd.

kchr 7y ago
Or skip the million non-container related dependencies introduced by systemd and focus on a container centric init system...

merb 7y ago

> Linux containers are processes with better sandboxing simply not true: https://github.com/google/gvisor#why-does-gvisor-exist https://github.com/google/gvisor#why-does-gvisor-exist

hardwaresofton 7y ago
The word "sandbox" is a bad choice -- "isolation and resource limiting" might have been a better term to use, but the idea that containerization does not sandbox at all is not a fair characterization. It's not a good sandbox, but if we are pedantic about the definition of a sandbox, it fits, especially when we think of the benefits of namespacing (effectively removing access to resources like networks, filesystems, etc). gVisor is a more focused on sandboxing processes specifically, so it's relevant but gVisor is not relevant to the wider discussion about a packaging format -- unless you're suggesting to run gvisor'd processes instead of containerized ones and containerization is still beneficial in that scenario.