4 ms·
Ex-Docker person here. I got an early peek at Sysbox and I'm really excited by it -- it's really neat. Docker is missing a bunch of features that make some sof
by bfirsh 6y ago
Ex-Docker person here. I got an early peek at Sysbox and I'm really excited by it -- it's really neat.
Docker is missing a bunch of features that make some software work, which is why you can't run Docker inside Docker by default. Instead of dropping from containers all the way down to hardware virtualization, Sysbox is "augmenting" containers with the missing features by simulating them in userland. That gives you all the power of a VM, without any of the downside of slow start-up speed, provisioning blocks of memory, not being able to run them on EC2, etcetc.
It reminds me a bit of user-mode Linux [0], weirdly. There's something kinda interesting about simulating a bunch of the kernel in userland.
[0] https://en.wikipedia.org/wiki/User-mode_Linux https://en.wikipedia.org/wiki/User-mode_Linux
- ctalledo 6y agoThanks! Yes, Sysbox is using OS-virtualization techniques to augment the abstraction of the container, thereby enabling software that interacts deeply with the kernel (e.g., dockerd, k8s, etc) to run inside the container, and do so with proper isolation (no privileged containers). Now that you mention user-mode linux, it is one of the references we used as we built Sysbox, though they are very different things of course. I think my background as a VMware ESX kernel developer played a strong influence too ...
- swsieber 6y agoSo can you run sysbox in sysbox?
- ctalledo 6y agoUnfortunately not. Sysbox requires "true root" privileges, so it can't run inside a system container deployed by Sysbox itself (since that system container would use the user namespace). You can run Sysbox inside a privileged container however, and in fact the Sysbox test framework relies on this heavily. What use case do you envision for running sysbox in sysbox?
- swsieber 6y agoIt's mostly curiosity. Probably docker in docker in docker.
- ctalledo 6y agoGot it; note that inside a system container you can always run docker-in-docker using privileged containers (https://hub.docker.com/_/docker https://hub.docker.com/_/docker). That is, you don't need sysbox nesting in order to run more levels of docker nesting inside the system container. And those privileged containers would only be privileged within the system container, but not at host level.
- swsieber 6y agoOh, that's cool. TIL. Thanks for taking the time to respond to something pretty far off in the weeds.
- danielheath 6y agoNo OP but one of my first questions about any layer is “how transparent is it”. If it can’t host itself, it’s clearly not 100% transparent. This matters because it adds cognitive overhead - I have to keep track of which features are available at which layer.
- ctalledo 6y agoAgreed; it's certainly something we will keep in mind as we mature Sysbox.
- ram_rar 6y agoi'm just curious. For what kind of use cases do you need docker inside of another docker?
- wh33zle 6y agoFor example, my CI provider might want to execute my build in a docker container for security reasons but I also want to run/build a docker container as part of my CI.
- rmolina 6y agoAs @wh33zle mentioned, CI/CD is an obvious use-case. Development environments is another one (pls see the other question i just answered on this topic). But i also see 'production' scenarios. Think about having a reverse-proxy system container, inside of which you host the backend applications, which happen to be docker containers. In essence, Sysbox allows you to create hierarchies of containers in a secured fashion, without the need to abuse 'sidecar' pattern, nor priv containers.
- yjftsjthsd-h 6y agoI use dind to build containers in gitlab ci.
- smcleod 6y agoTry using Kaniko with GitLab CI, it will save you from having to run privileged / DIND containers.
- yjftsjthsd-h 6y agoI've been experimenting with buildah, but that does look like another option I should try, thanks.
- anirudhmurali 6y agoI think you'll also need it if you want to use docker-compose in your CI.