3 ms·
Why not just run Docker containers natively?
by riyakhanna1983 6y ago
Why not just run Docker containers natively?
- mrkurt 6y agoWe have a whole post about workload isolation that answers this: https://fly.io/blog/sandboxing-and-workload-isolation/ https://fly.io/blog/sandboxing-and-workload-isolation/ The tldr is: Docker containers don't offer enough isolation for multi tenant systems. They're also very slow to boot, compared to a Firecracker VM.
- riyakhanna1983 6y agoBut does FC not incur high I/O overhead at runtime?
- mrkurt 6y agoThe flippant answer is "it doesn't really matter, safety usually wins over performance". But also, we run Firecrackers on our own physical servers and performance is quite good (even network + disk performance).