4 ms·

"containers" are just a combination of multiple kernel features, one of which does precisely that (user namespaces).

by lima 5y ago

pjmlp 5y ago
And were known as vaults on HP-UX 11, back in 2000.
- wil421 5y ago
  Sounds like Jails in FreeBSD. Wikipedia says they were added in 1999.
  - hestefisk 5y ago
    And Zones on Solaris :) phk was the original author of Jails; he wrote an excellent paper called “Defying the omnipotent root”, which I can highly recommend.
    - amarshall 5y ago
      *Confining the omnipotent root
      - hestefisk 5y ago
        Yes indeed! Brain fart, apologies.
  - hestefisk 5y ago
    And LPARs on System z :)
    - indigodaddy 5y ago
      Aren’t lpars quite a lot different in nature than zones and jails though?
    - queuebert 5y ago
      And VMs on IBM VM/370.
    - tyingq 5y ago
      Both LPARS and z/VM look more like hypervisors to me. Things like containers and chroot probably don't make much sense in the mainframe world since they already had granular facilities to limit access to networks, data sets, etc.
- jerf 5y ago
  Arguably, the issue with these features isn't their existence, since it's not even that hard to add them to a kernel, relative to the generalized difficulty of adding things to a kernel in general. The problem has been the need for mass awareness and desire for the feature, and that's what's taken multiple decades to emerge. It does no good for a kernel to have a security feature that only a vanishing fraction of developers care about and use. (And I say "vanishing fraction" relative to the pool of developers as a whole; even if a particular subcommunity uses it extensively that doesn't make it a pervasive request. I can name subcommunities with all sorts of exotic interests that have not penetrated the mainstream yet, like the capabilities-based security community. Someday, when that emerges, we'll all point back to E as a pioneer, but in the meantime, effectively nobody wants it right now.)

"containers" are just a combination of multiple kernel features, one of which does precisely that (user namespaces).

by lima 5y ago

"containers" are just a combination of multiple kernel features, one of which does precisely that (user namespaces).

pjmlp 5y ago

And were known as vaults on HP-UX 11, back in 2000.

wil421 5y ago
Sounds like Jails in FreeBSD. Wikipedia says they were added in 1999.
- hestefisk 5y ago
  And Zones on Solaris :) phk was the original author of Jails; he wrote an excellent paper called “Defying the omnipotent root”, which I can highly recommend.
  - amarshall 5y ago
    *Confining the omnipotent root
    - hestefisk 5y ago
      Yes indeed! Brain fart, apologies.
- hestefisk 5y ago
  And LPARs on System z :)
  - indigodaddy 5y ago
    Aren’t lpars quite a lot different in nature than zones and jails though?
  - queuebert 5y ago
    And VMs on IBM VM/370.
  - tyingq 5y ago
    Both LPARS and z/VM look more like hypervisors to me. Things like containers and chroot probably don't make much sense in the mainframe world since they already had granular facilities to limit access to networks, data sets, etc.
jerf 5y ago
Arguably, the issue with these features isn't their existence, since it's not even that hard to add them to a kernel, relative to the generalized difficulty of adding things to a kernel in general. The problem has been the need for mass awareness and desire for the feature, and that's what's taken multiple decades to emerge. It does no good for a kernel to have a security feature that only a vanishing fraction of developers care about and use. (And I say "vanishing fraction" relative to the pool of developers as a whole; even if a particular subcommunity uses it extensively that doesn't make it a pervasive request. I can name subcommunities with all sorts of exotic interests that have not penetrated the mainstream yet, like the capabilities-based security community. Someday, when that emerges, we'll all point back to E as a pioneer, but in the meantime, effectively nobody wants it right now.)