3 ms·

As far as I can tell from 30 seconds of research, this thing just bundles standard Linux syscalls in one package. "This machinery" is just typical Google overen

As far as I can tell from 30 seconds of research, this thing just bundles standard Linux syscalls in one package. "This machinery" is just typical Google overengineering, it's not doing anything except acting as middleware. P.S. Yeah, I wish we had a better userspace Linux namespace toolkit instead of Docker.

spockz 5y ago
What about podman?
melony 5y ago
So gVisor for C++?
a-dub 5y ago
i think namespaces are the wrong abstraction. it's a good solution given what exists (posix/linux), but way more hacky than something new with encapsulation of machine code by source being a first class design principle.
- otabdeveloper4 5y ago
  Wrong for what exactly? I just want to run my apps with a separate TCP port namespace :)
  - a-dub 5y ago
    the whole idea that you have to fork process tables, user tables, network tables and filesystems to achieve encapsulation between applications is a product of the old unix security model not being sufficient for what people are actually using these systems for today. so the popularity of containers (namespaces) and the entire ecosystem of tools like this (dating all the way back to chroots and bsd jails) basically says to me that maybe a fresh approach to security features in an operating system would lead to less complexity than what has needed to be built on top of good ol' unix.
    - otabdeveloper4 5y ago
      If I wanted security then namespaces aren't the tool I would use. (And I don't think they were ever intended as a security feature.)
      - a-dub 5y ago
        yeah i suppose you're right, point still stands. having to chop up all the kernel tables to run little mini systems just to deploy software correctly, along with choosing from a whole host of bolt on capabilities systems and sandboxing technologies makes it seem like the services provided by base unix for modern computing are looking a bit long in the tooth.

spockz 5y ago

What about podman?

melony 5y ago

So gVisor for C++?

a-dub 5y ago

i think namespaces are the wrong abstraction. it's a good solution given what exists (posix/linux), but way more hacky than something new with encapsulation of machine code by source being a first class design principle.

otabdeveloper4 5y ago
Wrong for what exactly? I just want to run my apps with a separate TCP port namespace :)
- a-dub 5y ago
  the whole idea that you have to fork process tables, user tables, network tables and filesystems to achieve encapsulation between applications is a product of the old unix security model not being sufficient for what people are actually using these systems for today. so the popularity of containers (namespaces) and the entire ecosystem of tools like this (dating all the way back to chroots and bsd jails) basically says to me that maybe a fresh approach to security features in an operating system would lead to less complexity than what has needed to be built on top of good ol' unix.
  - otabdeveloper4 5y ago
    If I wanted security then namespaces aren't the tool I would use. (And I don't think they were ever intended as a security feature.)
    - a-dub 5y ago
      yeah i suppose you're right, point still stands. having to chop up all the kernel tables to run little mini systems just to deploy software correctly, along with choosing from a whole host of bolt on capabilities systems and sandboxing technologies makes it seem like the services provided by base unix for modern computing are looking a bit long in the tooth.