14 ms·

I never understood the appeal of BSD jails over Solaris zones which seem to be more hardened and seem to vitualize more of the OS.

fsflover 5y ago
Same here, but I never understood how BSD jails or Solaris zones are better over normal hardware virtualization which is used in Qubes OS. In addition, you get a great UX in the latter.
- nix23 5y ago
  > Same here, but I never understood how BSD jails or Solaris zones are better over normal hardware virtualization which is used in Qubes OS. In addition, you get a great UX in the latter. Tells me you don't know the difference between HW-Virtualisation and OS-Virtualisation.
  - fsflover 5y ago
    Of course I do know it. Which is why I'm asking why you would use OS-virtualization, if HW- is possible. (Unless your hardware does not allow that of course).
    - nix23 5y ago
      Since you know the difference you know the pro and contra.
- laumars 5y ago
  Containerisation makes much more sense than virtualisation in a lot of areas: * lower runtime overhead * quicker deployment time * smaller image foot print Plus most of the advantages of VMs can still be applied. However it does massively depend on individual use cases. Qubes aims to be ultra secure and containers in Linux weren’t up to that task at the time (the situation has since improved massively).
  - StreamBright 5y ago
    - lower runtime overhead - quicker deployment time - smaller image foot print Firecracker beg to differ. I think you can do virtualisation and have all three you listed.
    - laumars 5y ago
      Sure. But for every edge case where virtualisation bridges the gap, there will be containerisation solutions that further the gap too. Also I’m not really in the mood to engage in a dumb flame war. I’m just answering the question as to why some people favour containers for some workflows. If firecracker works for you then keep at it.
  - throwawayboise 5y ago
    With modern hardware support for virtualization, is runtime overhead still a big deal (assuming your virtual environments are not emulating some other CPU?)
    - laumars 5y ago
      Depends on the industry. For general purpose computing it’s generally not an issue but it does matter for some specific workflows. I tend to look at it the other way though: given containerisation is so easy these days, what are the compelling reasons to run virtual machines. Neither is a wrong answer though.
      - throwawayboise 5y ago
        VMs still provide better isolation and security, or is that no longer true?
        laumars 5y ago
        They do but not by a significant margin these days. The kind of domains where this is an issue isn’t what you’re average engineer would be concerned with. Where VMs do help the average engineer is they have more secure defaults. It’s pretty easy to accidentally run containers insecurely on Linux (FreeBSD jails are a better story though)
- gaadd33 5y ago
  I don't think Qubes OS existed around 2000, did it?
  - fsflover 5y ago
    I was asking about what to use now.
    - nix23 5y ago
      For what? That would be the first thing to know.....
      - fsflover 5y ago
        For security and workflow separation. What else is there?
        nix23 5y ago
        On your phone, a desktop a server? For real-time applications, HPC, analytics, ML/AI? Hardware virtualization has tradeoffs...sometimes massive ones, and then you trust proprietary hardware to make it faster...again.
        fsflover 5y ago
        Are you using open hardware for software virtualization? I'm curious which. > On your phone, a desktop a server? Phone doesn't support hardware virtualization of course. On my laptop I'm using Qubes OS.
        nix23 5y ago
        >Phone doesn't support hardware virtualization of course. Every CPU "supports" hardware virtualization. >software virtualization? That's a "VM" like JVM, we talk about OS-Virtualisation.
- freemint 5y ago
  Also OS level emulation. Linux system calls can be translated to Solaris system calls allowing to run Linux specific workloads without having to emulate hardware and a full Linux kernels. Furthermore before Dtrace was ported Linux it allowed to debug Linux workloads under DTrace.
  - trasz 5y ago
    You can do both with FreeBSD in the exact same way.
    - freemint 5y ago
      I am fully aware. Parent was probably not.
  - NexRebular 5y ago
    Unless the software is "vendor locked" with linuxisms. I wish I could run everything only on zones but alas, still have to mix in some bhyves as well for e.g. docker support...
laumars 5y ago
FreeBSD is the appeal. Back in the earlier days of containerisation Linux had no options (Linux was pretty late to that particular game) and Solaris wasn’t free. So FreeBSD made a lot of sense. These days the tooling around Linux is better and there are open source forks of Solaris so FreeBSD might seem like an odd choice for some. However I still think FreeBSD is a rock solid operating system and one that doesn’t get taken as seriously these days as it should do.
- AndrewUnmuted 5y ago
  FreeBSD's appeal for me is the easy maintenance. Everything related to config is in /etc/rc.conf; tunables in /boot/loader.conf. The ZFS implementation is rock-solid. I therefore only have to fiddle with my FreeBSD server, running 80TB ZFS storage pool, once a year or so. No other OS gives me this kind of comfort and stability.
  - freemint 5y ago
    I wonder if Solaris has bigger userbase it would also appeal to you.
    - AndrewUnmuted 5y ago
      Perhaps it would! But the userbase is definitely what finally got me into FreeBSD. The fact that hobbyists were contributing such excellent cli tools as `iocage` [0] and `vm-bhyve` [1] really is what got me over my fears. [0] https://iocage.io/ https://iocage.io/ [1] https://github.com/churchers/vm-bhyve https://github.com/churchers/vm-bhyve
    - deltarholamda 5y ago
      Way back when OpenSolaris was around, I put it on a server to experiment with. There was a lot to like about it, but one thing I didn't like was there was a lot of obvious cruft that has built up over the years. Things were in places that I didn't expect, but they had been there since 1904 when people wrote C with a quill pen, so SUN couldn't just move it around, because it would break MasterCard or something. The base FreeBSD system is well thought out, and because it had the ability to, it coalesced into a very coherent system. Man pages are great, everything is where it should be.
drclau 5y ago
Note that FreeBSD Jails were introduced in 1999, while Solaris Containers and Zones were introduces in 2004. At the time FreeBSD Jails were introduced, probably the only alternative that was wildly available was chroot, which is really far from what Jails offer. Full virtualization was too slow to be practical for most scenarios, back then. 1999 is the year when Pentium III was released.
- betaby 5y ago
  > probably the only alternative that was wildly available was chroot Opensource Linux-vserver https://en.wikipedia.org/wiki/Linux-VServer https://en.wikipedia.org/wiki/Linux-VServer was available in 2001. At the same era commercial Virtuozzo was ubiquitous amount hosting providers.
- pjmlp 5y ago
  Bringing other UNIX into the party, HP-UX Virtual Vaults, which were introduced in HP-UX 11, available in 1997.
- freemint 5y ago
  I've seen nothing which would suggest that Solaris zones are more taxing than BSD jails. Did you imply that claim?
  - drclau 5y ago
    > Did you imply that claim? No, I didn't. I was comparing full virtualization to Jails. However, I realize now that there may not even have been a full virtualization solution available back then anyway, at least not for consumer hardware. I'll have to dig a bit on Wikipedia. I've never used Solaris Containers / Zones, but my understanding is that the implementation was similar to FreeBSD Jails, so I have no reason to believe the performance was different.
    - int_19h 5y ago
      Virtual PC and VMware did full virtualization on commodity hardware at the time (Macs and Windows PCs, respectively). But it was slow enough that it was mostly used for development and testing back then, and certainly not viable for any kind of routine sandboxing.
shrubble 5y ago
The issue with zones was the lack in the early days of GNU software and the difficulty in compiling certain things. For instance, awk can act differently and if you don't know the 25 year old decisions that led to the differences, it can be very confusing. (There are different behaviors and command line switches between GNU's AWK and the version from SVR4/XPG)
- eddieh 5y ago
  Lack of GNU stuff would be a selling point.
  - zokula 5y ago
    - eddieh 5y ago
      Wow. Name calling, especially such wholly inappropriate and inflammatory name calling, is way outside the norms here on HN. With brand ambassadors like yourself is there any wonder why I and many others want nothing to do with GNU or the FSF?

fsflover 5y ago

Same here, but I never understood how BSD jails or Solaris zones are better over normal hardware virtualization which is used in Qubes OS. In addition, you get a great UX in the latter.

nix23 5y ago
> Same here, but I never understood how BSD jails or Solaris zones are better over normal hardware virtualization which is used in Qubes OS. In addition, you get a great UX in the latter. Tells me you don't know the difference between HW-Virtualisation and OS-Virtualisation.
- fsflover 5y ago
  Of course I do know it. Which is why I'm asking why you would use OS-virtualization, if HW- is possible. (Unless your hardware does not allow that of course).
  - nix23 5y ago
    Since you know the difference you know the pro and contra.
laumars 5y ago
Containerisation makes much more sense than virtualisation in a lot of areas: * lower runtime overhead * quicker deployment time * smaller image foot print Plus most of the advantages of VMs can still be applied. However it does massively depend on individual use cases. Qubes aims to be ultra secure and containers in Linux weren’t up to that task at the time (the situation has since improved massively).
- StreamBright 5y ago
  - lower runtime overhead - quicker deployment time - smaller image foot print Firecracker beg to differ. I think you can do virtualisation and have all three you listed.
  - laumars 5y ago
    Sure. But for every edge case where virtualisation bridges the gap, there will be containerisation solutions that further the gap too. Also I’m not really in the mood to engage in a dumb flame war. I’m just answering the question as to why some people favour containers for some workflows. If firecracker works for you then keep at it.
- throwawayboise 5y ago
  With modern hardware support for virtualization, is runtime overhead still a big deal (assuming your virtual environments are not emulating some other CPU?)
  - laumars 5y ago
    Depends on the industry. For general purpose computing it’s generally not an issue but it does matter for some specific workflows. I tend to look at it the other way though: given containerisation is so easy these days, what are the compelling reasons to run virtual machines. Neither is a wrong answer though.
    - throwawayboise 5y ago
      VMs still provide better isolation and security, or is that no longer true?
      - laumars 5y ago
        They do but not by a significant margin these days. The kind of domains where this is an issue isn’t what you’re average engineer would be concerned with. Where VMs do help the average engineer is they have more secure defaults. It’s pretty easy to accidentally run containers insecurely on Linux (FreeBSD jails are a better story though)
gaadd33 5y ago
I don't think Qubes OS existed around 2000, did it?
- fsflover 5y ago
  I was asking about what to use now.
  - nix23 5y ago
    For what? That would be the first thing to know.....
    - fsflover 5y ago
      For security and workflow separation. What else is there?
      - nix23 5y ago
        On your phone, a desktop a server? For real-time applications, HPC, analytics, ML/AI? Hardware virtualization has tradeoffs...sometimes massive ones, and then you trust proprietary hardware to make it faster...again.
        fsflover 5y ago
        Are you using open hardware for software virtualization? I'm curious which. > On your phone, a desktop a server? Phone doesn't support hardware virtualization of course. On my laptop I'm using Qubes OS.
        nix23 5y ago
        >Phone doesn't support hardware virtualization of course. Every CPU "supports" hardware virtualization. >software virtualization? That's a "VM" like JVM, we talk about OS-Virtualisation.
freemint 5y ago
Also OS level emulation. Linux system calls can be translated to Solaris system calls allowing to run Linux specific workloads without having to emulate hardware and a full Linux kernels. Furthermore before Dtrace was ported Linux it allowed to debug Linux workloads under DTrace.
- trasz 5y ago
  You can do both with FreeBSD in the exact same way.
  - freemint 5y ago
    I am fully aware. Parent was probably not.
- NexRebular 5y ago
  Unless the software is "vendor locked" with linuxisms. I wish I could run everything only on zones but alas, still have to mix in some bhyves as well for e.g. docker support...

laumars 5y ago

FreeBSD is the appeal. Back in the earlier days of containerisation Linux had no options (Linux was pretty late to that particular game) and Solaris wasn’t free. So FreeBSD made a lot of sense. These days the tooling around Linux is better and there are open source forks of Solaris so FreeBSD might seem like an odd choice for some. However I still think FreeBSD is a rock solid operating system and one that doesn’t get taken as seriously these days as it should do.

AndrewUnmuted 5y ago
FreeBSD's appeal for me is the easy maintenance. Everything related to config is in /etc/rc.conf; tunables in /boot/loader.conf. The ZFS implementation is rock-solid. I therefore only have to fiddle with my FreeBSD server, running 80TB ZFS storage pool, once a year or so. No other OS gives me this kind of comfort and stability.
- freemint 5y ago
  I wonder if Solaris has bigger userbase it would also appeal to you.
  - AndrewUnmuted 5y ago
    Perhaps it would! But the userbase is definitely what finally got me into FreeBSD. The fact that hobbyists were contributing such excellent cli tools as `iocage` [0] and `vm-bhyve` [1] really is what got me over my fears. [0] https://iocage.io/ https://iocage.io/ [1] https://github.com/churchers/vm-bhyve https://github.com/churchers/vm-bhyve
  - deltarholamda 5y ago
    Way back when OpenSolaris was around, I put it on a server to experiment with. There was a lot to like about it, but one thing I didn't like was there was a lot of obvious cruft that has built up over the years. Things were in places that I didn't expect, but they had been there since 1904 when people wrote C with a quill pen, so SUN couldn't just move it around, because it would break MasterCard or something. The base FreeBSD system is well thought out, and because it had the ability to, it coalesced into a very coherent system. Man pages are great, everything is where it should be.

drclau 5y ago

Note that FreeBSD Jails were introduced in 1999, while Solaris Containers and Zones were introduces in 2004. At the time FreeBSD Jails were introduced, probably the only alternative that was wildly available was chroot, which is really far from what Jails offer. Full virtualization was too slow to be practical for most scenarios, back then. 1999 is the year when Pentium III was released.

betaby 5y ago
> probably the only alternative that was wildly available was chroot Opensource Linux-vserver https://en.wikipedia.org/wiki/Linux-VServer https://en.wikipedia.org/wiki/Linux-VServer was available in 2001. At the same era commercial Virtuozzo was ubiquitous amount hosting providers.
pjmlp 5y ago
Bringing other UNIX into the party, HP-UX Virtual Vaults, which were introduced in HP-UX 11, available in 1997.
freemint 5y ago
I've seen nothing which would suggest that Solaris zones are more taxing than BSD jails. Did you imply that claim?
- drclau 5y ago
  > Did you imply that claim? No, I didn't. I was comparing full virtualization to Jails. However, I realize now that there may not even have been a full virtualization solution available back then anyway, at least not for consumer hardware. I'll have to dig a bit on Wikipedia. I've never used Solaris Containers / Zones, but my understanding is that the implementation was similar to FreeBSD Jails, so I have no reason to believe the performance was different.
  - int_19h 5y ago
    Virtual PC and VMware did full virtualization on commodity hardware at the time (Macs and Windows PCs, respectively). But it was slow enough that it was mostly used for development and testing back then, and certainly not viable for any kind of routine sandboxing.

shrubble 5y ago

The issue with zones was the lack in the early days of GNU software and the difficulty in compiling certain things. For instance, awk can act differently and if you don't know the 25 year old decisions that led to the differences, it can be very confusing. (There are different behaviors and command line switches between GNU's AWK and the version from SVR4/XPG)

eddieh 5y ago
Lack of GNU stuff would be a selling point.
- zokula 5y ago
  - eddieh 5y ago
    Wow. Name calling, especially such wholly inappropriate and inflammatory name calling, is way outside the norms here on HN. With brand ambassadors like yourself is there any wonder why I and many others want nothing to do with GNU or the FSF?