8 ms·

I don't think you can explain that as NIH. From what I have seen, Linux namespaces are a much more powerful primitive than BSD jails.

kazen44 5y ago
namespaces in what sense? network namespaces? because freebsd has VNET for a while now. which seems to do the same thing.
- shatteredgate 5y ago
  And all the other ones: https://man7.org/linux/man-pages/man7/namespaces.7.html https://man7.org/linux/man-pages/man7/namespaces.7.html BSD jails are similar but not quite the same thing.
  - ori_b 5y ago
    I don't get it. How are people using this flexibility to get things done in practice, and what uses aren't allowed by the jail model?
    - shatteredgate 5y ago
      You can just compare the APIs, namespaces are like the individual components of a jail. You can use them to build something like a jail, or something different that has a different security model. This was discussed a lot in an old HN thread: https://news.ycombinator.com/item?id=13982620 https://news.ycombinator.com/item?id=13982620
      - ori_b 5y ago
        Yes, I am aware that it's got more moving parts. What are you using this flexibility for?
        shatteredgate 5y ago
        I'm using them for several things but the most straightforward one is probably that namespacing can be gradually added to services, you most likely see benefits from this already if you use systemd. That's one way that namespaces can be used in a different way from the docker model.
        ori_b 5y ago
        What are you adding gradually, specifically? Like, a concrete example that names a namespace you may want to use. I'm trying to figure out what problems a half sandbox solves, and a vague "I just want to enable some capabilities" doesn't help here.
        shatteredgate 5y ago
        A lot of the various security options in systemd: https://www.freedesktop.org/software/systemd/man/systemd.exec.html https://www.freedesktop.org/software/systemd/man/systemd.exe... The sandboxing and mount-related ones are implemented with namespaces, and the idea with them is to not make any of them mandatory so they can be slowly added to system services. That way you can get some of the benefits without needing to build a full rootfs/container for the service. I am not sure how any of those would be done with jails because jails require you to create a chroot and network interface, whereas in Linux the mount and network namespaces are just optional namespaces and you can still use the other namespaces without using them.
        shatteredgate 5y ago
        Side note: I suppose you could chroot to /.
        philkrylov 5y ago
        > jails require you to create a chroot and network interface, They don't: you may chroot to /, share the host's network interface, or disable networking.
      - trasz 5y ago
        This doesn't really answer the question. Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. One real difference is that you need to be root to create a jail. It'll get fixed eventually - FreeBSD already has unprivileged chroot, jail isn't that much different.
        shatteredgate 5y ago
        >Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. Not really, the example of Docker would probably be the most straightforward there. I don't think it's possible to fully port Docker to jails or at least I've never seen a successful port, some of the network topology features seem to just not be possible or straightforward. But I could be wrong, I have not looked into the technical details of this in years, somebody told me it might have been working a while ago but I never heard anything else about it since. Needing to be root is a major deficiency though and I can't take jails seriously with that, one of the main focuses on Linux containers in the past several years has been to make unprivileged namespaces a good option.
        trasz 5y ago
        Docker is literally just a jail. You can do whatever network topology you want using vnet. And yes, having to use root is a major issue. Looks fixable though.
        shatteredgate 5y ago
        Sorry, then I must be remembering some other issue. The effort to port docker to BSD seems to have disappeared. >And yes, having to use root is a major issue. Looks fixable though. AFAIK it took a long time to get this to work on Linux, there are a lot of security issues that it can cause.
    - ajross 5y ago
      > How are people using this flexibility to get things done in practice Um... to loop back to the upthread point: Docker. People are using Docker, and docker is using this stuff.
      - ori_b 5y ago
        And how is it mixing and matching these APIs? Given that there's an OCI-compatible runner for jails (runj, compatible with runc -- which is what docker uses to start containers), it seems to me that Docker isn't in actually using the flexibility afforded by the APIs here, but is just using a relatively fixed set of options. If I'm wrong: what is it using, and what problems is this flexibility solving?
        shatteredgate 5y ago
        I haven't tested runj but just from looking at it, it seems it is not fully compatible with everything that runc does because the OCI itself specifies a lot of Linux-specific functionality.
        trasz 5y ago
        Can you provide some examples?
        ajross 5y ago
        runC is literally the abstraction layer docker wrote internally on top of linux containers! It exists as a separate layer now because they spun it out precisely to freeze the API and enable other efforts like runj. And runj, IIRC (though I'm not an expert in the space) wasn't a trivial 1:1 thing and required changes to the underlying jails layer to enable it.
StreamBright 5y ago
Well, looking at the following things sort of gives it away: - brtfs vs zfs - cgroups vs jails - SystemTap vs dtrace - Systemd vs smf I get it, many of these were due to licensing issues. So they said[1]. Anyways, there are still some things to implement for linux. pf is my favourite (software) firewall. It would be great to see it ported to Linux. 1. https://opensource.stackexchange.com/questions/2094/are-cddl-and-gpl-really-incompatible/2106 https://opensource.stackexchange.com/questions/2094/are-cddl...
- shatteredgate 5y ago
  In my experience, both Linux developers and BSD developers don't seem to care too much about porting things to the other's operating system. If you want to do things the Linux way you can use Linux, and if you want to do things the BSD way you can use BSD. That's seen as easier than trying to glue two incompatible things together.
  - int_19h 5y ago
    BSD developers can't port things from Linux in a straightforward manner due to license issues. But that doesn't apply the other way around.
    - shatteredgate 5y ago
      I don't see why. BSD and GPL are equally compatible, it doesn't matter which way you go. I can see why they wouldn't want a GPL component to be mandatory but it can be made an optional component for Linux compatibility which seems to be the way BSD would want it anyway.
    - ajross 5y ago
      Won't, not can't. *BSDs shipped GPL components for decades before they decided to go for purity. It's a policy decision, not a incapability or mandate.
      - deleted 5y ago
        [deleted]

kazen44 5y ago

namespaces in what sense? network namespaces? because freebsd has VNET for a while now. which seems to do the same thing.

shatteredgate 5y ago
And all the other ones: https://man7.org/linux/man-pages/man7/namespaces.7.html https://man7.org/linux/man-pages/man7/namespaces.7.html BSD jails are similar but not quite the same thing.
- ori_b 5y ago
  I don't get it. How are people using this flexibility to get things done in practice, and what uses aren't allowed by the jail model?
  - shatteredgate 5y ago
    You can just compare the APIs, namespaces are like the individual components of a jail. You can use them to build something like a jail, or something different that has a different security model. This was discussed a lot in an old HN thread: https://news.ycombinator.com/item?id=13982620 https://news.ycombinator.com/item?id=13982620
    - ori_b 5y ago
      Yes, I am aware that it's got more moving parts. What are you using this flexibility for?
      - shatteredgate 5y ago
        I'm using them for several things but the most straightforward one is probably that namespacing can be gradually added to services, you most likely see benefits from this already if you use systemd. That's one way that namespaces can be used in a different way from the docker model.
        ori_b 5y ago
        What are you adding gradually, specifically? Like, a concrete example that names a namespace you may want to use. I'm trying to figure out what problems a half sandbox solves, and a vague "I just want to enable some capabilities" doesn't help here.
        shatteredgate 5y ago
        A lot of the various security options in systemd: https://www.freedesktop.org/software/systemd/man/systemd.exec.html https://www.freedesktop.org/software/systemd/man/systemd.exe... The sandboxing and mount-related ones are implemented with namespaces, and the idea with them is to not make any of them mandatory so they can be slowly added to system services. That way you can get some of the benefits without needing to build a full rootfs/container for the service. I am not sure how any of those would be done with jails because jails require you to create a chroot and network interface, whereas in Linux the mount and network namespaces are just optional namespaces and you can still use the other namespaces without using them.
        shatteredgate 5y ago
        Side note: I suppose you could chroot to /.
        philkrylov 5y ago
        > jails require you to create a chroot and network interface, They don't: you may chroot to /, share the host's network interface, or disable networking.
    - trasz 5y ago
      This doesn't really answer the question. Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. One real difference is that you need to be root to create a jail. It'll get fixed eventually - FreeBSD already has unprivileged chroot, jail isn't that much different.
      - shatteredgate 5y ago
        >Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. Not really, the example of Docker would probably be the most straightforward there. I don't think it's possible to fully port Docker to jails or at least I've never seen a successful port, some of the network topology features seem to just not be possible or straightforward. But I could be wrong, I have not looked into the technical details of this in years, somebody told me it might have been working a while ago but I never heard anything else about it since. Needing to be root is a major deficiency though and I can't take jails seriously with that, one of the main focuses on Linux containers in the past several years has been to make unprivileged namespaces a good option.
        trasz 5y ago
        Docker is literally just a jail. You can do whatever network topology you want using vnet. And yes, having to use root is a major issue. Looks fixable though.
        shatteredgate 5y ago
        Sorry, then I must be remembering some other issue. The effort to port docker to BSD seems to have disappeared. >And yes, having to use root is a major issue. Looks fixable though. AFAIK it took a long time to get this to work on Linux, there are a lot of security issues that it can cause.
  - ajross 5y ago
    > How are people using this flexibility to get things done in practice Um... to loop back to the upthread point: Docker. People are using Docker, and docker is using this stuff.
    - ori_b 5y ago
      And how is it mixing and matching these APIs? Given that there's an OCI-compatible runner for jails (runj, compatible with runc -- which is what docker uses to start containers), it seems to me that Docker isn't in actually using the flexibility afforded by the APIs here, but is just using a relatively fixed set of options. If I'm wrong: what is it using, and what problems is this flexibility solving?
      - shatteredgate 5y ago
        I haven't tested runj but just from looking at it, it seems it is not fully compatible with everything that runc does because the OCI itself specifies a lot of Linux-specific functionality.
        trasz 5y ago
        Can you provide some examples?
      - ajross 5y ago
        runC is literally the abstraction layer docker wrote internally on top of linux containers! It exists as a separate layer now because they spun it out precisely to freeze the API and enable other efforts like runj. And runj, IIRC (though I'm not an expert in the space) wasn't a trivial 1:1 thing and required changes to the underlying jails layer to enable it.

StreamBright 5y ago

Well, looking at the following things sort of gives it away: - brtfs vs zfs - cgroups vs jails - SystemTap vs dtrace - Systemd vs smf I get it, many of these were due to licensing issues. So they said[1]. Anyways, there are still some things to implement for linux. pf is my favourite (software) firewall. It would be great to see it ported to Linux. 1. https://opensource.stackexchange.com/questions/2094/are-cddl-and-gpl-really-incompatible/2106 https://opensource.stackexchange.com/questions/2094/are-cddl...

shatteredgate 5y ago
In my experience, both Linux developers and BSD developers don't seem to care too much about porting things to the other's operating system. If you want to do things the Linux way you can use Linux, and if you want to do things the BSD way you can use BSD. That's seen as easier than trying to glue two incompatible things together.
- int_19h 5y ago
  BSD developers can't port things from Linux in a straightforward manner due to license issues. But that doesn't apply the other way around.
  - shatteredgate 5y ago
    I don't see why. BSD and GPL are equally compatible, it doesn't matter which way you go. I can see why they wouldn't want a GPL component to be mandatory but it can be made an optional component for Linux compatibility which seems to be the way BSD would want it anyway.
  - ajross 5y ago
    Won't, not can't. *BSDs shipped GPL components for decades before they decided to go for purity. It's a policy decision, not a incapability or mandate.
    - deleted 5y ago
      [deleted]