5 ms·

> Many FreeBSD devs praise launchd, well... systemd is a clone of launchd. No they are not. Systemd has a way bigger scope then launchd. It's like saying a tru

> Many FreeBSD devs praise launchd, well... systemd is a clone of launchd. No they are not. Systemd has a way bigger scope then launchd. It's like saying a truck is the same thing as a family car because they both solve the mobility problem. > FreeBSD jail are sub-optimal compared to systemd-nspawn. systemd-nspawn isn't a container. For example it doesn't manage resources such as CPU or IO. Again, the scope is way different and in this case there is a whole slew of things systemd-nspawn isn't going to manage for you. BTW launchd doesn't have a feature like 'systemd-nspawn'. > Lack of security modules (such as SELinux) -- Edit: I should have written "Lack of good security module" And how is SELinux a good security module? SELinux with it's design fell in the same pitfall dozens of security systems did before it; ACL-Hell, Role-hell and now with SELinux we also have Label-hell.

acatton 5y ago
> systemd-nspawn isn't a container. For example it doesn't manage resources such as CPU or IO. Again, the scope is way different and in this case there is a whole slew of things systemd-nspawn isn't going to manage for you. It does[1]. At the end systemd-nspawn runs in a unit, which can be (like all systemd unit) resource-controlled. > BTW launchd doesn't have a feature like 'systemd-nspawn'. Neither does systemd. systemd-nspawn is just another binary, like git ant git-annex. The only difference from git and git-annex is that systemd and systemd-nspawn are maintained by the same team. But like git and git-annex, most systemd installations don't have systemd-nspawn, but systemd-nspawn needs systemd. > And how is SELinux a good security module? SELinux with it's design fell in the same pitfall dozens of security systems did before it; ACL-Hell, Role-hell and now with SELinux we also have Label-hell. SELinux is generic enough to allow for sandboxing of services. But in its mainstream use, SELinux is well design that it allows for reuse of policies. Most people don't care about SELinux, they just run CentOS, install RPM from the repository, and everything works out of the box with heighten security. (= if there is a vulnerability in any of these packages, the radius-blast of the attack is limited thanks to SELinux's Mandatory-Access-Control) [1] https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html https://www.freedesktop.org/software/systemd/man/systemd.res...
- chungy 5y ago
  > but systemd-nspawn needs systemd. That's not, strictly speaking, true. systemd-nspawn is able to do the cgroups-based containers fine without systemd as init, though you do lack some of the fancier resource control and networking features.
nottorp 5y ago
> Systemd has a way bigger scope then launchd. I hear it's taken over dns. Has it taken over sound too? When will it be able to read mail?
- Arnavion 5y ago
  systemd the init system has nothing to do with DNS. systemd the family of tools has a DNS server, systemd-resolved. Like all other tools in the family, using the init system does not require using the other tools, and sometimes also vice versa. In the broader "Poetteringware" family of tools, sound is handled by pulseaudio, though the server side of pulseaudio is in the process of being replaced by pipewire.
  - sascha_sl 5y ago
    I'm sure someone is about to bring up logind.
  - nottorp 5y ago
    Is it pulseaudio or systemd-pulseaudio now? :)
  - nottorp 5y ago
    > systemd the init system has nothing to do with DNS. And btw is that why systemd using distros lock up for minutes on boot if the machine doesn't have internet connectivity?
goodpoint 5y ago
> systemd-nspawn isn't a container. For example it doesn't manage resources such as CPU or IO. False. > And how is SELinux a good security module? It's good enough for most environments requiring RBAC. Additionally, it's complemented by the excellent sandboxing ability of SystemD unit files.

acatton 5y ago

> systemd-nspawn isn't a container. For example it doesn't manage resources such as CPU or IO. Again, the scope is way different and in this case there is a whole slew of things systemd-nspawn isn't going to manage for you. It does[1]. At the end systemd-nspawn runs in a unit, which can be (like all systemd unit) resource-controlled. > BTW launchd doesn't have a feature like 'systemd-nspawn'. Neither does systemd. systemd-nspawn is just another binary, like git ant git-annex. The only difference from git and git-annex is that systemd and systemd-nspawn are maintained by the same team. But like git and git-annex, most systemd installations don't have systemd-nspawn, but systemd-nspawn needs systemd. > And how is SELinux a good security module? SELinux with it's design fell in the same pitfall dozens of security systems did before it; ACL-Hell, Role-hell and now with SELinux we also have Label-hell. SELinux is generic enough to allow for sandboxing of services. But in its mainstream use, SELinux is well design that it allows for reuse of policies. Most people don't care about SELinux, they just run CentOS, install RPM from the repository, and everything works out of the box with heighten security. (= if there is a vulnerability in any of these packages, the radius-blast of the attack is limited thanks to SELinux's Mandatory-Access-Control) [1] https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html https://www.freedesktop.org/software/systemd/man/systemd.res...

chungy 5y ago
> but systemd-nspawn needs systemd. That's not, strictly speaking, true. systemd-nspawn is able to do the cgroups-based containers fine without systemd as init, though you do lack some of the fancier resource control and networking features.

nottorp 5y ago

> Systemd has a way bigger scope then launchd. I hear it's taken over dns. Has it taken over sound too? When will it be able to read mail?

Arnavion 5y ago
systemd the init system has nothing to do with DNS. systemd the family of tools has a DNS server, systemd-resolved. Like all other tools in the family, using the init system does not require using the other tools, and sometimes also vice versa. In the broader "Poetteringware" family of tools, sound is handled by pulseaudio, though the server side of pulseaudio is in the process of being replaced by pipewire.
- sascha_sl 5y ago
  I'm sure someone is about to bring up logind.
- nottorp 5y ago
  Is it pulseaudio or systemd-pulseaudio now? :)
- nottorp 5y ago
  > systemd the init system has nothing to do with DNS. And btw is that why systemd using distros lock up for minutes on boot if the machine doesn't have internet connectivity?

goodpoint 5y ago

> systemd-nspawn isn't a container. For example it doesn't manage resources such as CPU or IO. False. > And how is SELinux a good security module? It's good enough for most environments requiring RBAC. Additionally, it's complemented by the excellent sandboxing ability of SystemD unit files.