3 ms·

No questions yet as I am yet to read ... but I can already comment and say grade A title.

• cryptonector 5y ago
  It's a bit opinionated. It's meant to get a reaction, but also to have meaningful and thought-provoking content, and I think it's correct in the main too. Anyways, hope you and others enjoy it.
  • ahmedalsudani 5y ago
    That was a great read. Thank you for writing it up; I learned quite a few things! Especially appreciated the OS minutiae and opinionated commentary (... and the doc vs reality observation in Linux's vfork). The piece lives up to the great title :)
  • disgruntledphd2 5y ago
    What do you mean by zones/jails and why are they better than containers?
    • cryptonector 5y ago
      Zones -> Solaris/Illumos Zones Jails -> BSD jails They're software VMs. It's a lot like containers, yes. The problem with containers is that the construction toolkit for them is subtractive ("start by cloning my environment, then remove / replace various namespaces"), while the construction toolkit for zones/jails is additive ("start with an empty universe, and add namespaces or share them with the parent"). Constructing containers subtractively means that every time there's a new kind of namespace to virtualize, you have to update all container-creating tools or risk a security vulnerability. Constructing containers additively from an empty universe means that every time there's a new kind of namespace to virtualize, you have to update all container-creating tools or risk not getting sharing that you want (i.e., breakage). I'm placing a higher value on security. Maybe that's a bad choice. It's not like breaking is a good thing -- it might be just as bad as creating a security vulnerability.
      • ape4 5y ago
        Yes if we starting again today, we wouldn't do containers as they are now.