4 ms·

What do you mean by zones/jails and why are they better than containers?

• cryptonector 5y ago
  Zones -> Solaris/Illumos Zones Jails -> BSD jails They're software VMs. It's a lot like containers, yes. The problem with containers is that the construction toolkit for them is subtractive ("start by cloning my environment, then remove / replace various namespaces"), while the construction toolkit for zones/jails is additive ("start with an empty universe, and add namespaces or share them with the parent"). Constructing containers subtractively means that every time there's a new kind of namespace to virtualize, you have to update all container-creating tools or risk a security vulnerability. Constructing containers additively from an empty universe means that every time there's a new kind of namespace to virtualize, you have to update all container-creating tools or risk not getting sharing that you want (i.e., breakage). I'm placing a higher value on security. Maybe that's a bad choice. It's not like breaking is a good thing -- it might be just as bad as creating a security vulnerability.
  • ape4 5y ago
    Yes if we starting again today, we wouldn't do containers as they are now.