3 ms·

Same - we now use systemd to sandbox our apps, set resource limits, hide the rest of the system, mount read-only FS, etc. Add a custom SELinux policy for your s

by e1g 4y ago

Same - we now use systemd to sandbox our apps, set resource limits, hide the rest of the system, mount read-only FS, etc. Add a custom SELinux policy for your service, and you get a compelling alternative to containerization (at least at runtime).

GordonS 4y ago
Do you have a blog perchance? I'd love to read more about this, maybe with fully-featured examples.
- e1g 4y ago
  No, but here is one of our service files for systemd to manage a Node.js backend instance. Could be a useful starting point to create your own https://gist.github.com/eugene1g/22aa2b2c8897a29a54fba876b0cf88dd https://gist.github.com/eugene1g/22aa2b2c8897a29a54fba876b0c... Many sandboxing features require a relatively modern systemd and will do nothing on older distros (we run RHEL9).
  - GordonS 4y ago
    This is great, thanks, and I appreciate that's it's commented too! Also like the "negative" commented out config, that's something I often do myself with footguns that feel "obvious".
mike_hearn 4y ago
Yes, I reached the same conclusion when setting up the (fairly simple) servers needed for my company. SystemD + standard scripting can take you a long way, perhaps with Ansible if you need more. I've only used Kubernetes a bit, but I used Borg for quite some years. A fantastic system if you need an incredibly regularized prod environment with lots of replicas for everything i.e. if you're trying to replicate Google's internal setup. Extremely painful the moment you need to step outside that world. I had to do that once or twice at Google and quickly started wishing I could just grab some normal Linux machines and install some packages that depended on Apache and a DB. Actually said company makes packaging tools and Linux packages are fairly simple so we started with the ability to make server packages that use systemd. That support is still there and makes it fairly easy to build a signed apt repository from build system outputs (e.g. jars, native binaries), or even by re-packaging an existing server download [1]. What you get out is debs that start up the service on install, ensure it starts automatically at boot, restarts it across upgrades and shuts it down cleanly if the machine shuts down. Such packages can be built from any machine including Windows and macOS. The nice thing about doing packaging this way is you can specify dependencies (both install and service startup) on things like postgresql, and you get a template nginx/apache2 reverse proxy config as well. Unfortunately there doesn't seem to be a way to make those templates 100% usable out of the box due to limits in their config languages, but it's still nice to have. There's also pre-canned config snippets for sandboxing, setting up cron jobs and other useful systemd features [2]. We package and run all our servers this way. One big rented colo machine is sufficient right now. If there was a need for clustering we'd just point the machines at the same apt repo and use some shell scripting or Ansible, I think. There's lots of tools for making Docker containers out there already, but I never really clicked with Docker for various reasons. Conveyor is mostly focused on desktop apps but perhaps there's more demand for easily making systemd using packages than I thought. The server side support is there and we dogfood it, but isn't really advertised and it lacks a tutorial. [1] https://conveyor.hydraulic.dev/2.1/tasks/server/ https://conveyor.hydraulic.dev/2.1/tasks/server/ [2] https://conveyor.hydraulic.dev/2.1/stdlib/systemd/ https://conveyor.hydraulic.dev/2.1/stdlib/systemd/
xani_ 4y ago
More than that, you can automatically mount whole block device (or file-as-device), even run integrity checks on it. If someone is building say an embedded system that has to run different services (say a NAS, or a router), it's pretty compelling alternative to a bit more heavy weight containers like docker.
sass_muffin 4y ago
How do you scale across multiple computers reliably?
doublerebel 4y ago
This sounds like SMF on Solaris (and derivatives). I used that pattern successfully on Illumos/SmartOS for several years.

by e1g 4y ago

GordonS 4y ago

Do you have a blog perchance? I'd love to read more about this, maybe with fully-featured examples.

e1g 4y ago
No, but here is one of our service files for systemd to manage a Node.js backend instance. Could be a useful starting point to create your own https://gist.github.com/eugene1g/22aa2b2c8897a29a54fba876b0cf88dd https://gist.github.com/eugene1g/22aa2b2c8897a29a54fba876b0c... Many sandboxing features require a relatively modern systemd and will do nothing on older distros (we run RHEL9).
- GordonS 4y ago
  This is great, thanks, and I appreciate that's it's commented too! Also like the "negative" commented out config, that's something I often do myself with footguns that feel "obvious".

mike_hearn 4y ago

Yes, I reached the same conclusion when setting up the (fairly simple) servers needed for my company. SystemD + standard scripting can take you a long way, perhaps with Ansible if you need more. I've only used Kubernetes a bit, but I used Borg for quite some years. A fantastic system if you need an incredibly regularized prod environment with lots of replicas for everything i.e. if you're trying to replicate Google's internal setup. Extremely painful the moment you need to step outside that world. I had to do that once or twice at Google and quickly started wishing I could just grab some normal Linux machines and install some packages that depended on Apache and a DB. Actually said company makes packaging tools and Linux packages are fairly simple so we started with the ability to make server packages that use systemd. That support is still there and makes it fairly easy to build a signed apt repository from build system outputs (e.g. jars, native binaries), or even by re-packaging an existing server download [1]. What you get out is debs that start up the service on install, ensure it starts automatically at boot, restarts it across upgrades and shuts it down cleanly if the machine shuts down. Such packages can be built from any machine including Windows and macOS. The nice thing about doing packaging this way is you can specify dependencies (both install and service startup) on things like postgresql, and you get a template nginx/apache2 reverse proxy config as well. Unfortunately there doesn't seem to be a way to make those templates 100% usable out of the box due to limits in their config languages, but it's still nice to have. There's also pre-canned config snippets for sandboxing, setting up cron jobs and other useful systemd features [2]. We package and run all our servers this way. One big rented colo machine is sufficient right now. If there was a need for clustering we'd just point the machines at the same apt repo and use some shell scripting or Ansible, I think. There's lots of tools for making Docker containers out there already, but I never really clicked with Docker for various reasons. Conveyor is mostly focused on desktop apps but perhaps there's more demand for easily making systemd using packages than I thought. The server side support is there and we dogfood it, but isn't really advertised and it lacks a tutorial. [1] https://conveyor.hydraulic.dev/2.1/tasks/server/ https://conveyor.hydraulic.dev/2.1/tasks/server/ [2] https://conveyor.hydraulic.dev/2.1/stdlib/systemd/ https://conveyor.hydraulic.dev/2.1/stdlib/systemd/

xani_ 4y ago

More than that, you can automatically mount whole block device (or file-as-device), even run integrity checks on it. If someone is building say an embedded system that has to run different services (say a NAS, or a router), it's pretty compelling alternative to a bit more heavy weight containers like docker.

sass_muffin 4y ago

How do you scale across multiple computers reliably?

doublerebel 4y ago

This sounds like SMF on Solaris (and derivatives). I used that pattern successfully on Illumos/SmartOS for several years.