3 ms·

Genuine question: is Docker the best available option for creating such sandboxes? It feels like a fairly roundabout way for getting what should be an OS primit

Genuine question: is Docker the best available option for creating such sandboxes? It feels like a fairly roundabout way for getting what should be an OS primitive for isolating processes. Are chroots generically worse in some dimension? How does Flatpak or Bazel handle the situation of limiting the runtime environment? I love the goal of reducing the potential for malfeasance (plus some reproducibility wins likely come along for the ride), but leaning towards Docker feels heavier than required. Plus, inevitably makes it more difficult to work in Windows or Mac.

insanitybit 4y ago
(Author here) Docker basically packages together a bunch of technologies into something very usable and, at this point, pretty standard. So I could do some of this stuff using chroots, namespaces, and manually fixing up filesystems... but then I'll just reimplement a worse, less standard Docker. For example, I use cache mounts to get improved performance across executions. Writing that manually is going to involve mantaining a database and cache eviction policies and whatnot. Docker's actually quite lightweight for that same sort of reason. It's basically just "coordinator for a bunch of stuff already built into Linux". If I had to manually implement the sandbox it would be a massive amount of work for no real gain imo. > Plus, inevitably makes it more difficult to work in Windows or Mac. It's way easier to use Docker for Windows/ OSX than it is for me to build a custom sandbox/ CoW system for them, and things will get better on those operating systems for Docker without me having to do work.