5 ms·

barco is a project I worked on to learn more about Linux containers and the Linux kernel, based on other guides on the internet.

intelVISA 3y ago
awesome, thx for sharing this :)
metadat 3y ago
How did you come up with the name "Barco"?
- voidmain0001 3y ago
  It’s Spanish for boat.
- 29athrowaway 3y ago
  docker has to do with ships and barco means ship.
  - ofrzeta 3y ago
    It's funny that three people feel the urge to reply for the author and all of them are wrong :-) Also I find it interesting that in Portuguese as well as in Spanish the word exists in both genders: el barco, la barca, o barco, a barca.
    - darkwater 3y ago
      At least in Spanish, my rule of thumb is that "barco" is for bigger boats and "barca" is for smaller ones (and then you have Barça which is the football/soccer team).
      - loloquwowndueo 3y ago
        Barça looks similar but is pronounced entirely differently (say “barsa”).
    - quickthrower2 3y ago
      It is wrong but coincidently in a way that aligns with the sea-fairing theme
- lcvln 3y ago
  It's Venetian (my native language) for "hay barrack": http://vec.wikipedia.org/wiki/Barco http://vec.wikipedia.org/wiki/Barco
- mlashcorp 3y ago
  Also, Portuguese for boat.
murphyslaw 3y ago
This could be quite useful in a CS course on containers.
teleforce 3y ago
Looks like a good project to learn container from scratch. Just wondering the main reason you're C since most of the container project now seems to be using Go or Rust?
- cyphar 3y ago
  As the maintainer of a Go container runtime (runc), and having worked with Rust in various other projects, while they can be better languages for building large projects, they make it harder to understand what exactly your program is doing when writing software like this. One example that immediately comes to mind from Rust is a bug with O_PATH file descriptors I found a while ago[1], which would've made certain code we use in runc not work. And from Go, here is a bug I just found in their code for handling file descriptors for ForkExec[2] which is causing issues in a runc patch I'm working on. Neither of these issues exist in C programs. Though of course, C programs have their own issues. For better or worse, the Linux kernel APIs are easiest to use from C. In runc we actually implement the core container setup code in C because Go doesn't allow you to do everything we need for setting up a container (it has gotten better though, in the past it was completely impossible to set up a container properly in pure Go -- now you can set one up but there are still certain configurations that are not possible to implement in pure Go, such as "docker exec"). You also cannot run Go in single-threaded mode, which means that certain kernel APIs (unshare(CLONE_NEWUSER) for instance) simply cannot be used from regular Go code. [1]: https://github.com/rust-lang/rust/issues/62314 https://github.com/rust-lang/rust/issues/62314 [2]: https://github.com/golang/go/issues/61751 https://github.com/golang/go/issues/61751
  - bheadmaster 3y ago
    Wouldn't "runtime.LockOSThead()" help with the single-threaded API?
    - cyphar 3y ago
      No, that only pins the current goroutine to a single OS thread (which is needed for some APIs -- namely, all of the other namespace APIs and some thread-related APIs). There is no way to make an entire Go program run as a single threaded program without using CGo the way we do in runc. Even GOMAXPROCS=1 doesn't work. CLONE_NEWUSER will always fail in a multi-threaded program.

intelVISA 3y ago

awesome, thx for sharing this :)

metadat 3y ago

How did you come up with the name "Barco"?

voidmain0001 3y ago
It’s Spanish for boat.
29athrowaway 3y ago
docker has to do with ships and barco means ship.
- ofrzeta 3y ago
  It's funny that three people feel the urge to reply for the author and all of them are wrong :-) Also I find it interesting that in Portuguese as well as in Spanish the word exists in both genders: el barco, la barca, o barco, a barca.
  - darkwater 3y ago
    At least in Spanish, my rule of thumb is that "barco" is for bigger boats and "barca" is for smaller ones (and then you have Barça which is the football/soccer team).
    - loloquwowndueo 3y ago
      Barça looks similar but is pronounced entirely differently (say “barsa”).
  - quickthrower2 3y ago
    It is wrong but coincidently in a way that aligns with the sea-fairing theme
lcvln 3y ago
It's Venetian (my native language) for "hay barrack": http://vec.wikipedia.org/wiki/Barco http://vec.wikipedia.org/wiki/Barco
mlashcorp 3y ago
Also, Portuguese for boat.

murphyslaw 3y ago

This could be quite useful in a CS course on containers.

teleforce 3y ago

Looks like a good project to learn container from scratch. Just wondering the main reason you're C since most of the container project now seems to be using Go or Rust?

cyphar 3y ago
As the maintainer of a Go container runtime (runc), and having worked with Rust in various other projects, while they can be better languages for building large projects, they make it harder to understand what exactly your program is doing when writing software like this. One example that immediately comes to mind from Rust is a bug with O_PATH file descriptors I found a while ago[1], which would've made certain code we use in runc not work. And from Go, here is a bug I just found in their code for handling file descriptors for ForkExec[2] which is causing issues in a runc patch I'm working on. Neither of these issues exist in C programs. Though of course, C programs have their own issues. For better or worse, the Linux kernel APIs are easiest to use from C. In runc we actually implement the core container setup code in C because Go doesn't allow you to do everything we need for setting up a container (it has gotten better though, in the past it was completely impossible to set up a container properly in pure Go -- now you can set one up but there are still certain configurations that are not possible to implement in pure Go, such as "docker exec"). You also cannot run Go in single-threaded mode, which means that certain kernel APIs (unshare(CLONE_NEWUSER) for instance) simply cannot be used from regular Go code. [1]: https://github.com/rust-lang/rust/issues/62314 https://github.com/rust-lang/rust/issues/62314 [2]: https://github.com/golang/go/issues/61751 https://github.com/golang/go/issues/61751
- bheadmaster 3y ago
  Wouldn't "runtime.LockOSThead()" help with the single-threaded API?
  - cyphar 3y ago
    No, that only pins the current goroutine to a single OS thread (which is needed for some APIs -- namely, all of the other namespace APIs and some thread-related APIs). There is no way to make an entire Go program run as a single threaded program without using CGo the way we do in runc. Even GOMAXPROCS=1 doesn't work. CLONE_NEWUSER will always fail in a multi-threaded program.