6 ms·

You actually don't need that all packaging stuff for ease-of-use much. Compile your application with required libraries to a subfolder, define the jail's root a

You actually don't need that all packaging stuff for ease-of-use much. Compile your application with required libraries to a subfolder, define the jail's root as that subfolder, and fire the app. It's similar under Linux's CGroups. You fire the binary inside another CGroup and, that application thinks that it's the only thing on the machine, and may feel a little lonely, with its own IP and isolated network stack and such.

yjftsjthsd-h 3y ago
> You actually don't need that all packaging stuff for ease-of-use much. Compile your application with required libraries to a subfolder, define the jail's root as that subfolder, and fire the app. I can download and run anything in any accessible OCI registry with a single `docker run` command. The only thing I've seen that makes jails even remotely close to being as easy and quick to use... is using runj to recreate the same experience. > It's similar under Linux's CGroups. You fire the binary inside another CGroup and, that application thinks that it's the only thing on the machine, and may feel a little lonely, with its own IP and isolated network stack and such. Yeah, I know how the isolation features work, my point is that they're not nearly as important. For the vast majority of docker use, you could replace the actual container with chroot and not really make any difference, and the chroot is only to save the trouble of having to modify the application to handle host paths, not as a security barrier. Docker's killer feature isn't containers, it's images that are easy to move around and run, and to slightly lesser degree Dockerfiles that provided a standardized format to describe how to build those images. I love FreeBSD, but I think this kind of illustrates how the community has really dropped the ball on containers: Nobody cares that jails are technically superior and far more elegant under the hood, or that they've been here longer than on linux, or whether their security position is better. Docker was and is overwhelmingly better UX; all the under the hood stuff is effectively irrelevant to users.
- bayindirh 3y ago
  Well, not all shops just blindly install docker, pull a docker compose stack and call it day. Many of us out there compile their apps, stash into a cgroup or a jail and fire it. Just because mainstream developers using "that one thing", it doesn't mean that the whole world has abandoned other ways to do things. I personally doesn't pull any big software package from an OCI registry, because I don't trust the installation and don't like the reduced configurability of the packages involved. If I'm lazy for that day, I pull Debian minimal, build the thing I need, push to our local registry and call it a day. Otherwise I install that thing properly, run it under cgroups, or under its own VM if the workload warrants it, and get a mug of coffee. > Nobody cares that jails are technically superior and far more elegant under the hood... Believe me, some shops care.
  - yjftsjthsd-h 3y ago
    > Many of us out there compile their apps, stash into a cgroup or a jail and fire it. > If I'm lazy for that day, I pull Debian minimal, build the thing I need, push to our local registry and call it a day. I'm 100% sympathetic to not using public images, but it really sounds like you've just re-invented docker with extra steps. Or in the second case, like you are using docker just without the public images?
    - bayindirh 3y ago
      First case is not re-inventing Docker, it's just not changing our ways. We continue doing what we're doing, but using modern facilities to isolate or resource-control the workload we're running. In the second case, the only thing I pull is "Debian Slim" from the public repo. Since I'm using Debian for a very long time, I can actually verify down to last bit (package/binary checksums, etc.). Then built the rest from the source + Debian repositories inside a Dockerfile. I push the container to local registry, and Dockerfile to our local Git server.
  - throw0101c 3y ago
    > Well, not all shops just blindly install docker, pull a docker compose stack and call it day. "Hitler uses Docker": * https://www.youtube.com/watch?v=PivpCKEiQOQ https://www.youtube.com/watch?v=PivpCKEiQOQ

yjftsjthsd-h 3y ago

> You actually don't need that all packaging stuff for ease-of-use much. Compile your application with required libraries to a subfolder, define the jail's root as that subfolder, and fire the app. I can download and run anything in any accessible OCI registry with a single `docker run` command. The only thing I've seen that makes jails even remotely close to being as easy and quick to use... is using runj to recreate the same experience. > It's similar under Linux's CGroups. You fire the binary inside another CGroup and, that application thinks that it's the only thing on the machine, and may feel a little lonely, with its own IP and isolated network stack and such. Yeah, I know how the isolation features work, my point is that they're not nearly as important. For the vast majority of docker use, you could replace the actual container with chroot and not really make any difference, and the chroot is only to save the trouble of having to modify the application to handle host paths, not as a security barrier. Docker's killer feature isn't containers, it's images that are easy to move around and run, and to slightly lesser degree Dockerfiles that provided a standardized format to describe how to build those images. I love FreeBSD, but I think this kind of illustrates how the community has really dropped the ball on containers: Nobody cares that jails are technically superior and far more elegant under the hood, or that they've been here longer than on linux, or whether their security position is better. Docker was and is overwhelmingly better UX; all the under the hood stuff is effectively irrelevant to users.

bayindirh 3y ago
Well, not all shops just blindly install docker, pull a docker compose stack and call it day. Many of us out there compile their apps, stash into a cgroup or a jail and fire it. Just because mainstream developers using "that one thing", it doesn't mean that the whole world has abandoned other ways to do things. I personally doesn't pull any big software package from an OCI registry, because I don't trust the installation and don't like the reduced configurability of the packages involved. If I'm lazy for that day, I pull Debian minimal, build the thing I need, push to our local registry and call it a day. Otherwise I install that thing properly, run it under cgroups, or under its own VM if the workload warrants it, and get a mug of coffee. > Nobody cares that jails are technically superior and far more elegant under the hood... Believe me, some shops care.
- yjftsjthsd-h 3y ago
  > Many of us out there compile their apps, stash into a cgroup or a jail and fire it. > If I'm lazy for that day, I pull Debian minimal, build the thing I need, push to our local registry and call it a day. I'm 100% sympathetic to not using public images, but it really sounds like you've just re-invented docker with extra steps. Or in the second case, like you are using docker just without the public images?
  - bayindirh 3y ago
    First case is not re-inventing Docker, it's just not changing our ways. We continue doing what we're doing, but using modern facilities to isolate or resource-control the workload we're running. In the second case, the only thing I pull is "Debian Slim" from the public repo. Since I'm using Debian for a very long time, I can actually verify down to last bit (package/binary checksums, etc.). Then built the rest from the source + Debian repositories inside a Dockerfile. I push the container to local registry, and Dockerfile to our local Git server.
- throw0101c 3y ago
  > Well, not all shops just blindly install docker, pull a docker compose stack and call it day. "Hitler uses Docker": * https://www.youtube.com/watch?v=PivpCKEiQOQ https://www.youtube.com/watch?v=PivpCKEiQOQ