4 ms·

> If you're only used to cloud VMs that are setup for a single user or service, I guess your views would be different. This is overwhelmingly the view for busi

> If you're only used to cloud VMs that are setup for a single user or service, I guess your views would be different. This is overwhelmingly the view for business and personal users. Settings like what you described are very rare nowadays. No corporate IT department is timesharing users on a mainframe. It's just baremetal laptops or VMs on Windows with networked mountpoints.

mbreese 2y ago
Multi-user clusters are still quite common in HPC. And I think you're not going to see a switch away from multi-user systems anytime soon. Single user systems like laptops might be a good use-case, but even the laptop I'm using now has different accounts for me and my wife (and it's a Mac). When you have one OS that is used on devices from phones, to laptops, to servers, to HPC clusters, you're going to have this friction. Could Linux operate in a single-user mode? Of course. But does that really make sense for the other use-cases?
- airocker 2y ago
  you could potentially create multiple containers in that machine which are single user and give to every user who needs access. CPU/Memory/GPU can be assigned in any way you want(shared/not shared). Now no user can mess up another user.
  - SoftTalker 2y ago
    It's not "that machine" it's a cluster of dozens or hundreds of machines that is partitioned in various ways and runs batch jobs submitted via a queuing system (probably slurm).
  - wongarsu 2y ago
    Isn't that just reinventing multiuser operating systems? Normal Linux already has the property that no user can mess up any other user (unless they are root or have sudo rights)
    - airocker 2y ago
      no it is not
  - weebull 2y ago
    Not containers, but cgroups, and that is how HPC clusters work today. You still need multiple users though.
- whimsicalism 2y ago
  is it? most HPC (if GPU clusters count) are probably in industry and managed by containers
  - birdiesanders 2y ago
    Containers rely on many privilege separation systems to do what they do, they are in fact a rather extreme case of multi-user systems, but they tend to present as “single” user environs to the container’s processes.
    - airocker 2y ago
      Good software hides complexity. User does not have to understand user group permissions suid etc etc
    - whimsicalism 2y ago
      > they are in fact a rather extreme case of multi-user systems Are they? My understanding was that by default, the `dockerd` (or whatever) is root and then all containers map to the same non-privileged user.
  - bayindirh 2y ago
    HPC admin here. Yes. First, we use user level container systems like apptainer/singularity, and these containers run under the user itself. This is also same for non academic HPC systems. From schedulers to accounting, everything is done at user level, and we have many, many users. It won’t change anytime soon.
    - pankajkumar229 2y ago
      there is no reason for users to be maintained in the kernel.
      - bayindirh 2y ago
        Can you elaborate on that?
twic 2y ago
I wonder if they might be more common than you think. You will never see someone standing up at a conference and describing this setup, but there are millions of machines out there quietly doing work which are run by people who do not speak at conferences. Where i work, we have a lot of physical machines. The IT staff own the root account, and development teams get some sort of normal user accounts, with highly restricted sudo.
inopinatus 2y ago
> No corporate IT department is timesharing users on a mainframe Not a mainframe perhaps, but this sentiment is flat wrong otherwise, because that is how Citrix and RDS (fka Terminal Server) do app virtualization. It's an approach in widespread use both for enterprise mobile/remote access, and for thin clients in point of sale or booth applications. What's more, a *nix as the underlying infrastructure is far from unusual. I have first-hand insider knowledge of two financial institutions that prefer this delivery model to manage the attack surface in retail settings, and a supermarket chain that prefers it because employee theft is seen as a problem. It’s also a model that is easy to describe and pitch to corporate CIOs, which is undoubtedly a merit in the eyes of many project managers. One of the above financial institutions actually does still have an entire department of users logged in to an S/390 rented from IBM. They’ve been trying to discontinue the mainframe for years. I’m told there are similar continuing circumstances in airline reservations and credit card schemes; not just transaction processing, but connected interactive user sessions. This is what corporate IT actually looks like. It is super different to the tech environments and white-collar head offices many of us think are the universal exemplar.

mbreese 2y ago

Multi-user clusters are still quite common in HPC. And I think you're not going to see a switch away from multi-user systems anytime soon. Single user systems like laptops might be a good use-case, but even the laptop I'm using now has different accounts for me and my wife (and it's a Mac). When you have one OS that is used on devices from phones, to laptops, to servers, to HPC clusters, you're going to have this friction. Could Linux operate in a single-user mode? Of course. But does that really make sense for the other use-cases?

airocker 2y ago
you could potentially create multiple containers in that machine which are single user and give to every user who needs access. CPU/Memory/GPU can be assigned in any way you want(shared/not shared). Now no user can mess up another user.
- SoftTalker 2y ago
  It's not "that machine" it's a cluster of dozens or hundreds of machines that is partitioned in various ways and runs batch jobs submitted via a queuing system (probably slurm).
- wongarsu 2y ago
  Isn't that just reinventing multiuser operating systems? Normal Linux already has the property that no user can mess up any other user (unless they are root or have sudo rights)
  - airocker 2y ago
    no it is not
- weebull 2y ago
  Not containers, but cgroups, and that is how HPC clusters work today. You still need multiple users though.
whimsicalism 2y ago
is it? most HPC (if GPU clusters count) are probably in industry and managed by containers
- birdiesanders 2y ago
  Containers rely on many privilege separation systems to do what they do, they are in fact a rather extreme case of multi-user systems, but they tend to present as “single” user environs to the container’s processes.
  - airocker 2y ago
    Good software hides complexity. User does not have to understand user group permissions suid etc etc
  - whimsicalism 2y ago
    > they are in fact a rather extreme case of multi-user systems Are they? My understanding was that by default, the `dockerd` (or whatever) is root and then all containers map to the same non-privileged user.
- bayindirh 2y ago
  HPC admin here. Yes. First, we use user level container systems like apptainer/singularity, and these containers run under the user itself. This is also same for non academic HPC systems. From schedulers to accounting, everything is done at user level, and we have many, many users. It won’t change anytime soon.
  - pankajkumar229 2y ago
    there is no reason for users to be maintained in the kernel.
    - bayindirh 2y ago
      Can you elaborate on that?

twic 2y ago

I wonder if they might be more common than you think. You will never see someone standing up at a conference and describing this setup, but there are millions of machines out there quietly doing work which are run by people who do not speak at conferences. Where i work, we have a lot of physical machines. The IT staff own the root account, and development teams get some sort of normal user accounts, with highly restricted sudo.

inopinatus 2y ago

> No corporate IT department is timesharing users on a mainframe Not a mainframe perhaps, but this sentiment is flat wrong otherwise, because that is how Citrix and RDS (fka Terminal Server) do app virtualization. It's an approach in widespread use both for enterprise mobile/remote access, and for thin clients in point of sale or booth applications. What's more, a *nix as the underlying infrastructure is far from unusual. I have first-hand insider knowledge of two financial institutions that prefer this delivery model to manage the attack surface in retail settings, and a supermarket chain that prefers it because employee theft is seen as a problem. It’s also a model that is easy to describe and pitch to corporate CIOs, which is undoubtedly a merit in the eyes of many project managers. One of the above financial institutions actually does still have an entire department of users logged in to an S/390 rented from IBM. They’ve been trying to discontinue the mainframe for years. I’m told there are similar continuing circumstances in airline reservations and credit card schemes; not just transaction processing, but connected interactive user sessions. This is what corporate IT actually looks like. It is super different to the tech environments and white-collar head offices many of us think are the universal exemplar.