4 ms·
From my limited experience I don't see many containerized apps end up using newer syscalls. We're only recently getting io-uring (with its array of security de
by worthless-trash 2y ago
From my limited experience I don't see many containerized apps end up using newer syscalls. We're only recently getting io-uring (with its array of security defeating side affects) in containers.
Business software moves much slower than consumer software, i expect that LTS ends up sucking less when they can control the userspace around their application.
- tapoxi 2y agoeBPF potentially? There's a lot of security tooling out there (Wiz agent etc) that would assume a newer kernel on the node.
- worthless-trash 2y agoYeah, eBPF is another one of those speculative execution improvement tools. I haven't had a chance to look at Wiz, I would assume they would make their own kernel module that inspects things based on a very slim ABI requirement. Their customer base (according to their page) is fortune 500 companies, most of those only move off unsupported releases when they are forced to, it is unlikely they use new syscalls.
- inahga 2y agoOTOH off the shelf software distributed for Kubernetes IME does tend to pick up on new control plane features fairly regularly. I’ve historically tracked n-1 or n-2 of k8s, and it is not infrequent that we can’t take a helm chart update until we update k8s.