4 ms·

Why not use any of the existing OCI Runtimes? They take well-defined[0] JSON description as input, and are pretty well-contained (single static binary). And bec

Why not use any of the existing OCI Runtimes? They take well-defined[0] JSON description as input, and are pretty well-contained (single static binary). And because they are separate binaries, not libraries, you don't need to worry about things like thread safety or FD leaking. [0] https://github.com/opencontainers/runtime-spec/blob/main/config.md https://github.com/opencontainers/runtime-spec/blob/main/con...

r3trohack3r 2y ago
I’m currently exploring this for an AI context because I haven’t found a better solution for letting K8S manage AI workloads that need direct GPU access on OSx
- brcmthrowaway 2y ago
  Why are you building AI anything
- pm90 2y ago
  You're running a kubernetes cluster with nodes that are running OSx?
- denhamparry 2y ago
  Edera developer here. Edera Protect is being developed to manage access to the GPU hardware on a Node with the containers running your workloads. We talk a lot about isolation between containers, but we're also focused on adding this isolation throughout the stack, from containers/processes down to hardware.
  - r3trohack3r 2y ago
    Sounds compelling - I can’t see any mention of apple silicon on your site, any intention of supporting it?
harha_ 2y ago
The beginning of the article answers to your question.
zamalek 2y ago
"I don't need the full capabilities of OCI." In my (now very much stagnating) Nix-like pet project[1] I merely want a hermetic build environment. Rolling my own container runtime was no more difficult than, what would likely be, a nightmare of emulating a complete OCI container for the simple purpose that I'm after. Simple problems need simple solutions, and OCI is really complex. I was initially overjoyed by the prospect of deleting my code, but it looks like this project doesn't have rootless/shadowutils support yet (which is solely useful for not having to worry about su or caps during development). [1]: https://github.com/porkg/porkg/tree/rs https://github.com/porkg/porkg/tree/rs

r3trohack3r 2y ago

I’m currently exploring this for an AI context because I haven’t found a better solution for letting K8S manage AI workloads that need direct GPU access on OSx

brcmthrowaway 2y ago
Why are you building AI anything
pm90 2y ago
You're running a kubernetes cluster with nodes that are running OSx?
denhamparry 2y ago
Edera developer here. Edera Protect is being developed to manage access to the GPU hardware on a Node with the containers running your workloads. We talk a lot about isolation between containers, but we're also focused on adding this isolation throughout the stack, from containers/processes down to hardware.
- r3trohack3r 2y ago
  Sounds compelling - I can’t see any mention of apple silicon on your site, any intention of supporting it?

harha_ 2y ago

The beginning of the article answers to your question.

zamalek 2y ago

"I don't need the full capabilities of OCI." In my (now very much stagnating) Nix-like pet project[1] I merely want a hermetic build environment. Rolling my own container runtime was no more difficult than, what would likely be, a nightmare of emulating a complete OCI container for the simple purpose that I'm after. Simple problems need simple solutions, and OCI is really complex. I was initially overjoyed by the prospect of deleting my code, but it looks like this project doesn't have rootless/shadowutils support yet (which is solely useful for not having to worry about su or caps during development). [1]: https://github.com/porkg/porkg/tree/rs https://github.com/porkg/porkg/tree/rs