3 ms·

Have you considered running Docker on the embedded device?

• jasomill 3mo ago
  That sounds like a heavier-weight wrapper over the same system services they're using through systemd today. It could be useful if updating is a pain point. In this case, they may also consider Podman, as it has excellent systemd integration[1] including rudimentary container orchestration and the ability to auto-update containers and Kubernetes-style pods installed as systemd units. I've run Pihole under Fedora CoreOS this way for several years without touching a single thing to update the OS or Pihole. [1] https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html https://docs.podman.io/en/latest/markdown/podman-systemd.uni...
  • okanat 3mo ago
    See https://news.ycombinator.com/item?id=49275165 https://news.ycombinator.com/item?id=49275165 TL; DR you're right. We are aware options like Podman and systemd-nspawn (check it out if you don't know). They are just overkill.
• okanat 3mo ago
  No we don't need / shouldn't use Docker. As jasomill guessed the disk size and memory usage that Docker needs is just unnecessary overhead. These devices have only 8 GiB disk space. systemd provides every single thing that we need; one can obtain equivalent isolation just with a systemd unit file. If you don't need the layers of Docker and server pull-push, it is just overhead. We just fetch a single cryptographically signed squashfs file and execute the program in it with limited FS and separate namespaces.