8 ms·

I'm curious why the fuck it took until 2013 to get something comparable to freebsd jails/solaris zones. I mean, congratulation guys, but why the hell didn't th

I'm curious why the fuck it took until 2013 to get something comparable to freebsd jails/solaris zones. I mean, congratulation guys, but why the hell didn't this happen earlier? I know I'm not the brightest bulb in the room but this has been a fundamentally dangerous feature to be missing. I don't get how anyone pretends that their Linux boxes are secure without some extremely personal contrived creations.

strmpnk 13y ago
Just a guess: Vendors certainly seemed more focussed on getting people to use complicated virtualization schemes with proprietary hypervisors. I wonder if it was more a matter of man-power at that point. In comparison, Sun was already selling systems so the value of selling virtualization separately so zones may have ended up being an elegant integrated solution. I'm not sure of the FreeBSD jail history but there may be a similar story to tell if you look at the source of the contributions.
fotcorn 13y ago
There is OpenVZ, LXC and Linux-VServer which are the same as FreeBSD jails but for the Linux kernel.
- DASD 13y ago
  There was also another predcessor, UML(User Mode Linux). This was widely available and offered such as by Linode before they moved to Xen.
  - tmzt 13y ago
    UML is a little different, using a Linux kernel which relies on the system calls of a parent kernel. The other technologies you mentioned, and LXC which docker is built on, have a single unified kernel which interprets paths and other namespaces in system calls from different process trees differently.
justincormack 13y ago
Here is a 2006 article about it - there is no doubt more stuff on LWN if you dig around https://lwn.net/Articles/179361/ https://lwn.net/Articles/179361/ The gist is that there were a lot of out of tree solutions (openvz is still used eg by Travis CI) but they had conflicting requirements and a lot of the suggestions were just "we need BSD jails" which is a very monolithic single purpose solution, like having a web server in the kernel (yes there was one) rather than having the kernel APIs in place so that was not needed. What we have ended up with (mainly cgroups and namespacing basically) is much more flexible in that each piece is for a separate thing, eg you can just namespace networks without full isolation (which is really useful for eg testing network code without messing with the real config). It did take a very very long time though.
chubot 13y ago
Here is my conjecture from a few days ago: https://news.ycombinator.com/item?id=5901649 https://news.ycombinator.com/item?id=5901649 In summary, I think it's because containers, although open source, are a relatively commercial technology. Interested in any comments from people were there in the 90's when lots of hosting providers started using Linux.
- jpetazzo 13y ago
  raises a hand In the early 2000s, I was in the hosting business, and we started using UML (user-mode-linux), then vserver and openvz. When Xen came around, we switched to that, because it made more sense for us (and for our customers): more control, more "this is your machine" feeling. "Yes, but containers are better because they are lightweight!" Of course, but this idea was pointless back then, because people who wanted really lightweight things went to shared hosting (and for massive PHP hosting, containers can't beat a single Apache instance serving tens of thousands of vhosts; at least not yet). Maybe (maybe!) things changed with the rise of stacks like Python/Ruby/Node.js/etc for which there are no cheap shared hosting solutions like there is for PHP. Then containers are obviously cheaper than running your own VPS, and easier to setup (and isolate) than shared hosting on a single box.
e1ven 13y ago
I've been running OpenVZ for years - It works very well. LXC is built into the kernel directly, rather than a patch, which is very nice. So far as I can see, Docker is just some nice wrapper scripts around LXC, nothing particularly revolutionary in and of itself.
- shykes 13y ago
  Correct, docker is not an implementation of linux containers. The heavy lifting is done by lxc (and alternatives like openvz). What docker brings is a way for backend developers to package and distribute their app into portable, sandboxed containers (think "iphone apps for the server"). This is only possible now that linux has decent container support, because it means the vast majority of servers out there can potentially run a docker container unmodified.
Andys 13y ago
Linux has had containers for ages. Docker has simply made them easier to use as a service. You should be asking why Solaris/BSD never had something as useful as docker despite having zones/jails. And linux supports overlay filesystems (to clone containers cheaply) without the need for ZFS.
tmzt 13y ago
The facilities in the kernel for doing this have gotten better progressively over the years. Support for separate namespaces, and adding more and more of those types of namespaces have only been added in the last few years.

strmpnk 13y ago

Just a guess: Vendors certainly seemed more focussed on getting people to use complicated virtualization schemes with proprietary hypervisors. I wonder if it was more a matter of man-power at that point. In comparison, Sun was already selling systems so the value of selling virtualization separately so zones may have ended up being an elegant integrated solution. I'm not sure of the FreeBSD jail history but there may be a similar story to tell if you look at the source of the contributions.

fotcorn 13y ago

There is OpenVZ, LXC and Linux-VServer which are the same as FreeBSD jails but for the Linux kernel.

DASD 13y ago
There was also another predcessor, UML(User Mode Linux). This was widely available and offered such as by Linode before they moved to Xen.
- tmzt 13y ago
  UML is a little different, using a Linux kernel which relies on the system calls of a parent kernel. The other technologies you mentioned, and LXC which docker is built on, have a single unified kernel which interprets paths and other namespaces in system calls from different process trees differently.

justincormack 13y ago

Here is a 2006 article about it - there is no doubt more stuff on LWN if you dig around https://lwn.net/Articles/179361/ https://lwn.net/Articles/179361/ The gist is that there were a lot of out of tree solutions (openvz is still used eg by Travis CI) but they had conflicting requirements and a lot of the suggestions were just "we need BSD jails" which is a very monolithic single purpose solution, like having a web server in the kernel (yes there was one) rather than having the kernel APIs in place so that was not needed. What we have ended up with (mainly cgroups and namespacing basically) is much more flexible in that each piece is for a separate thing, eg you can just namespace networks without full isolation (which is really useful for eg testing network code without messing with the real config). It did take a very very long time though.

chubot 13y ago

Here is my conjecture from a few days ago: https://news.ycombinator.com/item?id=5901649 https://news.ycombinator.com/item?id=5901649 In summary, I think it's because containers, although open source, are a relatively commercial technology. Interested in any comments from people were there in the 90's when lots of hosting providers started using Linux.

jpetazzo 13y ago
raises a hand In the early 2000s, I was in the hosting business, and we started using UML (user-mode-linux), then vserver and openvz. When Xen came around, we switched to that, because it made more sense for us (and for our customers): more control, more "this is your machine" feeling. "Yes, but containers are better because they are lightweight!" Of course, but this idea was pointless back then, because people who wanted really lightweight things went to shared hosting (and for massive PHP hosting, containers can't beat a single Apache instance serving tens of thousands of vhosts; at least not yet). Maybe (maybe!) things changed with the rise of stacks like Python/Ruby/Node.js/etc for which there are no cheap shared hosting solutions like there is for PHP. Then containers are obviously cheaper than running your own VPS, and easier to setup (and isolate) than shared hosting on a single box.

e1ven 13y ago

I've been running OpenVZ for years - It works very well. LXC is built into the kernel directly, rather than a patch, which is very nice. So far as I can see, Docker is just some nice wrapper scripts around LXC, nothing particularly revolutionary in and of itself.

shykes 13y ago
Correct, docker is not an implementation of linux containers. The heavy lifting is done by lxc (and alternatives like openvz). What docker brings is a way for backend developers to package and distribute their app into portable, sandboxed containers (think "iphone apps for the server"). This is only possible now that linux has decent container support, because it means the vast majority of servers out there can potentially run a docker container unmodified.

Andys 13y ago

Linux has had containers for ages. Docker has simply made them easier to use as a service. You should be asking why Solaris/BSD never had something as useful as docker despite having zones/jails. And linux supports overlay filesystems (to clone containers cheaply) without the need for ZFS.

tmzt 13y ago

The facilities in the kernel for doing this have gotten better progressively over the years. Support for separate namespaces, and adding more and more of those types of namespaces have only been added in the last few years.