4 ms·

This project seems great, but I feel there's something wrong with the submitted article title, it sounds weird (plus, there's no mention of Docker on the linked

by nzp 13y ago

This project seems great, but I feel there's something wrong with the submitted article title, it sounds weird (plus, there's no mention of Docker on the linked page). Sure, you can draw parallels between Docker and what FreeBSD jails and tools built on top do, but it would be fairer to say Docker is a Linux based alternative to jails, and not as powerful (as far as I understand Linux kernel infrastructure that Docker uses). The crucial difference is that jails are really a security feature in FreeBSD (and if you're not using them in production you're probably doing it wrong), whereas Docker is primarily deployment oriented (please correct me if I'm wrong about Docker here). Various jail management tools give you a nice, easy to use, set of deployment features on top.

tachion 13y ago
The thing is that it is Docker that 'seems' to be leading the container movement right now, being a mainstream tool, even though Jails were available earlier and as of now seem to be more powerful than LXC. Also, Jails are not only security feature, but can be as good deployment feature, as Docker, if not better - it all depends what you want to do with them, and you can do a lot. I called CBSD an alternative to Docker, because Docker is more widely known, and Jails/FreeBSD/CBSD might interest someone as an viable and mature alternative to Docker/Linux.
- nzp 13y ago
  Well, I had a hunch it was for this reason. I usually get grumpy when an arguably superior solution is presented as an 'alternative' to something that's just more popular because it's easier that way for people to grok what it's all about. But on the other hand, I've never been good at marketing, so who am I to complain. :)
  - shykes 13y ago
    Docker and Jails are not directly comparable, the same way Docker and raw lxc are not directly comparable. Docker operates at a higher level of abstraction, and uses lxc as a low-level sandboxing tool. It could (and soon will) offer a choice of multiple sandboxing backends beyond lxc, for example simple chroot (for older linux kernels), openvz, libvirt, etc. There are also people experimenting with using Jails and Solaris zones as a backend to docker. From what I'm reading, this project cbsd sounds like a more direct competitor of docker + a future jails backend.
    - nzp 13y ago
      Yeah, don't get me wrong, I think Docker is great. I remember when I first heard about it thinking "Finally, something approaching jails functionality in Linux." Of course, I know it's a different level of abstraction and all that. My comments were more directed at the underlying Linux infrastructure Docker uses. Granted, I may well be wrong, it's been a long time since I was seriously in Linux land (i.e. not just a mindless day-to-day user), I'm not current with hard technicalities so it's totally possible that I'm being unjust to LXC. I'm happy to hear about plans for different backends, the jails one would be awesome if it comes to fruition.
ithkuil 13y ago
Why do you say that lxc (and cgroups) are less powerful than FreeBSD jails? From what I read in https://wiki.freebsd.org/Jails https://wiki.freebsd.org/Jails, jails don't yet have support for: * separate PID space * IO isolation cgroups provide extremely fine grained isolation, including among other things: * per-container OOM handler (userspace) * per-container swap * per-container disk I/O scheduling * per-container memory reclaim * per-container dirty page (write throttling) limit. These are very important features if you want to increase your utilization by mixing workload on shared machines.
- nzp 13y ago
  > Why do you say that lxc (and cgroups) are less powerful than FreeBSD jails? If I was wrong about this it's because I'm not up to date on things that happen in the Linux kernel, it wasn't my intention to bash it or anything like that.

by nzp 13y ago

tachion 13y ago

The thing is that it is Docker that 'seems' to be leading the container movement right now, being a mainstream tool, even though Jails were available earlier and as of now seem to be more powerful than LXC. Also, Jails are not only security feature, but can be as good deployment feature, as Docker, if not better - it all depends what you want to do with them, and you can do a lot. I called CBSD an alternative to Docker, because Docker is more widely known, and Jails/FreeBSD/CBSD might interest someone as an viable and mature alternative to Docker/Linux.

nzp 13y ago
Well, I had a hunch it was for this reason. I usually get grumpy when an arguably superior solution is presented as an 'alternative' to something that's just more popular because it's easier that way for people to grok what it's all about. But on the other hand, I've never been good at marketing, so who am I to complain. :)
- shykes 13y ago
  Docker and Jails are not directly comparable, the same way Docker and raw lxc are not directly comparable. Docker operates at a higher level of abstraction, and uses lxc as a low-level sandboxing tool. It could (and soon will) offer a choice of multiple sandboxing backends beyond lxc, for example simple chroot (for older linux kernels), openvz, libvirt, etc. There are also people experimenting with using Jails and Solaris zones as a backend to docker. From what I'm reading, this project cbsd sounds like a more direct competitor of docker + a future jails backend.
  - nzp 13y ago
    Yeah, don't get me wrong, I think Docker is great. I remember when I first heard about it thinking "Finally, something approaching jails functionality in Linux." Of course, I know it's a different level of abstraction and all that. My comments were more directed at the underlying Linux infrastructure Docker uses. Granted, I may well be wrong, it's been a long time since I was seriously in Linux land (i.e. not just a mindless day-to-day user), I'm not current with hard technicalities so it's totally possible that I'm being unjust to LXC. I'm happy to hear about plans for different backends, the jails one would be awesome if it comes to fruition.

ithkuil 13y ago

Why do you say that lxc (and cgroups) are less powerful than FreeBSD jails? From what I read in https://wiki.freebsd.org/Jails https://wiki.freebsd.org/Jails, jails don't yet have support for: * separate PID space * IO isolation cgroups provide extremely fine grained isolation, including among other things: * per-container OOM handler (userspace) * per-container swap * per-container disk I/O scheduling * per-container memory reclaim * per-container dirty page (write throttling) limit. These are very important features if you want to increase your utilization by mixing workload on shared machines.

nzp 13y ago
> Why do you say that lxc (and cgroups) are less powerful than FreeBSD jails? If I was wrong about this it's because I'm not up to date on things that happen in the Linux kernel, it wasn't my intention to bash it or anything like that.