4 ms·

I am not sure whether it is a common mistake to see containers as faster VMs. The way we use Docker at Phusion is on one side as sandboxed environments to run o

by tinco 13y ago

I am not sure whether it is a common mistake to see containers as faster VMs. The way we use Docker at Phusion is on one side as sandboxed environments to run our integration tests in, and on the other side as isolated containers to run long running services in (like apps, databases) to lessen administrative overhead. Both use cases work best in an environment that's as much as a fully functional OS as possible. Anyway, what's wrong with using containers as ultra light weight VMs, isn't the whole idea of the recent VM upmarch to use VMs as application containers? As long as you keep in mind that the security of LXC hasn't been thoroughly battle test yet, I think it's a fine idea to use docker to build light weight VMs.

ori_b 13y ago
The reason that you want a VM is because it reduces the attack surface for a process, and sandboxes it effectively. The administrative overhead gets cut down because you can more easily snapshot it, and reduces crosstalk between components. It removes access to data that other processes should not have access to, in a way that is tedious and difficult to do with file system permissions. It removes the ability to communicate with services running on localhost, increasing security that way. And so on. Containers do the same thing, without the overhead of a VM. The advantage of a VM in administrative overhead isn't because it's a VM, but because it has restricted access. Tossing in all the other crap that a VM has into a container because "it's like a VM" is simply cargo cult programming.
- tinco 13y ago
  No one is tossing crap into containers because "it's like a VM". Maybe you should pay attention before calling other people cargo cult programmers. Also, security is not the main reason people use VMs, if it was virtualization would not have been so popular.
- mateuszf 13y ago
  The difference is that although containers may have the same function as VMS they also are crazy fast. I don't see anything wrong with using them as VMS.
- coldtea 13y ago
  >The reason that you want a VM is because it reduces the attack surface for a process, and sandboxes it effectively. Well, that's why you want a container too. From an operations standpoint VMs are just heavyweight containers.

by tinco 13y ago

ori_b 13y ago

The reason that you want a VM is because it reduces the attack surface for a process, and sandboxes it effectively. The administrative overhead gets cut down because you can more easily snapshot it, and reduces crosstalk between components. It removes access to data that other processes should not have access to, in a way that is tedious and difficult to do with file system permissions. It removes the ability to communicate with services running on localhost, increasing security that way. And so on. Containers do the same thing, without the overhead of a VM. The advantage of a VM in administrative overhead isn't because it's a VM, but because it has restricted access. Tossing in all the other crap that a VM has into a container because "it's like a VM" is simply cargo cult programming.

tinco 13y ago
No one is tossing crap into containers because "it's like a VM". Maybe you should pay attention before calling other people cargo cult programmers. Also, security is not the main reason people use VMs, if it was virtualization would not have been so popular.
mateuszf 13y ago
The difference is that although containers may have the same function as VMS they also are crazy fast. I don't see anything wrong with using them as VMS.
coldtea 13y ago
>The reason that you want a VM is because it reduces the attack surface for a process, and sandboxes it effectively. Well, that's why you want a container too. From an operations standpoint VMs are just heavyweight containers.