4 ms·

Alternatively if you don't Linux-dependent and don't mind much the fact that not everyone is writing blogposts about it, BSD’s jails is lightweight virtualisati

by lelf 12y ago

Alternatively if you don't Linux-dependent and don't mind much the fact that not everyone is writing blogposts about it, BSD’s jails is lightweight virtualisation mechanism that has been production-ready for decades. (And zfs pools and snapshots are yours too along with that.)

dscrd 12y ago
Have you tried CBSD? Does it compete well against Docker? The documentation seems quite lacking, but then again, so is docker's at the moment too.
twic 12y ago
Jails are great. But - and apologies if i'm teaching my grandmother to suck eggs here - they're the equivalent of Linux's containers, as implemented in LXC or libcontainer or whatever. Docker is a layer on top of that - it's what prepares the file contents of the jails and looks after them while they're running. I think Docker can even manage FreeBSD jails, although i'm not certain about that. It's not the production-readiness of Linux containers that is in question here; they're fine, although nowhere near as mature as jails. The doubt is about docker, the layer on top. If you wanted to make a comparison to jails, it would be to whatever the equivalent of Docker is in the jail ecosystem. I'm not sure what that is; either there isn't one, or it's an ad-hoc pile of site-local shell scripts.
- feld 12y ago
  I'm not sure what the benefits of Docker are over using Ansible or Salt to build and start your Jail. It can automate the entire process, and it's very repeatable.
  - twic 12y ago
    Ah, now Docker and Ansible / Salt / legacy configuration management tools are also at slightly different places in the stack. Configuration management tools, as you say, give you a nice repeatable way of automatically building up a machine. Docker lets you take a machine you've built up and run lots of copies of it. I believe a typical way to use Docker is to have it run Ansible etc to build the contents of a container, and then use the result as an image. I think the point of doing it that way rather than just running Ansible etc on all your containers is that it means you're running N copies of one master image, rather than running N images which you hope are the same because they've been configured the same way. This doesn't seem like a colossal win to me, but some people seem to like it. Why it's docker that runs Ansible etc, rather than the other way round, i don't know. It's a bit like how rpmbuild runs the build tools that make the contents of RPMs, i suppose. But i really hate rpmbuild so i don't find that analogy very encouraging. As something of an aside, i get the impression that Docker is most popular with people, or organisations, or people in organisations where for whatever reason developers don't have a lot of control over the configuration of the machines their software run on. That could be traditional inflexible siloed organisations, or small, flexible organisations which just don't have an existing investment in infrastructure automation or the resources to make one. In those situations, Docker gives developers a way to make control the environment around their software without having to configure machines. This strikes me as a workaround to a problem rather than a solution to one, though.
    - feld 12y ago
      But I can do that with jails. I can build a master jail and distribute launch a bunch of jails from it... or distribute it to other machines... extra easy if I use ZFS snapshots. Handle the distribution/deployment and maybe any extra configuration with your salt/ansible/whatever and you're fine. What I see as a problem here for many people is that they don't want to do this all themselves and maybe docker offers conveniences out of the box. I get that. Someone needs to work on the jails tooling to make it more approachable so people aren't inventing the wheel.

by lelf 12y ago

dscrd 12y ago

Have you tried CBSD? Does it compete well against Docker? The documentation seems quite lacking, but then again, so is docker's at the moment too.

twic 12y ago

Jails are great. But - and apologies if i'm teaching my grandmother to suck eggs here - they're the equivalent of Linux's containers, as implemented in LXC or libcontainer or whatever. Docker is a layer on top of that - it's what prepares the file contents of the jails and looks after them while they're running. I think Docker can even manage FreeBSD jails, although i'm not certain about that. It's not the production-readiness of Linux containers that is in question here; they're fine, although nowhere near as mature as jails. The doubt is about docker, the layer on top. If you wanted to make a comparison to jails, it would be to whatever the equivalent of Docker is in the jail ecosystem. I'm not sure what that is; either there isn't one, or it's an ad-hoc pile of site-local shell scripts.

feld 12y ago
I'm not sure what the benefits of Docker are over using Ansible or Salt to build and start your Jail. It can automate the entire process, and it's very repeatable.
- twic 12y ago
  Ah, now Docker and Ansible / Salt / legacy configuration management tools are also at slightly different places in the stack. Configuration management tools, as you say, give you a nice repeatable way of automatically building up a machine. Docker lets you take a machine you've built up and run lots of copies of it. I believe a typical way to use Docker is to have it run Ansible etc to build the contents of a container, and then use the result as an image. I think the point of doing it that way rather than just running Ansible etc on all your containers is that it means you're running N copies of one master image, rather than running N images which you hope are the same because they've been configured the same way. This doesn't seem like a colossal win to me, but some people seem to like it. Why it's docker that runs Ansible etc, rather than the other way round, i don't know. It's a bit like how rpmbuild runs the build tools that make the contents of RPMs, i suppose. But i really hate rpmbuild so i don't find that analogy very encouraging. As something of an aside, i get the impression that Docker is most popular with people, or organisations, or people in organisations where for whatever reason developers don't have a lot of control over the configuration of the machines their software run on. That could be traditional inflexible siloed organisations, or small, flexible organisations which just don't have an existing investment in infrastructure automation or the resources to make one. In those situations, Docker gives developers a way to make control the environment around their software without having to configure machines. This strikes me as a workaround to a problem rather than a solution to one, though.
  - feld 12y ago
    But I can do that with jails. I can build a master jail and distribute launch a bunch of jails from it... or distribute it to other machines... extra easy if I use ZFS snapshots. Handle the distribution/deployment and maybe any extra configuration with your salt/ansible/whatever and you're fine. What I see as a problem here for many people is that they don't want to do this all themselves and maybe docker offers conveniences out of the box. I get that. Someone needs to work on the jails tooling to make it more approachable so people aren't inventing the wheel.