3 ms·

It seems to me the goal is separation of many apps on a single server for the sake of hygiene, security, and reproducibility (in theory), as well as shipping al

It seems to me the goal is separation of many apps on a single server for the sake of hygiene, security, and reproducibility (in theory), as well as shipping all dependencies for an app to run in one "thing". The problem I have with it is the level that it is done at. Using OS level virtualization (lxc) seems somewhat messy, because now you have to have a whole addition layer of proxies and indirection for any networked services. I am left wondering if sandboxing/Capsicum[1], along with something like Nix[2], would be much cleaner abstractions in the long run. [1]: http://www.cl.cam.ac.uk/research/security/capsicum/freebsd.html http://www.cl.cam.ac.uk/research/security/capsicum/freebsd.h... [2]: http://nixos.org/nix/ http://nixos.org/nix/

josteink 12y ago
> The problem I have with it is the level that it is done at. Using OS level virtualization (lxc) seems somewhat messy, because now you have to have a whole addition layer of proxies and indirection for any networked services. Nonsense. You can have LXC containers work at directly at ethernet-level with each container having it's own regular network IP, just like a regular VM.[1] Just because the default is to create an internal network doesn't mean LXC is limited to this only. And then all the problems you mention go away. You get the hygenic benfits of a VM without the resource-related cost. [1] Simple example on setting this up on Debian: https://wiki.debian.org/LXC/SimpleBridge https://wiki.debian.org/LXC/SimpleBridge