35 ms·

Systemd can now pull and update container images from the Internet

57 points by catern 12y ago

tmikaeld 12y ago
Is there anything more we can throw into systemd, perhaps http/https/v8 server so we can replace apache, nginx and nodejs as well? I don't like how systemd starts doing everything, people keep pointing to alternatives but when things start to depend on systemd for functioning the alternatives start to disappear one after another. I'm also thinking that each new feature like this would widen the area for potential security vulnerabilities.
- Spidler 12y ago
  There already is a HTTP server there. It's log support / shipping is done via HTTP as a transport.
  - digi_owl 12y ago
    And presenting your phone with a QR code housing the initial private key of the journald forward security "feature". A feature apparently developed by Poettering's brother as a doctoral thesis...
- Someotherdood 12y ago
  Is there a systemd-email yet?
Spidler 12y ago
I just hope they check for certificates better than Docker does. systemd-nspawn is a really fun thing to work with for developing early-init/daemons of various kinds, and this adds a bit more tools to that.
revelation 12y ago
Great, and it's a bunch of C with obvious memory leaks (remember, if theres a dup in that function name, it's gonna allocate memory) and other problems parsing complex formats it's downloaded off the web. This is terrible in both the "why is systemd doing this" and "it's just plain terrible software" sense.
- pedrocr 12y ago
  > it's a bunch of C with obvious memory leaks (remember, if theres a dup in that function name, it's gonna allocate memory) That's only really an issue if someone ever turns this into a library and calls it from long-running code. As a command line utility the small amounts of memory that are leaked don't ammount to too much waste and everything gets reclaimed on exit.
  - enqk 12y ago
    there's something to be said about the elegance of short-running C programs with no deallocation, using the OS to properly relinquish memory
  - revelation 12y ago
    I don't trust someone that can't get memory leaks in a simple utility function right to get the big, big things with writing software in C correct. This is Poetterings code after all, and he had his fingers in more than just command line utilities when it comes to systemd. Writing this kind of software in C requires serious discipline and religious use of valgrind.
    - tree_of_item 12y ago
      Isn't the point that it's not a leak if the program exits quickly?
      - jacquesm 12y ago
        If you can't be trusted to get the bookkeeping right what makes you think the rest of the program is solid? Being able to manage your allocation is a pretty good sign that a C programmer knows what he's doing. Relying on 'exit' to free your memory is backporting the web mentality to unix land, it just simply doesn't work that way. There is no different attitude when you write a long running daemon versus a utility program because for all you know your utility program code will be re-purposed to become part of a longer running daemon. So you write your code in as clean a manner as possible and balance your allocs/frees and make sure that you don't have any latent buffer overflows which you may not care about today because of the context your code executes in today because tomorrow that context of execution might change and then we're looking at yet another exploit.
houst0n_ 12y ago
When the big debate about systemd was going on, I couldn't really care less. In fact, I thought a future where the big distros used the same init system was a rosy one. No need to have to rewrite some init script to yet another system depending on the flavour of my clients. No need for our config management tools to have a gazallion 'if os == foo' statements. Now, I'm just not so sure. The feature creep here is remarkable. Why on earth would systemd have anything to do with container management? Surely the 'docker' (or whatever) service which systemd is supposed to be managing should be doing this? Another nail in the coffin of simple software that does one thing well. Edit: s/docker/container management/
- vruiz 12y ago
  It's not about docker, it about systemd-nspawn which is systemd's own alternative to docker. I'm with you here, at first I didn't understand the alarm but now I'm starting to see the danger of this trend.
  - ris 12y ago
    I don't think systemd is moving into this territory just for fun. I seem to recall it's because now the kernel is moving towards unified cgroups-trees if systemd wants to be able to use cgroups it more or less has to be "in charge" of them at the root, meaning it's going to have to take care of this sort of functionality.
    - jacquesm 12y ago
      Linux should simply adopt jails and get it over with rather than to get stuck in NIH territory.
      - ris 12y ago
        Right. They should "port" a feature that's intricately linked with the internal workings of a kernel over from another completely alien kernel.
throwawayaway 12y ago
If systemd could somehow be controlled from emacs we're looking at a whole new operating system paradigm here.
sciurus 12y ago
It seems like, if they renamed systemd-nspawn and systemd-import to take "systemd" out of their names, a lot of controversy would go away.
- geofft 12y ago
  It'd still be part of the same source tree, and there was tons of controversy about udev and systemd being joined into the same source tree. Alternatively, it could be a separate source tree if systemd implemented deep APIs for everything it does, but they don't want to do that.
- pmahoney 12y ago
  I was looking into systemd-nspawn recently because I wanted some container features (tcp port namespace, so I can have multiple groups of processes run and connect to an instance of mysqld on the default port, on a ci server). I installed it, ran it, and it immediately complained "not a systemd system" and refused to run. I've not looked into things further, but presumably systemd-nspawn requires that systemd be running, which was a surprise to me since systemd-nspawn calls itself "chroot on steroids", and chroot cares nothing about the init system.
  - chimeracoder 12y ago
    > systemd-nspawn calls itself "chroot on steroids", and chroot cares nothing about the init system. If I remember correctly, systemd-nspawn uses cgroups (hence the "steroids" part of of "chroot on steroids"). On Linux, cgroups require a single manager for all cgroups (in this case systemd). This is not a systemd limitation; it is a requirement set by the Linux kernel[0]. In theory you could bring-your-own cgroup manager, but cgroups are nascent enough that trying to make a userland tool like systemd-nspan work with a completely pluggable cgroup manager would be a nightmare. [0] http://www.freedesktop.org/wiki/Software/systemd/ControlGroupInterface/ http://www.freedesktop.org/wiki/Software/systemd/ControlGrou...
    - pmahoney 12y ago
      Hm, interesting. I'm certainly largely ignorant of how cgroups works, but I was wishing for a tool like "chroot" that could also "ch-network-namespace" or something. I've skimmed over cgroups documentation [1] several times, but never quite gotten a solid mental model of how everything fits together. [1] https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt
signa11 12y ago
how close are we to realizing zawinski's law with systemd ?
lxc 12y ago
Systemd is genious
transfire 12y ago
What operating system do you use? "Systemd"
jacquesm 12y ago
If you want to avoid systemd your choices are apparently: Slack, Crux and Gentoo or switching to *BSD. http://distrowatch.com/weekly.php?issue=20140908#qa http://distrowatch.com/weekly.php?issue=20140908#qa Here's to hoping that debian at least will reverse their position or that some group will fork it: https://devuan.org/ https://devuan.org/
- eleitl 12y ago
  I am switching to *BSD.
  - linuxydave 12y ago
    I'm seriously considering it. The fact that Digital Ocean offers FreeBSD means I get to try it out beforehand which is a bonus.
    - jacquesm 12y ago
      You're going to have to change your nick ;)
      - linuxydave 12y ago
        Yeah :(
- justincormack 12y ago
  Or Alpine or Sabotage if you want something a bit different (Musl libc support).
- digi_owl 12y ago
  http://without-systemd.org/wiki/index.php/Main_Page http://without-systemd.org/wiki/index.php/Main_Page
- elementai 12y ago
  Or one can even consider taking a shot at GNU DMD with Guix. Alpha-quality software, but it looks promising (at least for brave and true schemers).
moe 12y ago
Shouldn't systemd embed a BitTorrent client before it starts downloading things?
deleted 12y ago
[deleted]
dschiptsov 12y ago
Do not forget security updates and service packs.
SixSigma 12y ago
PXE, Gpxe were all you ever needed. http://etherboot.org/ http://etherboot.org/

57 points by catern 12y ago

Is there anything more we can throw into systemd, perhaps http/https/v8 server so we can replace apache, nginx and nodejs as well? I don't like how systemd starts doing everything, people keep pointing to alternatives but when things start to depend on systemd for functioning the alternatives start to disappear one after another. I'm also thinking that each new feature like this would widen the area for potential security vulnerabilities.

Spidler 12y ago
There already is a HTTP server there. It's log support / shipping is done via HTTP as a transport.
- digi_owl 12y ago
  And presenting your phone with a QR code housing the initial private key of the journald forward security "feature". A feature apparently developed by Poettering's brother as a doctoral thesis...
Someotherdood 12y ago
Is there a systemd-email yet?

Spidler 12y ago

I just hope they check for certificates better than Docker does. systemd-nspawn is a really fun thing to work with for developing early-init/daemons of various kinds, and this adds a bit more tools to that.

revelation 12y ago

Great, and it's a bunch of C with obvious memory leaks (remember, if theres a dup in that function name, it's gonna allocate memory) and other problems parsing complex formats it's downloaded off the web. This is terrible in both the "why is systemd doing this" and "it's just plain terrible software" sense.

pedrocr 12y ago
> it's a bunch of C with obvious memory leaks (remember, if theres a dup in that function name, it's gonna allocate memory) That's only really an issue if someone ever turns this into a library and calls it from long-running code. As a command line utility the small amounts of memory that are leaked don't ammount to too much waste and everything gets reclaimed on exit.
- enqk 12y ago
  there's something to be said about the elegance of short-running C programs with no deallocation, using the OS to properly relinquish memory
- revelation 12y ago
  I don't trust someone that can't get memory leaks in a simple utility function right to get the big, big things with writing software in C correct. This is Poetterings code after all, and he had his fingers in more than just command line utilities when it comes to systemd. Writing this kind of software in C requires serious discipline and religious use of valgrind.
  - tree_of_item 12y ago
    Isn't the point that it's not a leak if the program exits quickly?
    - jacquesm 12y ago
      If you can't be trusted to get the bookkeeping right what makes you think the rest of the program is solid? Being able to manage your allocation is a pretty good sign that a C programmer knows what he's doing. Relying on 'exit' to free your memory is backporting the web mentality to unix land, it just simply doesn't work that way. There is no different attitude when you write a long running daemon versus a utility program because for all you know your utility program code will be re-purposed to become part of a longer running daemon. So you write your code in as clean a manner as possible and balance your allocs/frees and make sure that you don't have any latent buffer overflows which you may not care about today because of the context your code executes in today because tomorrow that context of execution might change and then we're looking at yet another exploit.

houst0n_ 12y ago

When the big debate about systemd was going on, I couldn't really care less. In fact, I thought a future where the big distros used the same init system was a rosy one. No need to have to rewrite some init script to yet another system depending on the flavour of my clients. No need for our config management tools to have a gazallion 'if os == foo' statements. Now, I'm just not so sure. The feature creep here is remarkable. Why on earth would systemd have anything to do with container management? Surely the 'docker' (or whatever) service which systemd is supposed to be managing should be doing this? Another nail in the coffin of simple software that does one thing well. Edit: s/docker/container management/

vruiz 12y ago
It's not about docker, it about systemd-nspawn which is systemd's own alternative to docker. I'm with you here, at first I didn't understand the alarm but now I'm starting to see the danger of this trend.
- ris 12y ago
  I don't think systemd is moving into this territory just for fun. I seem to recall it's because now the kernel is moving towards unified cgroups-trees if systemd wants to be able to use cgroups it more or less has to be "in charge" of them at the root, meaning it's going to have to take care of this sort of functionality.
  - jacquesm 12y ago
    Linux should simply adopt jails and get it over with rather than to get stuck in NIH territory.
    - ris 12y ago
      Right. They should "port" a feature that's intricately linked with the internal workings of a kernel over from another completely alien kernel.

throwawayaway 12y ago

If systemd could somehow be controlled from emacs we're looking at a whole new operating system paradigm here.

sciurus 12y ago

It seems like, if they renamed systemd-nspawn and systemd-import to take "systemd" out of their names, a lot of controversy would go away.

geofft 12y ago
It'd still be part of the same source tree, and there was tons of controversy about udev and systemd being joined into the same source tree. Alternatively, it could be a separate source tree if systemd implemented deep APIs for everything it does, but they don't want to do that.
pmahoney 12y ago
I was looking into systemd-nspawn recently because I wanted some container features (tcp port namespace, so I can have multiple groups of processes run and connect to an instance of mysqld on the default port, on a ci server). I installed it, ran it, and it immediately complained "not a systemd system" and refused to run. I've not looked into things further, but presumably systemd-nspawn requires that systemd be running, which was a surprise to me since systemd-nspawn calls itself "chroot on steroids", and chroot cares nothing about the init system.
- chimeracoder 12y ago
  > systemd-nspawn calls itself "chroot on steroids", and chroot cares nothing about the init system. If I remember correctly, systemd-nspawn uses cgroups (hence the "steroids" part of of "chroot on steroids"). On Linux, cgroups require a single manager for all cgroups (in this case systemd). This is not a systemd limitation; it is a requirement set by the Linux kernel[0]. In theory you could bring-your-own cgroup manager, but cgroups are nascent enough that trying to make a userland tool like systemd-nspan work with a completely pluggable cgroup manager would be a nightmare. [0] http://www.freedesktop.org/wiki/Software/systemd/ControlGroupInterface/ http://www.freedesktop.org/wiki/Software/systemd/ControlGrou...
  - pmahoney 12y ago
    Hm, interesting. I'm certainly largely ignorant of how cgroups works, but I was wishing for a tool like "chroot" that could also "ch-network-namespace" or something. I've skimmed over cgroups documentation [1] several times, but never quite gotten a solid mental model of how everything fits together. [1] https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt

signa11 12y ago

how close are we to realizing zawinski's law with systemd ?

lxc 12y ago

Systemd is genious

transfire 12y ago

What operating system do you use? "Systemd"

jacquesm 12y ago

If you want to avoid systemd your choices are apparently: Slack, Crux and Gentoo or switching to *BSD. http://distrowatch.com/weekly.php?issue=20140908#qa http://distrowatch.com/weekly.php?issue=20140908#qa Here's to hoping that debian at least will reverse their position or that some group will fork it: https://devuan.org/ https://devuan.org/

eleitl 12y ago
I am switching to *BSD.
- linuxydave 12y ago
  I'm seriously considering it. The fact that Digital Ocean offers FreeBSD means I get to try it out beforehand which is a bonus.
  - jacquesm 12y ago
    You're going to have to change your nick ;)
    - linuxydave 12y ago
      Yeah :(
justincormack 12y ago
Or Alpine or Sabotage if you want something a bit different (Musl libc support).
digi_owl 12y ago
http://without-systemd.org/wiki/index.php/Main_Page http://without-systemd.org/wiki/index.php/Main_Page
elementai 12y ago
Or one can even consider taking a shot at GNU DMD with Guix. Alpha-quality software, but it looks promising (at least for brave and true schemers).

moe 12y ago

Shouldn't systemd embed a BitTorrent client before it starts downloading things?

deleted 12y ago

[deleted]

dschiptsov 12y ago

Do not forget security updates and service packs.

SixSigma 12y ago

PXE, Gpxe were all you ever needed. http://etherboot.org/ http://etherboot.org/