5 ms·

> just let me run containers on bare metal I don't think you understand what a container is.

carlos22 11y ago
Oh I think he does. You can run linux containers on bare metal - but you loose some features and it's not really secure. Look at SmartOS for example - their zones run on bare metal and provide most of the vm features as well as strong seperation.
- deleted 11y ago
  [deleted]
nailer 11y ago
Er OK, I'm not sure why you'd think that. Generally on HN we provide supporting arguments. If it wasn't obvious, I'll explain further: Containers run on a shared kernel. That kernel should run on metal, not in a hypervisor.
- peteretep 11y ago
  If the containers are running on a shared kernel, they're hardly running on the bare metal. As to "that kernel should run on metal", I hear "Debian" provide such a thing.
  - tacone 11y ago
    If the containers run on a shared kernel they're effectively running on whatever that kernel runs on, bare metal included. Or not?
    - peteretep 11y ago
      Unless I misunderstand, there's a parent kernel running, on which the containers are sandboxed groups of processes.
      - nailer 11y ago
        There's no 'parent' kernel, just a kernel per-se. Containers are userspace only and do not have a kernel of their own.
  - nailer 11y ago
    You're trolling. It should be obvious that a kernel is needed to run those containers, and that I was asking for that kernel to be on bare metal. For someone so confident in their technical abilities, I'm surprised you suggest running a general purpose OS as a container parent.
    - peteretep 11y ago
      If you say one thing, and mean something different, calling someone who points that out to you a troll is odd. I guess by your reasoning you could talk about running your nodejs services "on the bare metal" because it's obvious you need a kernel and nodejs too. I think it might be similarly misleading.
      - chris_wot 11y ago
        You really aren't helping your argument any here. Linux containers use resource and namespace isolation via the Linux kernel. When we talk about "bare metal", we're using shorthand to talk about the difference between a type 1 and type 2 hypervisor, where when we talk about a type 1 hypervisor we are referring to an operating system that does the actual virtualisation work directly, and when we talk about a type 2 hypervisor we are referring to something like VirtualBox that runs on top of a host OS as a seperate process itself and which does the virtualisation work. Linux containers rely on the operating system via cgroups and namespace isolation to do virtualisation. That's bare-metal under ordinary virtualisation terminology.
      - nailer 11y ago
        "Does your node app run in a VM?" "No, because of the heavy IO load we run it on bare metal" Doesn't sound odd to me.
        peteretep 11y ago
        https://www.twitter.com/shit_hn_says/status/234856345579446272 https://www.twitter.com/shit_hn_says/status/2348563455794462... When life imitates art.
  - chris_wot 11y ago
    The problem is the terminology around "bare-metal". Bare-metal hypervisor are what Popek and Goldberg [1] referred to as the Virtual Machine Monitor (or VMM) - in this case there is a hypervisor operating system and it runs different guests directly. VMWare's vSphere ESXi is a bare-metal hypervisor. The alternative is a Hybrid Virtual Machine (HVV), where you run the hypervisor as a seperate program on a host operating system. VirtualBox is one if the better known examples of a HVV, or type-2 hypervisor. With containers, you could argue that they are actually bare-metal because they share more in common with a type-1 hypervisor, because it is the operating system itself that is creating an efficient and isolated environment within which the application runs. In terms of Linux containers, a combination of resource isolation (cgroups [2]) and namespace isolation [3] achieves operating system level virtualisation. So actually, containers are really bare-metal. 1. http://cs.nyu.edu/courses/fall14/CSCI-GA.3033-010/popek-goldberg.pdf http://cs.nyu.edu/courses/fall14/CSCI-GA.3033-010/popek-gold... 2. https://en.wikipedia.org/wiki/Cgroups https://en.wikipedia.org/wiki/Cgroups 3. https://lwn.net/Articles/531114/ https://lwn.net/Articles/531114/

Oh I think he does. You can run linux containers on bare metal - but you loose some features and it's not really secure. Look at SmartOS for example - their zones run on bare metal and provide most of the vm features as well as strong seperation.

deleted 11y ago
[deleted]

nailer 11y ago

Er OK, I'm not sure why you'd think that. Generally on HN we provide supporting arguments. If it wasn't obvious, I'll explain further: Containers run on a shared kernel. That kernel should run on metal, not in a hypervisor.

peteretep 11y ago
If the containers are running on a shared kernel, they're hardly running on the bare metal. As to "that kernel should run on metal", I hear "Debian" provide such a thing.
- tacone 11y ago
  If the containers run on a shared kernel they're effectively running on whatever that kernel runs on, bare metal included. Or not?
  - peteretep 11y ago
    Unless I misunderstand, there's a parent kernel running, on which the containers are sandboxed groups of processes.
    - nailer 11y ago
      There's no 'parent' kernel, just a kernel per-se. Containers are userspace only and do not have a kernel of their own.
- nailer 11y ago
  You're trolling. It should be obvious that a kernel is needed to run those containers, and that I was asking for that kernel to be on bare metal. For someone so confident in their technical abilities, I'm surprised you suggest running a general purpose OS as a container parent.
  - peteretep 11y ago
    If you say one thing, and mean something different, calling someone who points that out to you a troll is odd. I guess by your reasoning you could talk about running your nodejs services "on the bare metal" because it's obvious you need a kernel and nodejs too. I think it might be similarly misleading.
    - chris_wot 11y ago
      You really aren't helping your argument any here. Linux containers use resource and namespace isolation via the Linux kernel. When we talk about "bare metal", we're using shorthand to talk about the difference between a type 1 and type 2 hypervisor, where when we talk about a type 1 hypervisor we are referring to an operating system that does the actual virtualisation work directly, and when we talk about a type 2 hypervisor we are referring to something like VirtualBox that runs on top of a host OS as a seperate process itself and which does the virtualisation work. Linux containers rely on the operating system via cgroups and namespace isolation to do virtualisation. That's bare-metal under ordinary virtualisation terminology.
    - nailer 11y ago
      "Does your node app run in a VM?" "No, because of the heavy IO load we run it on bare metal" Doesn't sound odd to me.
      - peteretep 11y ago
        https://www.twitter.com/shit_hn_says/status/234856345579446272 https://www.twitter.com/shit_hn_says/status/2348563455794462... When life imitates art.
- chris_wot 11y ago
  The problem is the terminology around "bare-metal". Bare-metal hypervisor are what Popek and Goldberg [1] referred to as the Virtual Machine Monitor (or VMM) - in this case there is a hypervisor operating system and it runs different guests directly. VMWare's vSphere ESXi is a bare-metal hypervisor. The alternative is a Hybrid Virtual Machine (HVV), where you run the hypervisor as a seperate program on a host operating system. VirtualBox is one if the better known examples of a HVV, or type-2 hypervisor. With containers, you could argue that they are actually bare-metal because they share more in common with a type-1 hypervisor, because it is the operating system itself that is creating an efficient and isolated environment within which the application runs. In terms of Linux containers, a combination of resource isolation (cgroups [2]) and namespace isolation [3] achieves operating system level virtualisation. So actually, containers are really bare-metal. 1. http://cs.nyu.edu/courses/fall14/CSCI-GA.3033-010/popek-goldberg.pdf http://cs.nyu.edu/courses/fall14/CSCI-GA.3033-010/popek-gold... 2. https://en.wikipedia.org/wiki/Cgroups https://en.wikipedia.org/wiki/Cgroups 3. https://lwn.net/Articles/531114/ https://lwn.net/Articles/531114/