3 ms·

For multitenant situations, sure. Still more isolation than running a bunch of services on the same box.

• geggam 11y ago
  what is the benefit to any isolation of a process for a single tenant ? and why cant you just run cgroups without the overhead of docker ? see : bocker
  • superuser2 11y ago
    >what is the benefit to any isolation of a process for a single tenant? Build, test, and ship the same artifact. Whether it's a Vagrant on your Mac, AWS, or metal in your colo datacenter. >and why cant you just run cgroups without the overhead of docker ? If you're running cgroups, you've created your own half-baked implementation of Docker in giving yourself a reasonable API to work with. This might make sense if you're Google but otherwise probably not.
    • geggam 11y ago
      cgroups is docker now ? what does that make systemd-nspawn ?
      • superuser2 11y ago
        Docker is a simplified interface for controlling cgroups, yes. (Some people are working on/using alternative backends now, but that was the whole point at the beginning - a nice API for cgroups.)