Author here. Containers always seemed a little magical to me. So I dug into how they work and then built a “container runtime” that only uses the change root sys call (Which has been in UNIX since the 70s).
This was not only fun, but took a way a bit of the magic, so I could better understand what’s going on when I use real containers.
Meaningless meme images are just noise that make people close their earflaps.
Myself, moving images at the edge of of my visual field are destructive of my ability to concentrate.
If I was working at some place where people shared animated GIFs on Slack I'd have to apply for an accommodation for a disability. If you want everyone to feel included, no m̵e̵m̵e̵s̵.
I find that technology is a lot like magic - delightful and baffling when you're uninitiated, and mundane and boring once you learn the grubby details of how it's done. I believe it was Arthur C. Clarke who said that sufficiently advanced technology is indistinguishable from magic, so my insight is hardly a new one.
As far as I can tell, what Docker did was to create a universal software packaging system within the Linux world. Thinking of them as a lightweight VM can be useful, but it's not the full picture.
> As far as I can tell, what Docker did was to create a universal software packaging system within the Linux world.
Yeah, for sure and containers are great. Namespaces, cgroups v2, runC, overlayfs, the OCI image format, and everything else in this space is impressive engineering. It’s incredible forward progress we can all take advantage of. But it's fun to peal back the layers and see it’s a long series of progressive refinements.
If you ever watch "Connections" by James Burke (and everyone should), you'll see that basically anything we see as a breakthrough technology is really just a long series of progressive refinements - it's evolution all the way down. And nearly all the physical laws/effects/discoveries named after one person (for instance the Kuiper belt around our solar system) were actually discovered by groups of people working over time.
chroot is fine, though often I will also want resource limits (usually via cgroups) and an IP address (usually via network namespaces.)
Often I don't even need chroot, just resource limits and an IP address - and the latter probably wouldn't be necessary with a distribution/proxy switch or if if DNS returned IP:port (which arguably it could.)
Indeed the docker revolution was the Dockerfile and container images: the latter a convenient way to store and share container binaries and the former a convenient way to define recipes for the latter.
This is also what they are trying to do with wasm and what (in part) GitHub did with git: creating a developer ecosystem.
> So git is to github as (chroot/cgroups/unionfs) is to docker et all?
You could do docker-alike runtime things with lxc and e.g. squashfs filesystems. That is IMHO a good signal to say it's not the tech.
I see it more as developer workflows. Github looked at git and LKML working model and put that into a centralized UI. The revolution was individual contribution (not teams) and personal repositories. (Does anyone remember the other scm hosting tools before? I remember running some open source sorceforge alike thing)
Docker took all the pieces before you could run a container and made those easy to achieve (building, sharing, pulling, ...).
The developer ecosystem is always the primary path to success.
The same thing with Raspberry Pi. There are a million $notmuch single board computers with fruit names, but the Raspberry Pi has dominated much more powerful systems for 10 years now because of its top-tier software.
But containers are not just chroot + marketing. Some containers offer real security advantages not found with using straight up chroot. I would agree that the __basis__ of containers is chroot however.
Any search of "chroot vs docker" or "chroot vs lxc" will immediately show that there are some attempts made to isolate the container from the host.
But I will say that I use docker images on a regular basis in chroots for the simple fact that I don't have to wait for debootstrap (or similar) to build a chroot for me.
My understanding is that chroot can be escaped, and containers prevent that. Am I mis-informed?
My view is that VMs, Containers, WASM and all the other things of that sort are just efforts to patch the lack of capability based security in the Unix/Linux/Windows OS model.
16 comments
[ 0.24 ms ] story [ 55.7 ms ] threadThis was not only fun, but took a way a bit of the magic, so I could better understand what’s going on when I use real containers.
Let me know what you think!
Here's an article that is very heavy on 'voice' using images that I thought was a lot of fun:
https://www.cockroachlabs.com/blog/raft-is-so-fetch/
Meaningless meme images are just noise that make people close their earflaps.
Myself, moving images at the edge of of my visual field are destructive of my ability to concentrate.
If I was working at some place where people shared animated GIFs on Slack I'd have to apply for an accommodation for a disability. If you want everyone to feel included, no m̵e̵m̵e̵s̵.
As far as I can tell, what Docker did was to create a universal software packaging system within the Linux world. Thinking of them as a lightweight VM can be useful, but it's not the full picture.
Yeah, for sure and containers are great. Namespaces, cgroups v2, runC, overlayfs, the OCI image format, and everything else in this space is impressive engineering. It’s incredible forward progress we can all take advantage of. But it's fun to peal back the layers and see it’s a long series of progressive refinements.
Often I don't even need chroot, just resource limits and an IP address - and the latter probably wouldn't be necessary with a distribution/proxy switch or if if DNS returned IP:port (which arguably it could.)
This is also what they are trying to do with wasm and what (in part) GitHub did with git: creating a developer ecosystem.
So git is to github as (chroot/cgroups/unionfs) is to docker et all?
What is the VC company that is going to spring up around WASM?
You could do docker-alike runtime things with lxc and e.g. squashfs filesystems. That is IMHO a good signal to say it's not the tech.
I see it more as developer workflows. Github looked at git and LKML working model and put that into a centralized UI. The revolution was individual contribution (not teams) and personal repositories. (Does anyone remember the other scm hosting tools before? I remember running some open source sorceforge alike thing)
Docker took all the pieces before you could run a container and made those easy to achieve (building, sharing, pulling, ...).
That's developer workflows.
The developer ecosystem is always the primary path to success.
The same thing with Raspberry Pi. There are a million $notmuch single board computers with fruit names, but the Raspberry Pi has dominated much more powerful systems for 10 years now because of its top-tier software.
I'd actually like to see macOS support BSD jails.
Any search of "chroot vs docker" or "chroot vs lxc" will immediately show that there are some attempts made to isolate the container from the host.
But I will say that I use docker images on a regular basis in chroots for the simple fact that I don't have to wait for debootstrap (or similar) to build a chroot for me.
My view is that VMs, Containers, WASM and all the other things of that sort are just efforts to patch the lack of capability based security in the Unix/Linux/Windows OS model.