CoreOS Overview, Part One

Re:CoreOS Overview, Part One by merb on Saturday January 30, 2016 @04:45AM (#11001285)

for sandboxes you don't need containers and for resource management, neither. The only thing which docker gives you, is that it enforces immutable disks, which cgroups can't do, can't yet do or whatever. however when even with docker you need to ensure that your program won't mutate the filesystem so anyways nothing special.

[ Parent | on HN ]

Re:CoreOS Overview, Part One by icebraining on Saturday January 30, 2016 @05:43AM (#11001410)

Enforcing an immutable filesystem is actually pretty easy to do, just don't give write permissions to the user under which the program is running :)

What Docker integrates is a layered filesystem, in which the application can mutate the filesystem, but only it will see those changes (and they'll go away when the container is destroyed).

[ Parent | on HN ]

Re:CoreOS Overview, Part One by justincormack on Saturday January 30, 2016 @07:20AM (#11001596)

You can mount the base filesystem read only in the container as of 1.10, with tmpfs mounts for where you need ephemeral mutation.

[ Parent | on HN ]

Re:CoreOS Overview, Part One by merb on Saturday January 30, 2016 @06:15AM (#11001481)

oh yeah sorry. however on some linux filesystems you could also use `chattr +x` however most things won't play well with that ;) especially not programs which create logs / pids / whatever.

[ Parent | on HN ]