I am watching it now but he's talking about VMs ("KVM") and not "containers".

As to why we're in this mess, this rather amusing talk by B. Cantrill discusses the history: https://youtu.be/hgN8pCMLI2U

(Linux) Containers are not VMs: https://wiki.archlinux.org/index.php/Linux_Containers

Thanks for the youtube link! Didn't see that one before.

Regarding the attacks and how they relate to containers. It's true that two of the attacks were targeting KVM/KSM i.e. VMs. But one attack was entirely inside a process and conceptually the problem also applies to containers.

https://openvz.org/Comparison

I haven't yet looked at different container implementations but the row 'Page sharing' suggests that there might be some form of memory deduplication.

You could probably use KSM under Linux across containers by registering all memory to KSM through madvise() and MADV_MERGEABLE (http://man7.org/linux/man-pages/man2/madvise.2.html).

https://openvz.org/KSM_(kernel_same-page_merging)

> conceptually the problem also applies to containers.

Yep. c.f. BC's talk @ 34:21 "To improve storage efficiency"

Containers are just namespaces, mount, user, pin, and network namespaces.

The reason why chroot is not enough is that you want to allow a different pace of using certain dependencies is different applications. In a way its similar to how Mac OS packages applications as they all ship their own prefix root so to say.

s/pin/pid/ namespace - sorry, just correcting this for newcomers.

isn't that the OS-part of what containers are doing anyway?