News for hackers. Stuff that matters.

A comment on Containers vs. Zones vs. Jails vs. VMs. Parent comment

Re:Containers vs. Zones vs. Jails vs. VMs by sarnowski on Wednesday March 29, 2017 @12:58AM (#13983539)
Containers are just advanced chroots. They do the same with the network interface, process list and your local user list as chroot is doing with your filesystem. In addition, containers often throttle resource consumption of CPU, memory, block I/O and network I/O of the running application to have some QoS for other colocated applications in the same machine.

It is the spot between chroot and VM. Looks like a VM from the inside, provides some degree of resource usage QoS and does not require you to run a full operating system like a VM.

Another concept that is now also often automatically connected to containers is the distribution mechanism that Docker brought. While provisioning is an orthogonal topic to runtime, it is nice that these two operational topics are solved at the same time in a convinient way.

rkt did some nice work to allow you to choose the runtime isolation level while sticking to the same provisioning mechanism:

https://coreos.com/rkt/docs/latest/devel/architecture.html#s...

[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by AstralStorm on Wednesday March 29, 2017 @03:27AM (#13984126)
Unfortunately containers provide about the same security as chroots too. Nothing even close to a true virtual machine with not much lower cost.
[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by dobin on Wednesday March 29, 2017 @06:00AM (#13984689)
Chroot does not provide security, just a restricted view on the file system. Container can provide pretty ok security, but fail with Kernel Exploits. VMs provide better security, but also fail with VM exploits (which there are quite regularly some).
[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by AstralStorm on Wednesday March 29, 2017 @08:13AM (#13985266)
Actually many of the VM exploits are related to qemu device emulation or paravirtualization drivers, which are closed by the use of Xen stubdom. Only very few were privilege escalation via another vector, both in kvm and in Xen. I have no idea about other hypervisors.
[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by bonzini on Wednesday March 29, 2017 @04:10PM (#13990111)
And in turn most QEMU vulnerabilities are closed by SELinux of your distribution enables it. Libvirt (and thus the virt-manager GUI) automatically confine each QEMU process so that it can only access the resources for that particular VM.
[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by maccam94 on Wednesday March 29, 2017 @04:23AM (#13984339)
Seccomp, apparmor, and namespacing (especially user!) do add a lot more security than plain old chroots, but still not at the level of a VM.
[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by cm2187 on Wednesday March 29, 2017 @05:46AM (#13984622)
But couldn't containers have been designed that way? One thing I have in mind is one of windows 10 recent features, which consist in running certain applications using the same hardware level memory protection mechanism than VMs, so that the application is safe from the OS/Kernel, and the OS/Kernel is safe from the application (can't find the exact name for this new feature unfortunately).
[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by daenney on Wednesday March 29, 2017 @05:57AM (#13984671)
Containers can't be designed that way as long as the primitives to build them that way (which are mostly part of the Linux kernel) are missing. That's a core part of the article. Containers aren't an entity by themselves, they're a clever and useful combination of an existing set of capabilities.
[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by di4na on Wednesday March 29, 2017 @07:39AM (#13985105)
It is like that... but in Zones or Jails, not in Linux "container toolkit"
[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by bonzini on Wednesday March 29, 2017 @04:09PM (#13990089)
No, the Windows 10 feature he's talking about uses Hyper-V internally. It's called, unsurprisingly, Hyper-V containers: https://docs.microsoft.com/en-us/virtualization/windowsconta...
[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by cm2187 on Wednesday March 29, 2017 @04:29PM (#13990260)
Actually I found it. It's called Windows 10 Virtual Secure mode

https://channel9.msdn.com/Blogs/Seth-Juarez/Windows-10-Virtu...

(or Windows 10 isolated user mode, which seems kind of similar)

https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Crede...

[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by bonzini on Saturday April 01, 2017 @01:02AM (#14010530)
Oh yeah that's another use of Hyper-V, somewhat similar to ARM TrustZone. It's used to implement "Credential Guard".
[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by emmelaich on Wednesday March 29, 2017 @06:03AM (#13984707)
You can design all you like, but implementation takes work.

Seccomp only landed for Docker in about 1.12

[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by di4na on Wednesday March 29, 2017 @07:38AM (#13985104)
in Linux...

as the article shows, this is not the point for Zones and Jails.

[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by friendzis on Wednesday March 29, 2017 @04:04AM (#13984260)
Is there any fundamental difference between containers and shared-kernel virtualization (OpenVZ) that I am missing?
[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by maccam94 on Wednesday March 29, 2017 @04:22AM (#13984331)
OpenVZ was an early container implementation that required patches to the Linux kernel that never made it into mainline. Parallels acquired the company behind OpenVZ, Virtuozzo, and then worked to mainline much of the functionality into what are now Linux namespaces.
[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by discordianfish on Wednesday March 29, 2017 @07:50AM (#13985160)
Oh really? I didn't know that namespaces is linux are the openvz changes. Thought they were a completely new implementation mostly driven by Google?
[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by AstralStorm on Wednesday March 29, 2017 @08:15AM (#13985275)
They aren't, but share some similarities. OpenVZ can be considered an inspiration for LXC. (Which was mostly implemented by RedHat and not Google.)
[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by throw2016 on Wednesday March 29, 2017 @10:35PM (#13992431)
Correction. The LXC project was mainly Daniel Lezcano and Serge Hallyn from IBM. Then some cgroup support from Google. And then Canonical hired Serge Hallyn and Stephane Graber to continue work on LXC around 2009 where they have continued to develop it till today. Docker based off LXC in 2013.
[ Parent | on HN ]
Re:Containers vs. Zones vs. Jails vs. VMs by dreamcompiler on Wednesday March 29, 2017 @01:14AM (#13983612)
Very helpful. Thanks.
[ Parent | on HN ]