News for hackers. Stuff that matters.

A comment on K3s: Kubernetes without the features I don't care about. Parent comment

Re:K3s: Kubernetes without the features I don't care about by ofrzeta on Thursday October 04, 2018 @03:15AM (#18137844)
> I mean "transparent to the OS" in reference to operating system tooling rather than the kernel objects that make up containers (there is an argument that these are related concepts -- but I think we can have cohesive tooling without redesigning how Linux handles containers). The lack of a 'struct container_t' in Linux definitely makes containers quite complicated to set up, and is a constant source of pain

It makes it difficult to reason about containers, as well. For instance do you see confinement technologies such as AppArmor or SELinux belonging to the container or are they slapped on top of containers? Where do you draw the boundary? And does it make sense to talk about "containers" when it's such a vague concept. Also, there are now "VM containers" such as Kata.

[ Parent | on HN ]
Re:K3s: Kubernetes without the features I don't care about by cyphar on Thursday October 04, 2018 @10:08AM (#18139996)
> And does it make sense to talk about "containers" when it's such a vague concept.

Well at some point we have to be able to talk about the widely-used and glued-together namespaces+cgroups+... concept. "Containers" is a perfectly fine thing to discuss (especially since the history of namespaces was definitely based in more "fully fledged" container technologies like Xen).

> Also, there are now "VM containers" such as Kata.

... which are just VMs that can interact with container tools. I'm pretty sure that most people would not call these "containers" from an OS point of view because they do not share any of the primary properties that containers (or Jails/Zones) have -- the host kernel actually knows what the container processes are doing.

[ Parent | on HN ]