Re:Container Linux on the Desktop [slides]
by compsciphd on Wednesday November 21, 2018 @04:14PM
(#18506162)
you don't need deduplicating file system or ksm. regular file systems and regular shared read only code pages work fine.
see the links I posted above, if every package (or a subset of packages based on the underlying source package) in a traditional linux distribution is treated as an independent layer that can be composed together on demand (i.e. what happens when you install a package, except much slower) using a traditional union file system you get deduplication (as every image using that package will be sharing the same exact portion of the file systme) and you get memory sharing for free (for exact same reason, as its fundamentally no different than multiple processes on a single host dynamically linking the same binaries).
Re:Container Linux on the Desktop [slides]
by the8472 on Thursday November 22, 2018 @04:11PM
(#18512583)
In practice containers are siblings with a lot of redundant data, not a layer cake.
The pledge/unveil model is far more elegant.
> What does it do to memory usage, and disk usage?
You'd need a deduplicating filesystem, i.e. btrfs for the storage aspect. For memory consumption you either have to rely on KSM or hope that they will implement page cache sharing it for btrfs. Overlayfs has it but it's less space-efficient.
But I agree that this shouldn't be needed because containers shouldn't each ship with their own OS disk image. That's not orthogonal to the security aspect.