> They did. It's called Docker.
Yes I see that. But I was hoping more for a toolbox like GNU fileutils, not a toolbox with a billion dollar valuation (which is what Docker is)
What do you see as the primary differences between those two projects, or types of projects?
Last I checked, they weren’t suitable for multi-tenant machines or for running untrusted code.
Beyond that it is very difficult to get things right, and there's definitely some information leakage (e.g. see the output of `mount` in a docker container... not a docker specific problem).
The main issue is, having a VM layer is always going to be "more secure" (because it's another security boundary) than not having a VM layer. Of course VM's have their own issues.
So if you have a need to run multi-tenant/untrusted workloads it's kind of a CYA situation where if you don't use this extra security boundary and there is a problem sometime down the line then you'll have to answer questions like "why didn't you do ..."
The reality is you can do a lot to lock things down with seccomp+selinux/apparmor.
No free lunch. But yeah, Linux's suite of "container" tools are basically as secure as any other OS's "containers", no matter what spin you're reading elsewhere.
With linux, it's because the tools are exposed piecewise. Creating a process namespace isn't the same thing as creating a virtual network device. You can use cgroups to stop a container all at once, sure, but you can also use them for other useful purposes and the code is the same. Some of these APIs are simple, some less so. But they're tools.
I know, I know, now you're asking "well, why didn't someone just put all the tools together in one box that would do it with one sane UI?!"
They did. It's called Docker.