Deep dive into runc and OCI specifications

Re:Deep dive into runc and OCI specifications by tyingq on Tuesday April 28, 2020 @08:37AM (#23006375)

Good read, but "The tool that really runs your containers" isn't quite right either.

Bocker (docker runtime in ~100 lines of bash) does a good job showing what's really happening. Basically namespaces and cgroups, both of which come with Linux. The source is probably the best "deep dive" on containers I've found.

https://github.com/p8952/bocker

Docker thrives because of the repository of images, a great name, and some marketing. Runc thrives because it provides a nice wrapper around namespaces, mounts, cgroups, virtual network interfaces, etc. Neither really provides the magic, though...it's already there.

[ Parent | on HN ]

Re:Deep dive into runc and OCI specifications by monocasa on Tuesday April 28, 2020 @10:00AM (#23007019)

Namespaces and cgroups are orthogonal to OCI and runc.

gvisor is an example that runs containers via runc without all that, using the same scheme as User Mode Linux instead.

[ Parent | on HN ]

Re:Deep dive into runc and OCI specifications by fodoj on Wednesday April 29, 2020 @12:17AM (#23015302)

I agree that the final “thing” that runs containers and provides isolation is Linux kernel, it’s also pointed out in the article :-) Thanks for the feedback! Bocker looks like a fun little project indeed

[ Parent | on HN ]

Re:Deep dive into runc and OCI specifications by mav3rick on Tuesday April 28, 2020 @01:12PM (#23009180)

These are at different abstraction levels.

[ Parent | on HN ]