Re:Ask HN: What's the worst piece of software you use everyday?
by _-___________-_ on Saturday July 11, 2020 @10:40PM
(#23808282)
> > Also, it wouldn't really be a product at all but just a built-in tool on Linux systems.
> Well, there's systemd-nspawn and machinectl
There's also podman, which is a drop-in replacement for docker, and buildah, which does daemonless container builds. I switched to them from Docker recently and will never look back.
The only thing that really needs setuid are network namespaces to setup the bridges. Userspace workarounds are clunky and slow. If you can do without network isolation then this would be possible.
> The containers should be nest-able to arbitrary depth without performance loss (at least to say, hundreds of nestings deep.)
Multiple levels of nesting are ppossible if you disable seccomp. I don't know if it scales to hundreds though. Overlayfs has hard limits and btrfs snapeshots don't scale infinitely either.
> Also, it wouldn't really be a product at all but just a built-in tool on Linux systems.
Well, there's systemd-nspawn and machinectl