Sandboxing and workload isolation

Re:Sandboxing and workload isolation by jayd16 on Thursday July 30, 2020 @02:59PM (#24001714)

Is that a surprise? Containers can mostly be summed up by file system isolation on top of process isolation. I think this is why we're seeing some work done on capability based OSes like Google's Fuchsia.

[ Parent | on HN ]

Re:Sandboxing and workload isolation by kjeetgill on Thursday July 30, 2020 @04:45PM (#24002665)

Sorta, but I think you're missing the value proposition forest for the feature trees.

I'm going to speak to the docker-style containers because that's what I'm most familiar with.

Filesystem, process, and even network isolation facilitate the illusion of an application having a fresh install of an OS to a degree. This includes details like /dev/, a package manager, things sitting in /etc/.

Added to that there's decent tooling for sharing, composing/layering, shipping, baking images. They're declarative (enough-ish) too.

This is nice because that's a pretty decent compatibility layer across a ton of software like databases and webservers that have always run expecting a full host, services written with bare metal in mind, and new things too.

The kernel isolation features are powerful enablers, but don't undervalue how important it was to have things sorted out for you, like ldloader quirks with different glibc versions against the same kernel. Real issue I had.

Source: Too much futzing around with chroots.

[ Parent | on HN ]