Launch HN: Nestybox (YC S20) – Containers beyond microservices

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by bfirsh on Friday August 07, 2020 @04:02PM (#24085910)

Ex-Docker person here. I got an early peek at Sysbox and I'm really excited by it -- it's really neat.

Docker is missing a bunch of features that make some software work, which is why you can't run Docker inside Docker by default. Instead of dropping from containers all the way down to hardware virtualization, Sysbox is "augmenting" containers with the missing features by simulating them in userland. That gives you all the power of a VM, without any of the downside of slow start-up speed, provisioning blocks of memory, not being able to run them on EC2, etcetc.

It reminds me a bit of user-mode Linux [0], weirdly. There's something kinda interesting about simulating a bunch of the kernel in userland.

[0] https://en.wikipedia.org/wiki/User-mode_Linux

[ Parent | on HN ]

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by ctalledo on Friday August 07, 2020 @04:37PM (#24086187)

Thanks! Yes, Sysbox is using OS-virtualization techniques to augment the abstraction of the container, thereby enabling software that interacts deeply with the kernel (e.g., dockerd, k8s, etc) to run inside the container, and do so with proper isolation (no privileged containers). Now that you mention user-mode linux, it is one of the references we used as we built Sysbox, though they are very different things of course. I think my background as a VMware ESX kernel developer played a strong influence too ...

[ Parent | on HN ]

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by swsieber on Friday August 07, 2020 @04:40PM (#24086215)

So can you run sysbox in sysbox?

[ Parent | on HN ]

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by ctalledo on Friday August 07, 2020 @04:48PM (#24086293)

Unfortunately not. Sysbox requires "true root" privileges, so it can't run inside a system container deployed by Sysbox itself (since that system container would use the user namespace). You can run Sysbox inside a privileged container however, and in fact the Sysbox test framework relies on this heavily.

What use case do you envision for running sysbox in sysbox?

[ Parent | on HN ]

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by danielheath on Saturday August 08, 2020 @04:42AM (#24090103)

No OP but one of my first questions about any layer is “how transparent is it”. If it can’t host itself, it’s clearly not 100% transparent.

This matters because it adds cognitive overhead - I have to keep track of which features are available at which layer.

[ Parent | on HN ]

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by ctalledo on Tuesday August 11, 2020 @02:01PM (#24123536)

Agreed; it's certainly something we will keep in mind as we mature Sysbox.

[ Parent | on HN ]

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by swsieber on Friday August 07, 2020 @08:40PM (#24087934)

It's mostly curiosity. Probably docker in docker in docker.

[ Parent | on HN ]

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by ctalledo on Friday August 07, 2020 @11:39PM (#24088748)

Got it; note that inside a system container you can always run docker-in-docker using privileged containers (https://hub.docker.com/_/docker). That is, you don't need sysbox nesting in order to run more levels of docker nesting inside the system container. And those privileged containers would only be privileged within the system container, but not at host level.

[ Parent | on HN ]

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by swsieber on Saturday August 08, 2020 @12:15AM (#24088892)

Oh, that's cool. TIL. Thanks for taking the time to respond to something pretty far off in the weeds.

[ Parent | on HN ]

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by ram_rar on Friday August 07, 2020 @05:26PM (#24086614)

i'm just curious. For what kind of use cases do you need docker inside of another docker?

[ Parent | on HN ]

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by rmolina on Friday August 07, 2020 @06:25PM (#24087056)

As @wh33zle mentioned, CI/CD is an obvious use-case. Development environments is another one (pls see the other question i just answered on this topic).

But i also see 'production' scenarios. Think about having a reverse-proxy system container, inside of which you host the backend applications, which happen to be docker containers.

In essence, Sysbox allows you to create hierarchies of containers in a secured fashion, without the need to abuse 'sidecar' pattern, nor priv containers.

[ Parent | on HN ]

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by yjftsjthsd-h on Friday August 07, 2020 @09:54PM (#24088314)

I use dind to build containers in gitlab ci.

[ Parent | on HN ]

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by smcleod on Sunday August 09, 2020 @11:42AM (#24100307)

Try using Kaniko with GitLab CI, it will save you from having to run privileged / DIND containers.

[ Parent | on HN ]

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by yjftsjthsd-h on Sunday August 09, 2020 @12:26PM (#24100675)

I've been experimenting with buildah, but that does look like another option I should try, thanks.

[ Parent | on HN ]

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by wh33zle on Friday August 07, 2020 @05:37PM (#24086705)

For example, my CI provider might want to execute my build in a docker container for security reasons but I also want to run/build a docker container as part of my CI.

[ Parent | on HN ]

Re:Launch HN: Nestybox (YC S20) – Containers beyond microser... by anirudhmurali on Saturday August 08, 2020 @12:23AM (#24088936)

I think you'll also need it if you want to use docker-compose in your CI.

[ Parent | on HN ]