News for hackers. Stuff that matters.
Re:Jails on FreeBSD by tptacek on Friday May 26, 2023 @12:50PM (#36086663)
Jails are not VM-like. The defining attribute of a VM is that it runs its own kernel. FreeBSD has a virtualization system: it's called bhyve.
Re:Jails on FreeBSD by heavyset_go on Friday May 26, 2023 @01:47PM (#36087425)
I believe I recall there being a period quite a while ago when things like LXC and OpenVZ were described/marketed as being "VM-like" around the same time that jails were popularized.

It feels like jails are still stuck with being described using older terms even after Linux containers and the distinction between them and VMs were mainstreamed.

Re:Jails on FreeBSD by tptacek on Friday May 26, 2023 @02:01PM (#36087623)
I don't know about any of that. LXC containers are also not VM-like.
Re:Jails on FreeBSD by fragmede on Friday May 26, 2023 @03:16PM (#36088434)
> The defining attribute of a VM is that it runs its own kernel.

of a VM.

The difference between "VM" and "VM-like" is the trailing modifier "-like". This means something is similar, but not the same thing. If it looks like a duck, but is made of rubber, we call it a "rubber ducky." If it looks like a duck, is wearing a blue shirt, has a speech impediment, and is not wearing any pants, we call it Donald Duck.

Thus the fact that jails, and docker look like VMs because they have their own PID 1, their own file system, their own slice of memory/cpu/IO/network; that is why people are, accurately, using the descriptor "VM-like" to describe them. People understand that docker is not a true virtual machine because it's not running its own kernel. In cases where it matters, pedantry between true VM vs fake VM, or VM-like (for eg security isolation between VM and docker container) is crucial, but most discussions where "VM-like" is used to help people understand OpenVZ, LXC, jails, docker, cgroups, etc aren't focused on the possibility of an RCE in the container escaping the container, but helping people understand what a container even is in the first place.

Or to put it another way, strcmp("VM", "VM-like") != 0.

Re:Jails on FreeBSD by insanitybit on Friday May 26, 2023 @08:22PM (#36090950)
If VM "like" means "doesn't do the one thing that VMs do aka run a separate kernel" it's not a very useful term