News for hackers. Stuff that matters.
Re:SUSE Liberty Linux: secure your Linux future without fea... by hedora on Monday July 03, 2023 @04:29PM (#36578341)
Containers have to be compatible with the host operating system kernel.

In my experience, getting containers to run on non-mainstream Linux distributions is a complete crapshoot.

Re:SUSE Liberty Linux: secure your Linux future without fea... by oneplane on Monday July 03, 2023 @04:31PM (#36578364)
That's why I mentioned kernel and runtime compatibility.
Re:SUSE Liberty Linux: secure your Linux future without fea... by pxc on Monday July 03, 2023 @06:55PM (#36579864)
What non-mainstream distros did you run into this with? Was it Docker containers or desktop containers like Flatpak?

I thought with Docker the only thing you depend on from the host system was the kernel.

Re:SUSE Liberty Linux: secure your Linux future without fea... by hedora on Wednesday July 05, 2023 @12:01PM (#36602340)
Devuan and Synology come to mind. Devuan's kernels lead to segfaults that I didn't successfully diagnose. Synology's are missing some obscure system call that non-obsolete OpenSSL needs.

SmartOS (an Illumnos / solaris variant) is also a bit flaky, though was more stable than those two the last time I checked.

edit: Also, switching between RHEL and Ubuntu sometimes leads to VDSO mismatches, which can cause severe performance regressions. I've seen that with and without containers.

Re:SUSE Liberty Linux: secure your Linux future without fea... by TheNewsIsHere on Tuesday July 04, 2023 @02:09PM (#36590459)
Yeah, there are a lot of misconceptions about how containers work, and partly that’s due (IMO and experience) to the earlier days of containers, before we had things like standard formats and interfaces.

It’s also partly complicated by higher level abstractions like Kubernetes, Mesos, Racher, et al.

So at the minimum, pushing these workloads to containers with existing codebases would likely just replace the “certified on RHEL X” with “certified for use in RHEL X containers on RHEL X hypervisors, managed by container orchestration platform X version Y” and so on.

Epic has been working on an implementation of their client application (Hyperspace) as a web app (Hyperweb), and that’s probably where we’ll see any new abstraction from incumbent players with large install bases for quite a long time.

Edit: typo

Re:SUSE Liberty Linux: secure your Linux future without fea... by oneplane on Friday July 07, 2023 @09:48AM (#36631717)
As long as you have a complete userland in your image and a compatible kernel and no extra CAP or binds, it really doesn't matter at all what else the host is doing. That's true for most mainstream architectures and distros of the past 5 years (and more, but I can't be bothered to look it up).

If you add orchestration tools in to the mix, that's a different story, but even then you can argue that the orchestrator is your API and not the host OS. A bare kubeadm setup vs. EKS vs. AKS vs. GKE all have the same base API, which means as long as you don't extend past this API it doesn't matter where you run. Again, that breaks as soon as you start including hard dependencies on StorageClass configurations for PVCs, CNIs or CSIs.

The only real reason a specific host OS matters is the case where someone writes software against the specific userland of that OS. If you use the same syscalls that are available everywhere, the host OS no longer matters as long as it complies. In a way, if you didn't need the host OS userland, you could just build a single static binary. Or if the software really has special needs, build it as a unikernel.

As a concept the 'we build the software, you install the OS' deal is critically flawed and a bad point to abstract an interface between a third party vendor and a server they don't supply.