Re:My VM is lighter (and safer) than your container (2017)
by fhuici on Tuesday May 14, 2024 @09:34AM
(#40355082)
The model of a single container within a VM just adds overhead. The ideal case would be to remove the container layer and have the application(s) within the container run directly in the VM (which hopefully only includes the libs and OS modules needed for the app to run, and nothing more).
This is the approach we take at kraft.cloud (based on the LF Unikraft project): use Dockerfiles to specify app/filesystem, and at deploy automatically convert to a lightweight VM (unikernel) without the container runtime/layer.
Re:My VM is lighter (and safer) than your container (2017)
by nailer on Tuesday May 14, 2024 @12:09PM
(#40356735)
> So you do get strong isolation.
No, you don’t. There is no benefit the container is providing, because The only feature of the container is isolating you from the zero other containers running on the VM.
Re:My VM is lighter (and safer) than your container (2017)
by kevincox on Tuesday May 14, 2024 @12:36PM
(#40357063)
The isolation I am referencing is from the VM, not the container. Containers don't provide strong isolation, that is why the VM is required in this model.
Re:My VM is lighter (and safer) than your container (2017)
by nailer on Tuesday May 14, 2024 @08:30PM
(#40361726)
The VM is an isolated environment itself. You do not need to be isolated from it.
Using two levels of userland isolation makes about the same sense as using 457 levels of userland isolation.
This is similar to how managed container IaaS works. They launch a VM and run your container in it.
It is extra complexity but has a few advantages. 1. People already have a convenient workflow for building container images. 2. The base OS can manage hardware, networking and whatever other low-level needs so that the container doesn't need to have these configurations. 3. If you want to trade of isolation for efficiency you can do this. For example running two instances of a container in the same VM. The container doesn't need any changes to support this setup.