Containers are chroot with a Marketing Budget

by simjue • 4 years ago

20 16 4 years ago

Author here. Containers always seemed a little magical to me. So I dug into how they work and then built a “container runtime” that only uses the change root sys call (Which has been in UNIX since the 70s).

This was not only fun, but took a way a bit of the magic, so I could better understand what’s going on when I use real containers.

Let me know what you think!

PaulHoule2• 4 years ago

I would have voted this article up except for the meme images.

adamgordonbell4• 4 years ago

I like to think images can break things up a bit, keep people engaged and summarize the main points in a fun way.

Here's an article that is very heavy on 'voice' using images that I thought was a lot of fun:

https://www.cockroachlabs.com/blog/raft-is-so-fetch/

hotpotamus2• 4 years ago

I find that technology is a lot like magic - delightful and baffling when you're uninitiated, and mundane and boring once you learn the grubby details of how it's done. I believe it was Arthur C. Clarke who said that sufficiently advanced technology is indistinguishable from magic, so my insight is hardly a new one.

As far as I can tell, what Docker did was to create a universal software packaging system within the Linux world. Thinking of them as a lightweight VM can be useful, but it's not the full picture.

adamgordonbell4• 4 years ago

As far as I can tell, what Docker did was to create a universal software packaging system within the Linux world.

Yeah, for sure and containers are great. Namespaces, cgroups v2, runC, overlayfs, the OCI image format, and everything else in this space is impressive engineering. It’s incredible forward progress we can all take advantage of. But it's fun to peal back the layers and see it’s a long series of progressive refinements.

musicale2• 4 years ago

chroot is fine, though often I will also want resource limits (usually via cgroups) and an IP address (usually via network namespaces.)

Often I don't even need chroot, just resource limits and an IP address - and the latter probably wouldn't be necessary with a distribution/proxy switch or if if DNS returned IP:port (which arguably it could.)

afiori2• 4 years ago

Indeed the docker revolution was the Dockerfile and container images: the latter a convenient way to store and share container binaries and the former a convenient way to define recipes for the latter.

This is also what they are trying to do with wasm and what (in part) GitHub did with git: creating a developer ecosystem.

adamgordonbell4• 4 years ago

I never thought of the parallels to git but that is interesting.

So git is to github as (chroot/cgroups/unionfs) is to docker et all?

What is the VC company that is going to spring up around WASM?

afiori2• 4 years ago

Docker itself is trying to expand into wasm applications: https://news.ycombinator.com/item?id=33320530

treffer• 4 years ago

So git is to github as (chroot/cgroups/unionfs) is to docker et all?

You could do docker-alike runtime things with lxc and e.g. squashfs filesystems. That is IMHO a good signal to say it's not the tech.

I see it more as developer workflows. Github looked at git and LKML working model and put that into a centralized UI. The revolution was individual contribution (not teams) and personal repositories. (Does anyone remember the other scm hosting tools before? I remember running some open source sorceforge alike thing)

Docker took all the pieces before you could run a container and made those easy to achieve (building, sharing, pulling, ...).

That's developer workflows.

suprjami• 4 years ago

Very insightful comment.

The developer ecosystem is always the primary path to success.

The same thing with Raspberry Pi. There are a million $notmuch single board computers with fruit names, but the Raspberry Pi has dominated much more powerful systems for 10 years now because of its top-tier software.

musicale2• 4 years ago

One new possibility that seems exciting to me is building native OS X containers based on chroot

I'd actually like to see macOS support BSD jails.

failsecure• 4 years ago

But containers are not just chroot + marketing. Some containers offer real security advantages not found with using straight up chroot. I would agree that the __basis__ of containers is chroot however.

Any search of "chroot vs docker" or "chroot vs lxc" will immediately show that there are some attempts made to isolate the container from the host.

But I will say that I use docker images on a regular basis in chroots for the simple fact that I don't have to wait for debootstrap (or similar) to build a chroot for me.

mikewarot• 4 years ago

My understanding is that chroot can be escaped, and containers prevent that. Am I mis-informed?

My view is that VMs, Containers, WASM and all the other things of that sort are just efforts to patch the lack of capability based security in the Unix/Linux/Windows OS model.

Containers are chroot with a Marketing Budget

Related Stories