Re: Fedora/RedHat is moving is a similar direction

On Sat, Sep 5, 2015 at 9:20 AM, Liam Proven <[email protected]> wrote:

> No. That does not help at all. It literally contributes nothing at
> all, *and* would get in the way.
>
> Docker is a kind of standardized container for Linux.
>
> Containers are a sort of virtual machine.
>
> Current VMs are PC emulators for the PC: they virtualise the PC's
> hardware, so you can run multiple OSes at once on one PC.
>
> This is useful if you want to run, say, 3 different Linux distros,
> Windows and Solaris on the same machine at once.
>
> If you run lots of copies of the same OS, it is very inefficient, as
> you duplicate lots of code.

But it was my understanding that this is what made Docker so great.
Unlike other visualization systems, e.g. Xen and VMWare, Docker
doesn't require a full instance of each OS running.

"The goal of LXC is to create an environment as close as possible to a
standard Linux installation but without the need for a separate
kernel. As the linuxcontainers.org website puts it: LXC is often
considered as something in the middle between a chroot on steroids and
a full-fledged virtual machine."

So Docker is really a containment system, not a virtual OS system.

> Containers virtualise the OS instead of the computer. 1 OS instance, 1
> kernel, but to the apps running on that OS, each app has its own OS.
> Apps cannot see other apps at all. The virtualisation means that each
> app thinks it is running standalone on the OS, with nothing else
> installed.
>
> This means that you can, say, run 200 instances of Apache on 1
> instance of Linux, and they are all isolated. If one crashes, the
> others don't. You can mix versions, have custom modules in one that
> the others don't have, etc.
>
> All without the overhead of running 200 copies of the OS.

You should be able to do that with Docker.

> All within 1 user account, so that this can be done for multiple
> users, side-by-side, even concurrently on a multiuser host.
>
> It is nothing to do with user accounts; these are irrelevant to it.

But isolating users to there own contained OS on a multi-user system
would nonetheless be a step in the right direction, wouldn't it? That
seems almost like a no-brainer to me actually.  In a way I feel like
we are worrying about securing all the closets in the house, but
haven't bother to put a lock on the front door yet.