Re: Fedora/RedHat is moving is a similar direction

El 5/9/2015 6:05 p. m., "Trans" <[email protected]> escribió:
>
> On Sat, Sep 5, 2015 at 9:20 AM, Liam Proven <[email protected]> wrote:
>
> > No. That does not help at all. It literally contributes nothing at
> > all, *and* would get in the way.
> >
> > Docker is a kind of standardized container for Linux.
> >
> > Containers are a sort of virtual machine.
> >
> > Current VMs are PC emulators for the PC: they virtualise the PC's
> > hardware, so you can run multiple OSes at once on one PC.
> >
> > This is useful if you want to run, say, 3 different Linux distros,
> > Windows and Solaris on the same machine at once.
> >
> > If you run lots of copies of the same OS, it is very inefficient, as
> > you duplicate lots of code.
>
> But it was my understanding that this is what made Docker so great.
> Unlike other visualization systems, e.g. Xen and VMWare, Docker
> doesn't require a full instance of each OS running.
>
> "The goal of LXC is to create an environment as close as possible to a
> standard Linux installation but without the need for a separate
> kernel. As the linuxcontainers.org website puts it: LXC is often
> considered as something in the middle between a chroot on steroids and
> a full-fledged virtual machine."
>
> So Docker is really a containment system, not a virtual OS system.
>
> > Containers virtualise the OS instead of the computer. 1 OS instance, 1
> > kernel, but to the apps running on that OS, each app has its own OS.
> > Apps cannot see other apps at all. The virtualisation means that each
> > app thinks it is running standalone on the OS, with nothing else
> > installed.
> >
> > This means that you can, say, run 200 instances of Apache on 1
> > instance of Linux, and they are all isolated. If one crashes, the
> > others don't. You can mix versions, have custom modules in one that
> > the others don't have, etc.
> >
> > All without the overhead of running 200 copies of the OS.
>
> You should be able to do that with Docker.
Let's take the most lightweight way of having another OS inside an already
existing one: chroot, even with that the system might have to load a lot of
stuff (libraries, config, resources...) , however much of these stuff might
already be inside the host and thus duplicating them.

> > All within 1 user account, so that this can be done for multiple
> > users, side-by-side, even concurrently on a multiuser host.
> >
> > It is nothing to do with user accounts; these are irrelevant to it.
>
> But isolating users to there own contained OS on a multi-user system
> would nonetheless be a step in the right direction, wouldn't it?
Well, remember we are unix (sort-of) and as far as I remember, unix already
does this, right?
Even for those parts where unix itself is not enough, we already have
policies(SELinux), which I think are more flexible anyway.

>That seems almost like a no-brainer to me actually.  In a way I feel like
> we are worrying about securing all the closets in the house, but
> haven't bother to put a lock on the front door yet.

Don't worry, the lock on the front door is there :).

-- Best regards, Sergio

_______________________________________________
gobolinux-users mailing list
[email protected]
http://lists.gobolinux.org/mailman/listinfo/gobolinux-users