Re: Fedora/RedHat is moving is a similar direction

On 5 September 2015 at 17:05, Trans <[email protected]> wrote:
> On Sat, Sep 5, 2015 at 9:20 AM, Liam Proven <[email protected]> wrote:
>>
>> If you run lots of copies of the same OS, it is very inefficient, as
>> you duplicate lots of code.
>
> But it was my understanding that this is what made Docker so great.

It is.

> Unlike other visualization systems, e.g. Xen and VMWare, Docker
> doesn't require a full instance of each OS running.

I presume you mean "virtualisation".

Don't compare Docker to hypervisors. Both do virtualisation, but they
do totally different types of virtualisation. I'll call virtualisation
v12n for short.

Hypervisors do not mean v12n. V12n does not mean hypervisors.

Modern OSes do all kinds of v12n. Linux does v12n of your memory map,
of your I/O ports, of your graphics card, of your console, and more,
as part of its normal functioning: it allows multiple programs to
share memory, screen, keyboard, etc. by virtualising these devices;
the programs access virtual ports, memory etc. and the kernel juggles
access to the real hardware.

A hypervisor virtualises a whole machine. It allows one OS to boot and
run under another OS. It's a PC emulator for the PC. Each guest OS
thinks it has a whole PC to itself, with virtual graphics card,
virtual RAM, virtual disk controllers with virtual disks on them, etc.

Containers virtualise the whole OS, so each program thinks it has the
whole OS to itself. You run only 1 kernel, but the kernel's interface
to the program is virtualised. The program sees a clean install of the
OS and no other apps in the filesystem; the program sees no other apps
in the memory map, no other open files, nothing.

But there's only one OS.

This is a hypervisor and whole-system virtualisation:

 [apps]         [apps]      [apps]
----------       ---------     ---------
[OS #1]      [OS #2]    [OS #3]
----------------------------------------
[V PC #1] [V PC #2] [V PC #3]
----------------------------------------
[......... hypervisor.................. ]
----------------------------------------
[ ........... host OS .................. ]
----------------------------------------
[ ... real physical host PC ......]

Note, we're running 4 OSes here, with 4 sets of drivers, 3 virtualised
computers with virtual components, etc. Tons of duplication -- if
they're the same OS, lots of wasted resources.


 [apps]         [apps]      [apps]
----------       ---------     ---------
[V OS #1] [V OS #2] [V OS #3]
----------------------------------------
[......... container system ....... ]
----------------------------------------
[ ........... host OS .................. ]
----------------------------------------
[ ... real physical host PC ......]

Just one OS, one set of drivers etc., and the main thing that's
duplicated is sets of config files etc. so that each app /thinks/ it
has the OS to itself.

> "The goal of LXC is to create an environment as close as possible to a
> standard Linux installation but without the need for a separate
> kernel. As the linuxcontainers.org website puts it: LXC is often
> considered as something in the middle between a chroot on steroids and
> a full-fledged virtual machine."

Yes, correct. Not sure of the relevance. LXC is now the most
successful implementation of containers on Linux; there are others,
such as Linux VServers. On other OSes there are others: FreeBSD has
jails, Solaris has Zones, IBM AIX has LPARs.

LXC is one of the components of Docker. Docker adds management, more
isolation, standardized installation and removal and packaging of
containers, and so on.

> So Docker is really a containment system, not a virtual OS system.

No. Docker is a wrapper around LXC. LXC are containers. Containers are
an OS virtualisation system. Virtualised OS instances are called
containers; that is what containers *are*.

>> All without the overhead of running 200 copies of the OS.
>
> You should be able to do that with Docker.

You can. I was talking about Docker.

>> It is nothing to do with user accounts; these are irrelevant to it.
>
> But isolating users to there own contained OS on a multi-user system
> would nonetheless be a step in the right direction, wouldn't it?

No.

Imagine: if you have Firefox running as user "alice" and Thunderbird
running as user "bob", how is clicking a link in an email in
Thunderbird going to pass it to Firefox? How will you copy a link in
Firefox and paste it into Thunderbird?


> That
> seems almost like a no-brainer to me actually.

Well, I'm sorry, but no. The whole point of the exercise is that if,
say, one app manages a privilege escalation, it can affect the whole
OS and other apps running on the OS. This affects all user accounts --
they're irrelevant. They don't isolate apps from each other; all that
is isolated are home directories. Depending on privileges you can
still /see/ into other users' home directories, and if you have root,
you can write to them. All users can see all of the OS.

With app containerisation, each app is in a sandbox and as far as it
can see it is the only thing installed on the whole computer.


> In a way I feel like
> we are worrying about securing all the closets in the house, but
> haven't bother to put a lock on the front door yet.

There are many other things to be done, but there's no need to do them
in a particular order...



-- 
Liam Proven • Profile: http://lproven.livejournal.com/profile
Email: [email protected] • GMail/G+/Twitter/Flickr/Facebook: lproven
MSN: [email protected] • Skype/AIM/Yahoo/LinkedIn: liamproven
Cell/Mobiles: +44 7939-087884 (UK) • +420 702 829 053 (ČR)
_______________________________________________
gobolinux-users mailing list
[email protected]
http://lists.gobolinux.org/mailman/listinfo/gobolinux-users