‹ BackHN Continuity

Thread

Docker has always used microVMs (well since 2016)

48 points · 40 comments · avsm

  1. unsnap_biceps · · focus · HN ↗
    Article title is a bit click-baity. The article is only talking about Docker Desktop on Mac or Windows. Docker Linux have not been using microVMs for a decade.
    1. throwaway27448 · · focus · HN ↗
      It's still not a bad idea to reduce attack surface. A VM is much easier to harden than a kernel.
      1. c0balt · · focus · HN ↗
        In those two cases they also use VMs because they don't really have another cheap option.

        Neither XNU/Darwin nor Windows have had an oob option for running Linux images. WSL is rather new in comparison.

        1. pjmlp · · focus · HN ↗
          Windows has native support for Win32 containers though, those don't need WSL, they build up on top of jobs infrastructure.
          1. c0balt · · focus · HN ↗
            Sure but almost no OSS projects build containers for Windows (to my knowledge). The same goes for XNU/darwin afaik. They may get binaries but container images often assume Linux by default.

            Developers, ime, also don't really want to start building their own container images for auxiliary services like, e.g., PostgreSQL, MongoDB or MySQL.

            Having virtualized Linux support means you can take the existing ecosystem and make it accessible to the other two. It also means docker itself doesn't have to fully embrace & support either which is part of why it's "cheaper".

      2. otterley · · focus · HN ↗
        Of course it’s not a bad idea. It’s just a bad article.
    2. avsm · · focus · HN ↗
      > Docker Linux have not been using microVMs for a decade.

      You sure could. Kata containers have been around for a long time; I remember putting them into production back in 2017 or so (and dealing with filesystem forwarding issues). <a href="https:&#x2F;&#x2F;lwn.net&#x2F;Articles&#x2F;755230&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lwn.net&#x2F;Articles&#x2F;755230&#x2F;

      1. unsnap_biceps · · focus · HN ↗
        &quot;Could&quot; is not the same as &quot;always&quot; which is what the article title is claiming.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.