5 ms·

You can just compare the APIs, namespaces are like the individual components of a jail. You can use them to build something like a jail, or something different

You can just compare the APIs, namespaces are like the individual components of a jail. You can use them to build something like a jail, or something different that has a different security model. This was discussed a lot in an old HN thread: https://news.ycombinator.com/item?id=13982620 https://news.ycombinator.com/item?id=13982620

ori_b 5y ago
Yes, I am aware that it's got more moving parts. What are you using this flexibility for?
- shatteredgate 5y ago
  I'm using them for several things but the most straightforward one is probably that namespacing can be gradually added to services, you most likely see benefits from this already if you use systemd. That's one way that namespaces can be used in a different way from the docker model.
  - ori_b 5y ago
    What are you adding gradually, specifically? Like, a concrete example that names a namespace you may want to use. I'm trying to figure out what problems a half sandbox solves, and a vague "I just want to enable some capabilities" doesn't help here.
    - shatteredgate 5y ago
      A lot of the various security options in systemd: https://www.freedesktop.org/software/systemd/man/systemd.exec.html https://www.freedesktop.org/software/systemd/man/systemd.exe... The sandboxing and mount-related ones are implemented with namespaces, and the idea with them is to not make any of them mandatory so they can be slowly added to system services. That way you can get some of the benefits without needing to build a full rootfs/container for the service. I am not sure how any of those would be done with jails because jails require you to create a chroot and network interface, whereas in Linux the mount and network namespaces are just optional namespaces and you can still use the other namespaces without using them.
      - shatteredgate 5y ago
        Side note: I suppose you could chroot to /.
      - philkrylov 5y ago
        > jails require you to create a chroot and network interface, They don't: you may chroot to /, share the host's network interface, or disable networking.
        trasz 5y ago
        It's literally a single command: trasz@v3:~ % doas jail / foo 127.0.0.1 /bin/sh # ps aux USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND root 37975 0,0 0,0 13500 3056 3 SJ 09:11 0:00,01 /bin/sh root 37976 0,0 0,0 13624 2776 3 R+J 09:11 0:00,00 ps aux
        kazen44 5y ago
        also, with epairs you can do some really flexible networking stuff on freebsd between jails/jails and the host system and even jails and ipsec tunnels.
trasz 5y ago
This doesn't really answer the question. Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. One real difference is that you need to be root to create a jail. It'll get fixed eventually - FreeBSD already has unprivileged chroot, jail isn't that much different.
- shatteredgate 5y ago
  >Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. Not really, the example of Docker would probably be the most straightforward there. I don't think it's possible to fully port Docker to jails or at least I've never seen a successful port, some of the network topology features seem to just not be possible or straightforward. But I could be wrong, I have not looked into the technical details of this in years, somebody told me it might have been working a while ago but I never heard anything else about it since. Needing to be root is a major deficiency though and I can't take jails seriously with that, one of the main focuses on Linux containers in the past several years has been to make unprivileged namespaces a good option.
  - trasz 5y ago
    Docker is literally just a jail. You can do whatever network topology you want using vnet. And yes, having to use root is a major issue. Looks fixable though.
    - shatteredgate 5y ago
      Sorry, then I must be remembering some other issue. The effort to port docker to BSD seems to have disappeared. >And yes, having to use root is a major issue. Looks fixable though. AFAIK it took a long time to get this to work on Linux, there are a lot of security issues that it can cause.

ori_b 5y ago

Yes, I am aware that it's got more moving parts. What are you using this flexibility for?

shatteredgate 5y ago
I'm using them for several things but the most straightforward one is probably that namespacing can be gradually added to services, you most likely see benefits from this already if you use systemd. That's one way that namespaces can be used in a different way from the docker model.
- ori_b 5y ago
  What are you adding gradually, specifically? Like, a concrete example that names a namespace you may want to use. I'm trying to figure out what problems a half sandbox solves, and a vague "I just want to enable some capabilities" doesn't help here.
  - shatteredgate 5y ago
    A lot of the various security options in systemd: https://www.freedesktop.org/software/systemd/man/systemd.exec.html https://www.freedesktop.org/software/systemd/man/systemd.exe... The sandboxing and mount-related ones are implemented with namespaces, and the idea with them is to not make any of them mandatory so they can be slowly added to system services. That way you can get some of the benefits without needing to build a full rootfs/container for the service. I am not sure how any of those would be done with jails because jails require you to create a chroot and network interface, whereas in Linux the mount and network namespaces are just optional namespaces and you can still use the other namespaces without using them.
    - shatteredgate 5y ago
      Side note: I suppose you could chroot to /.
    - philkrylov 5y ago
      > jails require you to create a chroot and network interface, They don't: you may chroot to /, share the host's network interface, or disable networking.
      - trasz 5y ago
        It's literally a single command: trasz@v3:~ % doas jail / foo 127.0.0.1 /bin/sh # ps aux USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND root 37975 0,0 0,0 13500 3056 3 SJ 09:11 0:00,01 /bin/sh root 37976 0,0 0,0 13624 2776 3 R+J 09:11 0:00,00 ps aux
      - kazen44 5y ago
        also, with epairs you can do some really flexible networking stuff on freebsd between jails/jails and the host system and even jails and ipsec tunnels.

trasz 5y ago

This doesn't really answer the question. Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. One real difference is that you need to be root to create a jail. It'll get fixed eventually - FreeBSD already has unprivileged chroot, jail isn't that much different.

shatteredgate 5y ago
>Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. Not really, the example of Docker would probably be the most straightforward there. I don't think it's possible to fully port Docker to jails or at least I've never seen a successful port, some of the network topology features seem to just not be possible or straightforward. But I could be wrong, I have not looked into the technical details of this in years, somebody told me it might have been working a while ago but I never heard anything else about it since. Needing to be root is a major deficiency though and I can't take jails seriously with that, one of the main focuses on Linux containers in the past several years has been to make unprivileged namespaces a good option.
- trasz 5y ago
  Docker is literally just a jail. You can do whatever network topology you want using vnet. And yes, having to use root is a major issue. Looks fixable though.
  - shatteredgate 5y ago
    Sorry, then I must be remembering some other issue. The effort to port docker to BSD seems to have disappeared. >And yes, having to use root is a major issue. Looks fixable though. AFAIK it took a long time to get this to work on Linux, there are a lot of security issues that it can cause.