ctalledo

4 ms·

1.
by ctalledo 5y ago
Thanks again for the detailed response. > Have a look at what gVisor actually does I am aware of what it does, though I had missed the fact that the Sentry and/or Gopher run within a user-ns (could not find this in the docs). Had al
2.
by ctalledo 5y ago
LXD is great, but one nice feature of Sysbox is that it's an OCI-based runtime, and therefore integrates with Docker, K8s, etc. In a way, Sysbox turns Docker containers or Kubernetes pods into LXD-like containers, although there are di
3.
by ctalledo 5y ago
Thanks for the feedback; I am one of the developers of Sysbox. Some answers to the above comments: - Regarding the container isolation, Sysbox uses a combination of Linux user-namespace + partial procfs & sysfs emulation + intercepting
4.
Sysbox now works on K8s v1.21(github.com)
3 points by ctalledo 5y ago|1 comments
5.
by ctalledo 5y ago
Hi HN, this is Cesar, one of the developers behind Sysbox, a next-generation "runc". Sysbox enables containers (or pods) to act as "VM-like" environments, capable of running systemd, Docker, Kubernetes and more, seamless
6.
Show HN: Rootless Containers/Pods that run systemd, Docker, and even Kubernetes
10 points by ctalledo 5y ago|0 comments
7.
by ctalledo 5y ago
Thanks! Yes, if you wish to setup dev environments backed by Docker or K8s containers/pods, Sysbox is an excellent way to do so because it gives you a rootless container inside of which you can run most workloads that run in VMs. Prior
8.
Sysbox v0.3 Released
14 points by ctalledo 5y ago|2 comments
9.
by ctalledo 6y ago
If you are using Docker-in-Docker, you may want to checkout the new Sysbox runtime (find it on Github). It's a new type of runc that sits below Docker and creates rootless containers capable of running Docker, systemd, K8s, etc. All yo
10.
by ctalledo 6y ago
+1 for the Emacs client.
11.
by ctalledo 6y ago
Thanks; one thing I may have omitted mentioning is that Sysbox works with the fast overlayfs storage driver, meaning that when you do use it for Docker-in-Docker for example, both the outer Docker and the inner Docker are using overlayfs (a
12.
by ctalledo 6y ago
Agreed; it's certainly something we will keep in mind as we mature Sysbox.
13.
by ctalledo 6y ago
A use case that we often get asked about for Docker-in-Docker is using the outer container as a dev environment that includes a developer's tools, ssh, and a dedicated Docker (CLI + daemon). It gives sys-admins a lighter-weight alterna
14.
by ctalledo 6y ago
Ubuntu carries a few things that Sysbox relies on: a couple that come to mind are the shiftfs module (which Sysbox uses to enable the user-namespace in containers without requiring Docker to be set in userns-remap mode) and a kernel patch t
15.
by ctalledo 6y ago
There is plenty of info on Kubernetes (K8s) on the web, so I would start there. As far as running K8s inside Docker containers though, the use case would be one in which you want to run multiple isolated K8s clusters on a single host. One w
16.
by ctalledo 6y ago
This is something we've not tried yet, so I don't know. I would be surprised if it worked right now. But in general, it's something we would definitely be interested in exploring. The containers created by Sysbox act like vir
17.
by ctalledo 6y ago
We felt just providing enterprise support would not be sufficient to create a healthy business, given that Sysbox is designed to work under the covers (i.e., under docker/containerd) and does not require a lot of support. We opted for
18.
by ctalledo 6y ago
Take a look at the Nestybox blog site: https://blog.nestybox.com/ It has an article on Docker sandboxing. Hope that helps!
19.
by ctalledo 6y ago
Correct; Sysbox always enables the user-namespace in containers and manages the subuid/subgid allocation. In the open-source version, it assigns all containers the same subuid/subgid range, which is not ideal for cross-container i
20.
by ctalledo 6y ago
Thanks @lopezator.
21.
by ctalledo 6y ago
That's funny ... brings back memories of the 90s :) One thing I've noticed is that in modern IT infrastructure, there is usually two levels of sandboxing going on. At the low level you have VMs (sandboxed OS), and on top of it you
22.
by ctalledo 6y ago
It's hard to compare them because the goals are different. Kata containers seeks to harden container security by wrapping it with a highly optimized VM. Sysbox seeks to enable containers to run system-level workloads (systemd, dockerd,
23.
by ctalledo 6y ago
Please take a look at these examples and let us know if they help: https://github.com/nestybox/sysbox/blob/master/docs/quicksta...
24.
by ctalledo 6y ago
Got it; note that inside a system container you can always run docker-in-docker using privileged containers ( https://hub.docker.com/_/docker ). That is, you don't need sysbox nesting in order to run more levels of
25.
by ctalledo 6y ago
Yes, as long as you can install Sysbox on the EC2 nodes, you are good to go.
26.
by ctalledo 6y ago
Thanks, that's really encouraging. While it has taken a lot of hard-work to develop it, Sysbox would not exist without the excellent work done by OCI runc developers (Sysbox was forked from runc) as well as the LXD developers (who have
27.
by ctalledo 6y ago
Got it; the answer is no, because I believe AWS ECS (Fargate) creates the containers using the OCI runc. In order for them to offer system-containers as a service, AWS ECS would need to run Sysbox on their backend to deploy the containers.
28.
by ctalledo 6y ago
Great! ping us on our slack channel (the link is in the sysbox README file) in case you need help.
29.
by ctalledo 6y ago
Unfortunately not. Sysbox requires "true root" privileges, so it can't run inside a system container deployed by Sysbox itself (since that system container would use the user namespace). You can run Sysbox inside a privileged
30.
by ctalledo 6y ago
You can certainly install Sysbox on an AWS EC2 VM and launch system containers inside that VM. Note that Sysbox currently requires Ubuntu Linux, because the latest Ubuntu releases use pretty new kernels and carry kernel patches that Sysbox

More ›