Hacker News Reader

Comment by richardwhiuk | Hacker News Reader

Or use something like GKE where the containers should be running directly on hardware, so you only have one layer.

"Bare-metal" means running directly on hardware. But yes, GKE would also join Triton and Red Shift (provided it has similar container isolation capabilities).

Actually, as 0x74696d mentions below, GKE is also not bare metal.

Doing a little research: GKE runs on https://cloud.google.com/container-optimized-os/docs/ which is designed for GCE, which runs on KVM: https://cloud.google.com/compute/docs/faq

So it looks like just Triton and Red Shift.

Disclaimer: I used to work at Red Hat, which means I like the people behind Red Shift, but that also means I hate the people behind Triton as part of the early 2000s Linux/Solaris wars.

GKE clusters run on VMs, not on bare metal.

Containers don't actually run directly on hardware with GCE - there's still a virtualization layer in-between.

I'm 99% sure that Google runs one VM per container because that's the only way to make it safe.

Anything else would be insane.

1 container per VM? What's the point? If you can bypass container sandbox it's very likely that you can do the same with VM.

> If you can bypass container sandbox it's very likely that you can do the same with VM.

Hypervisors are much, much harder to break out of than a Linux container.

> I'm 99% sure that Google runs one VM per container

I'm 100% sure you are wrong. You might as well just use VMs.

Containers are not only about safety, you know.

I stand corrected, it's a bunch of VMs per customer but still no multi-tenancy.

Reply on news.ycombinator.com