Hacker News Reader

Container engine is just a wrapper around couple of Linux APIs mainly cgroups & namespaces & iptables/BPF - there is most of hard work done. A good example how trivially it can be implemented is this: https://news.ycombinator.com/item?id=9925896

Now, implementing DBMS with even basic SQL query language, is not a trivial job.

View on HN

That's funny because getting these things right (without security issues) is quite difficult.

Its very likely that most of the challenging security stuff will continue to move down into the kernel itself. Its important to remember that the entire concept of a container wasn't really a single unified concept in the Kernel until very recently as they've gained popularity; instead, they were a amalgamation of a few different capabilities in the kernel.

Perhaps, you caught news of something I haven't seen, but AFAIK, "container" is still defined in user space. Talking to Eric Biederman, that's what the kennel team wants - people to experiment in user space, remixing kernel tech together...

There's a new-ish (from Feb) LWN article about container's as an object in the kernel: https://lwn.net/Articles/780364/

Reception still doesn't seem great.

Reply on news.ycombinator.com