Hacker News Reader

Comment by lmz | Hacker News Reader

Does anyone have a link to an explanation of why they moved to this approach in WSL 2?

Edit: more info here: https://devblogs.microsoft.com/commandline/announcing-wsl-2/

Ahh, from your link:

"dramatic file system performance increases, and full system call compatibility, meaning you can run more Linux apps in WSL 2 such as Docker."

That will be welcome. I use WSL, but it's currently very slow for anything that touches lots of files, like a git clone, rsync, etc.

Not sure if that article touches on it but it also allows docker to be used without a VM

You can use docker client from WSL and have it use the Windows docker running in the background. No need for VM

https://nickjanetakis.com/blog/setting-up-docker-for-windows...

Docker for windows currently still runs in a VM though

Docker just runs a lightweight vm in hyperv which uses to run the containers. So yeah a Linux vm is still needed.

I use WSL at work and use windows docker as a server... I use docker client form wsl ubuntu and make it connect to the Docker server running on windows. I do the same thing with databases. I’ve grown fond of this approach, as it integrates well with the Services app in windows.

https://nickjanetakis.com/blog/setting-up-docker-for-windows...

That is not the most secure way to run Docker in WSL - IIRC exposing the Docker socket on localhost lets websites start Docker containers. If you use something like npiperelay [0], you can access Docker from WSL without exposing the Docker socket to everything.

0: https://github.com/jstarks/npiperelay

Can't docker restrict incoming connections from a whitelist? Or you could use the system firewall to ensure that it does.

What do you mean by a white list? The connections are coming from local host (from your browser). The fact that they were initiated by code which was downloaded from malware.com is not knowable to docker.

oh wait, you mean from client side javascript? I didn't know you could do that. FWIK, only WebSockets are supported within browsers - let me know if you know of a way otherwise.

I'm pretty sure you can make http POST and GET requests from client side JS, and again IIRC you can start a container in Docker with a single POST - no return info required

Yes, but aren't HTTP requests subject to CORS?

I'm pretty sure, otherwise, that is a gaping hole in many security setups right now - if any website could poke local sockets using client JS.

CORS applies only to JS code - sites can still issue cross-origin GETs and POSTs via HTML, using Forms for example. Not sure whether there is enough control on the format to actually issue a valid Docker request.

Still, it's generally a pretty bad idea to have an unauthenticated service running on localhost which can perform arbitrary operations on the system - you're depending on all other software running on the system not to transform that into a vulnerability.

It would be nice if they improved their own file system performance. Sidestepping the gap by running a VM gives them less incentive to fix these issues, which are also visible in native Windows applications.

I agree Windows file access is noticeably slower than on other platforms. But it seems like the issue has quite fundamental roots: https://github.com/Microsoft/WSL/issues/873#issuecomment-425.... Add to that Windows Defender scanning, and you have death by a thousand cuts rather than something that could be fixed by a single measure like adopting a faster filesystem.

I used to work at Microsoft doing work that touched filesystem stuff a lot, and every single one of those points was known to me already. But at a certain point they ought to be able to say: the OS is not competitive with the state of the art in this area. It shouldn't matter what organizational or component boundaries create this situation, they should do more to fix it. Blaming the layering is a start I guess, but shouldn't be the end.

Sure, hard to argue with that. The effects are pronounced enough even from an end-user perspective, and it's clearly Microsoft's job to fix.

Not sure how they could improve filesystem performance, since they have previously explained that the slowness is from going through the Windows FS stack that has hooks at like five different levels. So do they now somehow sidestep the Windows' FS? How would that work?

As they're using a linux kernel, I wonder if they're using an ext4 filesystem for the wsl stuff, hosted in a file image on NTFS? Windows apps could still get access to the wsl files via the 9P file server.

Yes they are. It's an ext4 VHD, mounted under WSL.

Makes sense. Thanks. I quite look forward to checking it out.

Oh man that sucks! Now you have to worry about resizing the partition and disk all the time. It was so awesome not having to worry about that!

For me it seems that they just abandoned their efforts to implement Linux syscalls and decided to build a GUI for Linux VM. Very similar to their new Edge approach: abandon complex task of building browser engine and just build a GUI for Chromium. That's very different from their original goal to have both Windows and Linux processes work together. I don't think that their WSL 2 will allow Linux process to exec into Windows binary.

For me, personally, it seems like another failure. I don't see any reason not to use Linux in VirtualBox. It's simpler and it works. Their original approach was something new and interesting. Microsoft started to make very questionable decisions lately.

Probably for the same reason they adopted Chromium as base for their browser.

Reply on news.ycombinator.com