Introduction to runc | Hacker News Reader

Introduction to runc

danishpraka.sh

73 pointsprakashdanish28 comments

In addition to runc, I'd like to point out an alternative OCI runtime implementation, crun (https://github.com/containers/crun). You can play with both either directly, or through Podman (https://podman.io/)

Useful for cgroups v2 too.

The really weird thing about this is that latest Fedora (by Red Hat, as is crun) doesn't even support cgroups v2. Or I couldn't figure out how to get it working. I had to disable v2 and go back to v1 and use runc.

Did you modified your bootloader with following parameter: systemd.unified_cgroup_hierarchy=1

In runtime, you should see the following:

mount | grep cgroup cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate)

btw, I use Arch (yeah I know, the standard adage)

There is also a rust implementation that I wrote in my time at Oracle. Unfortunately they no longer maintain it, but there is a fork with some more recent updates: https://github.com/drahnr/railcar

Sounds like you are no longer at Oracle. Was this at Oracle Cloud in Seattle? Can you talk about their Rust adoption?

Pretty sure runc supports cgroups2 these days.

Not sure why I would want a lot of new C on my machine, unless I was pressed for storage or RAM. Which I am not. runc is like 5MB, which is pretty small for a Go binary.

crun is quite a bit faster.

Also `runc` has quite a lot of C in it anyways. The go runtime makes many things very complicated or even impossible.

Unfortunately on mobile the zoom is fixed (I can't zoom out, didn't know that was possible) and I can't see the left and right edges of the text.

I hate when they do that. Here is a bookmarklet that will fix those pages:

    javascript:document.querySelector('meta[name=viewport]').setAttribute('content','width=device-width,initial-scale=1.0,maximum-scale=10.0,user-scalable=1');

The real fix is of course to complain to the page author.

Reader mode on Firefox does a great job too!

Reader mode in Safari on iOS works great as well, but the zoom level doesn't seem to be fixed, either. It's initially zoomed in but I'm able to zoom out and it will stay.

Checking the desktop site checkbox on Android chrome fixed that for me.

Settings > Accessibility > Force Enable Zoom; it's one of the first things I always enable.

Why would anyone want to restrict the reader in this way?

Incompetence.

Are there any runc shims that just use processes (I know, containers are just processes) ignoring network/user/etc namespace isolation and other Linux-specific security features? For example a shim that could run native MacOS processes on MacOS, native FreeBSD binaries on FreeBSD, etc. just by executing the processes directly.

The point of this would be to take advantage of the Docker ecosystem for _scheduling_ particularly in developer environments. Specifically I'd like a "docker-compose for processes" that can run on any system and just handles scheduling multiple processes together but without requiring root access to modify init scripts or systemd services at the system level.

Isnt that what Foreman and its Procfile handle?

https://github.com/ddollar/foreman

Maybe, but I don't want to learn a new config system. Developers are so familiar with docker-compose I just want to use that.

This developer not.

Sorry for the overly broad brush. :) But the existence of this shim doesn't mean you have to use it.

Nor do I have to use Docker.

wget directly to /usr/bin. Am I the only one who cringes upon such a pattern? I am probably too old. I recently almost doubled over when I saw that /sbin is now a symlink to /usr/sbin on bullseye. Even worse, /lib/modules is a symlink to /usr/lib/modules. Try $ find /lib -name \mlx5\ and learn how find treats symlinks.

Reply on news.ycombinator.com