Hacker News Reader

Comment by boomboomsubban | Hacker News Reader

Could anyone tell me why Red Hat intentionally uses non-LTS kernels? I can understand why they didn't go with the last super LTS 5.10, but why go for 5.14 over the still supported 5.15? Sure it wouldn't matter in a year but that's still a year of support.

View on HN

I'm a bit out of the loop on RHEL, but a large reason for the specific kernel versions is to maintain API/ABI compatibility.

One of the reason, at the place were we ran about 100's of RHEL/CentOS instances, he stayed with RHEL-ish installs was to maintain API compatibility through out the lifecycle of the OS version.

I've now moved on to places were that isn't that specific need. But I still have a few smaller projects that I use RHEL/CentOS/Rocky/etc. because of the stability that those built into the releases.

I don't see why that would explain why they picked 5.14 rather than the LTS kernel of 5.15, unless LTS support regularly breaks API/ABI compatibility.

That part I couldn't tell you, but I haven't look into it much lately.

It is because they don't need the community's help. They have a huge kernel team, and do all their own backporting. The RHEL 5.14 kernel is quite different from the vanilla 5.14 kernel, making the community's help not that useful.

Stability. The kernels contain tons of backported goodies and bug fixes. RHEL users dislike change. We use Debian where I work, and it's stable, but not as stable as RHEL. When it absolutely needs to be rock solid, RHEL. I've used Red Hat since 1998. Fedora for personal use. You'll find some people using Debian Stable for some important things, but with Red Hat paid support, you can get help with seriously intractable problems. With Debian, there is no paid support except for third parties. Loads of corporations like having a throat to choke when the SHTF. Forgot to mention that tons of hosting companies using Red Hat/CentOS/variations of RHEL use cPanel. It doesn't run on anything else.

mid-skill level admin here, mostly linux. I put up a Debian server on racked hardware for a consulting client, did almost nothing else but check on it from time to time.. uptime was past 800 days when I took it down (?) .. not one reboot. I updated the openssl and related, that was about it. AMD64

I only recently learned to use RHEL (did the RHCSA) and from before I've used debian and Slackware. RHEL is really polished, more so than the competition. I asked around why more people aren't using RHEL in Scandinavia, and the reply I got was that it was mostly cultural.

In Europe it's Debian or SUSE, and in the states it's RHEL. I don't have a preference (but Slackware is awesome).

There’s a clear trend of migrating from SUSE to RHEL in Sweden at least

Years ago for kicks me and a few friends did the Gentoo thing starting at Stage 1 tarballs. Took my then Toshiba Satellite 12 hours to bootstrap. When I got it all up and running, it looked like anything else. I was happy for the experience, but even with all the tweaks for my specific chipsets, RAM, etc., it was no better than Red Hat or Slackware.

3 years of uptime might sound impressive, but this means you keep running the same kernel, and towards the end of that streak, that kernel is pretty much guaranteed to have a widely-known local privilege escalation vulnerability.

you sound smart and are probably technically correct, but the reality is, what replaced this setup was ephemeral VMs with outsourced India contractors.. there was spam coming from their setup within weeks of the transition.. Admin as in, I share my root password with the crew of contractors in my small company .. like that..

The very reason I will never work for a shop that outsources anything. Especially fintech stuff. You just never know who is going to have access. RBAC is huge where I work.

It would be interesting to see what percentage of meaningful security vulnerabilities couldn't be fixed via live patch. Of course that does require that you invest the significant effort required to get live patching to work, but it is possible.

So the LTS kernels have back ported features as well? My understanding was they only got bug fixes, but my knowledge primarily comes from Wikipedia.

The notion that RH kernels are stable is patently false. RH constantly backports features to "stable" kernels, and it does cause problems.

I was on the forefront of this when they were backporting container tech to their 2.6.32 kernel.

I've also seen them break userspace repeatedly with kernel changes for selinux within a stable kernel.

But as you say, you can pay for support so you have someone to scream at when things go south.

When it comes to ABI stability, I'd trust the vanilla kernels more than RHEL.

Yeah, Suse has a better kernel method IMHO.

Yelling at RH is about as effective as screaming at paint to dry faster in my experience. Their support can be very effective, but it's so slow it's mostly useless. They put you through afew layers of "are you this dumb" before you can get anywhere.

Reply on news.ycombinator.com