Talos Linux | Hacker News Reader

Talos Linux

talos.dev

100 pointskiyanwang44 comments

I was totally expecting this to be something made by Raptor: https://www.raptorcs.com/TALOSII/

Same. Was expecting polished Debian-based OS for ppc architecture machines. Shucks.

I would expect Raptor folks to contribute upstream to firmware, the Linux kernel, bootloaders and Debian itself, not make a fork just for their own machines. The Debian ppc64el architecture is an official release architecture so Debian supports those machines quite well already.

That's a fair point. I guess watching System76 PopOS has biased my thinking.

The existence of PopOS is pretty disappointing to me, they should instead be offering a choice of preinstalled distros, contributing to those distros and sponsoring those distros.

I had somewhat of a weird moment here as well. I was expecting this to be related to Cisco Talos.

And so I opened your link to find out what it was about. Only to find it mentioning CAPI 2.0 which I only know from the ISDN days (https://en.wikipedia.org/wiki/Common_ISDN_Application_Progra...) and not as some form of I/O interface accelerator.

We mention CAPI but certainly not 2.0 since the CAPI we are referring to is "Cluster API" and they only have 1.0.

The amount and variety of machine images shipped is honestly impressive:

https://github.com/siderolabs/talos/releases/tag/v1.0.6

First time I have seen a project publish vmware-arm64.ova for ESXi arm edition.

Is it still possible to exec into a shell on a cluster node via something like https://github.com/kvaps/kubectl-node-shell ?

There's no shell on a Talos machine. You can obviously mount the host filesystem into a container, but you cannot exec onto a node directly (afaik).

This is correct. You could have a privileged pod that mounts up the host and you can do things from there but even then the OS is read only.

> Ephemeral

> Talos runs in memory from a SquashFS, and persists nothing, leaving the primary disk entirely to Kubernetes.

Hmm so if the entire disk is unused where is /boot in this configuration?

It can netboot.

... so it wastes memory instead of disk?

Unless we are talking about, like, a 100MB ramdisk, why is that a good thing?

And really, I'd prefer a 10MB ramdisk.

Diskless servers are not uncommon

I've got over 10k of them. ;-)

It is a 50MB squashfs.

Thats impressive honestly.

Probably makes full disk encryption easier. Also compared to how much memory you can have on a modern server - it's trivial amount

Can anybody help explain when organizations should use Talos instead of cloud-vendor-managed Kubernetes offerings (EKS/AKS/GKE)? Especially considering that the managed offerings now fit most regulatory requirements (e.g. EKS is FedRAMP-High Authorized)? Or does Talos see most of its use in on-prem environments?

> Can anybody help explain when organizations should use Talos instead of cloud-vendor-managed Kubernetes offerings (EKS/AKS/GKE)?

1. Learning. I want to self host to learn the stack top to bottom.

2. Build your own service.

3. Why not? (probably the best, most hackerish option)

> Especially considering that the managed offerings now fit most regulatory requirements (e.g. EKS is FedRAMP-High Authorized)?

Standards that meet regulatory requirements may not be updated or secure enough to meet private sector needs.

For folks who are all in on a single cloud provider it might not make sense, but if you run Kubernetes in multiple clouds, on-premise, edge, etc. then it starts to make a lot of sense since you get consistency.

GKE uses ChromeOS, weirded me out at first.

GKE runs Google's "Container Optimised" OS. It's just a bare-bones Linux designed for security and performance running containers, very similar to Talos.

Edit: Was wrong, thanks for the correction.

“Container-Optimized OS is maintained by Google and based on the open source Chromium OS project.” [0]

[0] https://cloud.google.com/container-optimized-os/docs/concept...

Ha. I even triple-checked this with a bunch of google searches to make sure I was right. Sorry about that!

That is strange. They aren't even some common base, CO-OS is literally based on Chromium OS.

Ssh into the nodes and poke around. Interesting FS layout, my typical probing commands didn't work and couldn't figure out the package manager or distro for a while, it was my firsr exposure to chromium os.

interesting factoids:

CoreOS was too based on Chrome OS!

And Chrome OS is related to Gentoo Linux.

I've been looking at Talos for almost a year now. I love the fact there is no shell, each machine is just a K8s node. It seems wonderful, but I can not get it to install. A friend has has the exact same experience, he finally went with Ubuntu and k3s. Has anyone successfully installed it?

Have you tried our Slack fir support?

By Talos, this can't be happening!

So.. it's CoreOS all over again?

Or Ubuntu Eucalyptus?

(Neither is still with us. wonder why..)

CoreOS has a lot of children including Flatcar, RHEL CoreOS, and Fedora CoreOS. Then you have Ubuntu whatever, Google Container-Optimized OS, Amazon Bottlerocket, Talos, and probably a few more. The market is flooded.

The same spirit as CoreOS but it is something entirely different. Written from PID1 up solely for the purposes of running Kubernetes.

I would say that CoreOS is gone because RH destroyed it. Not because people didn't use it.

I think you are misinformed, coreos is still alive within RH products (openshift)

Oh I am well aware of RH CoreOS.

or SmartOS?

> Security: Talos reduces your attack surface: It's minimal, hardened and immutable. All API access is secured with mutual TLS (mTLS) authentication.

So, no actual threat modelling, third party audits or integration and unit testing is done? Yes, that appears so.

Did you just read a marketing blurb on their landing page and decide after 5 seconds they don't do unit testing? I guess we can also assume they don't brush their teeth every morning because they didn't mention that either.

Actually I read the entire documentation and browsed the source code.

https://www.talos.dev/v1.0/learn-more/philosophy/ "Security" section makes no mention of independent audits. It just boldly claims "There are no passwords in Talos" as if that was a panacea for security.

The existing integration tests don't verify any assumptions about security, only that the configuration is valid. Please correct me if I'm wrong or missed anything.

If you're going to call something "secure" you need to prove it.

They didn’t call it secure as per your initial quote. They say it is designed to have a small attack surface. You missed to acknowledge that security means different things for different contexts. Besides, it’s a free offering, clearing issues with insecurities other offerings have. If you want something to be more secure, you can point out flaws you find in the intended way (filing issues) which might help improve the situation. Calling it out the way you did (probably without trying the tool and even more likely without having substantial knowledge of better approachable alternatives in the space) doesn’t help at all.

This is SO cool, Raptor Engineering's Talos Workstations have a new OS!

This only appears to support ARM64/aarch64 and AMD64/x86_64; it doesn't mention POWER anywhere.

Why'd they name it Talos then? LOL check out my new OS - called Surface!

Reply on news.ycombinator.com