Hacker News Reader

So playing microkernels anyway, with worse performance due to the extra monolithic layers.

How are namespaces similar to microkernels? I see them a lot more as glorified chroot; it's not like there's a modprobe namespace or anything.

Namespaces are a tiny part of what means a complete container infrastructure, across all OS layers.

Then there is the whole IPC taking place across containers with much slower APIs and heavier context switch states.

Containers on Linux don't have slower APIs or IPC, and don't have heavier context switches. Are you sure you're not thinking about VMs?

How do containers communicate with each other?

Sockets, shared memory, or the network, just like any Linux process.

Shared memory across containers, across isolation layers, that is a good one.

The two remaining ones are worse than any micro-kernel API call in performace.

It's explicit, just like all the other mapping/mounting options[1], and containers aren't exclusively for secure isolation anyway. Many examples exist where security isn't desirable, such as the afformentioned toolbox/distrobox.

[1]: https://docs.docker.com/engine/reference/run/#ipc-settings--...

Reply on news.ycombinator.com