Hacker News Reader

Comment by reactordev | Hacker News Reader

   “devices:
         - /dev/kvm”

Well yeah, sure, you’re running a qemu vm in a container, that’s not exactly the same thing here.

No one will (should) ever expose /dev/kvm to containers in production.

View on HN

Isn’t that just easy way to run Windows on my laptop ? Docker is not about security, but about lazyness.

Some people see the word “containerization” and confuse it with “sandboxing”. It’s about defining your requirements on a filesystem level. Not security.

Docker gives you plenty of tools to sandbox & isolate your applications. Just like any other consumer-facing product you will have to roll your own security policy.

You can use qemu for pure userspace emulation, without passing /dev/kvm. It'll be slow. Probably unusable for Windows. However I used this kind of emulation to build images with qemu from arm host and it worked OK, like few minutes to boot from Linux image, install some packages, run some commands and shutdown.

Docker is actually great for that kind of applications, because you can run it everywhere: Mac, Windows with one single-line. The only problem is that it's not very convenient to use docker images just as file containers, but it works.

Docker is actually not that great because you can't run it everywhere. BSD and illumos have no native docker support for example.

Docker is literally doing nothing there but getting you a qemu binary. There are countless better, more efficient ways to do that. Namely nix.

If "running a VM" is somehow simpler with docker, you should really think about what Docker is supposedly doing for you.

Reply on news.ycombinator.com