Hacker News Reader

Comment by ranger_danger | Hacker News Reader

Personally I still think this is not enough, and we really need full generalized (not AI-only) microvm support built into docker/podman, like yesterday.

Currently it's difficult to even get a hold of a properly configured minimal kernel (or time-consuming to try to build one) and all the right command-line incantations to even start a one-off microvm using say, qemu, with all the proper storage/networking/etc. bits one needs for production environments. Plus you need to keep that kernel updated very regularly.

I know there's projects like smolvm that try to make this simpler, but I've had some major problems with those solutions as well, and I just feel like the big boys need to step up and support this directly by now.

View on HN

this has already been done.

runsc (gvisor)

Kata Containers (virtualization)

both drop in replacements for runc (default OCI runtime)

there are others too. one based on libkrun : https://github.com/containers/crun/blob/main/krun.1.md

and these are just runc replacements.

with some minor scripting you can roll a CLI solution using any of gvisor, cloud-hypervisor, firecracker, muvm (libkrun).

Many such things have been built. Problem afaik is that the underlying hypervisor setup to support VMs isn't present, or isn't enabled by default, or is hard to figure out, on many machines. Plus you need nested virtualization when the thing you're using is a VM itself (also comes with possible pain). Docker runs because it has "ROAC" properties (Runs On Any Computer). That's not today true of VMs (of which micro-VMs, firecracker etc are a subset).

Maybe this here helps (I have not tried yet): https://github.com/virtkit-dev/virtkit

I wanted to try it but it seems it requires krun which does not have a readily-available package on ubuntu that I could find, and I didn't feel like compiling it.

BETA: I have been following https://github.com/superradcompany/microsandbox a bit, very simple to get started with at least.

I'm all ears, would love to improve smolvm into the right solution for this.

Well for starters, all the single binaries I made of various distros a month ago, simply don't work anymore for no obvious reason. Trying to execute the process silently exits after about 10 seconds with a 0 exit code and no output, shell or anything at all, and no errors. I have absolutely no idea what to do now.

Apologies for this.

I introduced a breaking change in order to build out the hosted platform & registry of pre-packed machines.

I updated the newest smolvm to have a recommendation to repack to fix it.

Forgive me, hope you can try smolvm again. It's improving. :'(

I thought the point of a single binary was that none of that should matter?

Containers and security are oxymorons. The flood of page cache cves (which can always be escalated/weaponized to an escape) from the other month is making deploying containers to prod untenable.

As for orchestration - a lot of folks think you need a completely new orchestration system for dealing with vms but we just simply re-use the existing infrastructure that already exists - the public clouds. Those companies have tens of thousands of engineers that are much better than the average engineer at this stuff, custom hardware, custom protocols and close to several decades of existing deployment.

I can build and ship a vm from my laptop/ci to prod on AWS/GCP in ~tens of second. Granted I come from the camp that thinks deploying full blown general purpose operating systems to prod is an increasingly incredibly risky practice.

Have you tried podman with the crun OCI runtime and `--annotation=run.oci.handler=krun`?

The problem I ran into is that krun does not have a readily available package for ubuntu, and I'm too lazy to build it.

Reply on news.ycombinator.com