Hacker News Reader

Comment by peteretep | Hacker News Reader

    > just let me run containers on bare metal

I don't think you understand what a container is.

View on HN

Er OK, I'm not sure why you'd think that. Generally on HN we provide supporting arguments. If it wasn't obvious, I'll explain further:

Containers run on a shared kernel. That kernel should run on metal, not in a hypervisor.

If the containers are running on a shared kernel, they're hardly running on the bare metal. As to "that kernel should run on metal", I hear "Debian" provide such a thing.

The problem is the terminology around "bare-metal". Bare-metal hypervisor are what Popek and Goldberg [1] referred to as the Virtual Machine Monitor (or VMM) - in this case there is a hypervisor operating system and it runs different guests directly. VMWare's vSphere ESXi is a bare-metal hypervisor.

The alternative is a Hybrid Virtual Machine (HVV), where you run the hypervisor as a seperate program on a host operating system. VirtualBox is one if the better known examples of a HVV, or type-2 hypervisor.

With containers, you could argue that they are actually bare-metal because they share more in common with a type-1 hypervisor, because it is the operating system itself that is creating an efficient and isolated environment within which the application runs. In terms of Linux containers, a combination of resource isolation (cgroups [2]) and namespace isolation [3] achieves operating system level virtualisation.

So actually, containers are really bare-metal.

1. http://cs.nyu.edu/courses/fall14/CSCI-GA.3033-010/popek-gold...

2. https://en.wikipedia.org/wiki/Cgroups

3. https://lwn.net/Articles/531114/

You're trolling. It should be obvious that a kernel is needed to run those containers, and that I was asking for that kernel to be on bare metal.

For someone so confident in their technical abilities, I'm surprised you suggest running a general purpose OS as a container parent.

If you say one thing, and mean something different, calling someone who points that out to you a troll is odd.

I guess by your reasoning you could talk about running your nodejs services "on the bare metal" because it's obvious you need a kernel and nodejs too. I think it might be similarly misleading.

You really aren't helping your argument any here. Linux containers use resource and namespace isolation via the Linux kernel. When we talk about "bare metal", we're using shorthand to talk about the difference between a type 1 and type 2 hypervisor, where when we talk about a type 1 hypervisor we are referring to an operating system that does the actual virtualisation work directly, and when we talk about a type 2 hypervisor we are referring to something like VirtualBox that runs on top of a host OS as a seperate process itself and which does the virtualisation work.

Linux containers rely on the operating system via cgroups and namespace isolation to do virtualisation. That's bare-metal under ordinary virtualisation terminology.

"Does your node app run in a VM?"

"No, because of the heavy IO load we run it on bare metal"

Doesn't sound odd to me.

This makes me think you have some kind of nodejs runtime instead of running a linux kernel.

https://www.twitter.com/shit_hn_says/status/2348563455794462...

When life imitates art.

Not quite.

If the containers run on a shared kernel they're effectively running on whatever that kernel runs on, bare metal included. Or not?

Unless I misunderstand, there's a parent kernel running, on which the containers are sandboxed groups of processes.

There's no 'parent' kernel, just a kernel per-se. Containers are userspace only and do not have a kernel of their own.

Oh I think he does. You can run linux containers on bare metal - but you loose some features and it's not really secure.

Look at SmartOS for example - their zones run on bare metal and provide most of the vm features as well as strong seperation.

Reply on news.ycombinator.com