34K views · Mar 3, 2016 · 1:45:47 · 6 HN recommenders · 9 mentions · discussed 2016–2025
Bryan Cantrill's Papers We Love talk on FreeBSD Jails and Solaris Zones, tracing how OS-level virtualization grew out of chroot and the limits of the traditional UNIX security model.
Why Hacker News points people here: Recommended repeatedly as the best account of container history and how Zones built on and went beyond Jails.
“I highly recommend this talk, talking about Jails and Zones.”HN comment, 2024
“Bryan Cantrill has a wonderful talk about exactly this in Illumos that I recommend at every opportunity”
Cantrill talk on jails, zones and OS virtualization
Bryan Cantrill has a wonderful talk about exactly this in Illumos that I recommend at every opportunity this video
“I highly recommend this talk, talking about Jails and Zones.”
Talk on how Zones built on and went beyond Jails
I highly recommend this talk, talking about Jails and Zones. Jails was first, but Zones took a lot of lessens from it and went further. this video
“this rather amusing talk by B. Cantrill discusses the history”
Amusing Cantrill talk on the history of containers
I am watching it now but he's talking about VMs ("KVM") and not "containers". As to why we're in this mess, this rather amusing talk by B. Cantrill discusses the history: this video (Linux) Containers are not VMs: link
“Bryan Cantrill has a nice talk which starts with a bit of history on containers”
Talk starting with history of chroot, jails and zones
Bryan Cantrill has a nice talk which starts with a bit of history on containers (chroot, FreeBSD jails, Solaris zones, etc.). this video
“This talk by Bryan Cantrill on the history of OS-level virtualization is great.”
Great talk on history of OS-level virtualization
This talk by Bryan Cantrill on the history of OS-level virtualization is great. this video Apparently the first version of Jails was a few hundred lines of code.
“recommended talk about those topics”
Talk on FreeBSD jails and Solaris zones
FreeBSD jails were released in 2000 in FreeBSD 4.0. Solaris Zones in 2004/2005. In fact, the original Solaris Zones paper cites jails as inspiration. Jails: Confining the omnipotent root (2000): < link > Solaris Zones: Operating System Support for Consolidating Commercial Workloads (2004): < link > Originally, jails didn't virtualise the network stack. That was added later, in FreeBSD 8.0 with VNETs, which were buggy for a long time, but went through extensive testing and are enabled by default since FreeBSD 12.0 (quite recently). Solaris Zones went a step further than the original design, and run a separate network stack for each zone from the start, years before FreeBSD did. BTW, recommended talk about those topics: Papers We Love: Jails and Zones: < this video >
.. no? Because many of the grsecurity+pax improvements apply to any kernel that runs on a CPU (it provides active protections against certain forms of kernel vulnerabilities caused by bugs). This includes illumos, thus the question is valid. grsecurity is a set of patches for the GNU/Linux kernel. illumos is based on Solaris, so the entire argument about grsecurity is nonsense. illumos uses red zones to prevent buffer overflows, which grsecurity is attempting to address. grsecurity is a commercial product by the way. A single license costs $19,000 USD. Enhanced auditing and process control which grsecurity provides have been part of Solaris, and therefore illumos, since Solaris 10, some even earlier. GNU/Linux is still playing catch-up, and as long as people like myself, Bryan Cantrill, Adam Leventhal and the rest of the former Sun kernel engineers live, it will be playing catch-up forever. My impression about package management being a shit-show on other operating systems is that every single podcast or blog post I read about those operating systems is celebrating that "package management is easy now with pkg" -- while it's actually not IMO as good as certain GNU/Linux package managers. In order for that opinion of yours to actually mean anything, the question is: how many packaging formats do you know to produce packages for? Only then will you be in a position where you would actually be competent to make such a statement, and where your opinion would actually make a diffe
I love Haiku -- and their inspiration in BeOS brings back my memories of deciding not to work for Be in 1996, and then later hitting jackpot at the Be Inc. bankruptcy auction.[1] [1] this video
Cited to support chroot as lightweight virtualization
1st of all yes, many people consider not only chroot to be virtualization (of the file system). Yes it is arguable as it is the birth of lightweight virtualization. But you were wrong in saying no one does. link this video 2nd containers go farther and virtualize network, and other resources.
