User: Password:
|
|
Subscribe / Log in / New account

Re: Detecting if you are running in a container

From:  Ted Ts'o <tytso-AT-mit.edu>
To:  "Eric W. Biederman" <ebiederm-AT-xmission.com>
Subject:  Re: Detecting if you are running in a container
Date:  Mon, 10 Oct 2011 21:32:01 -0400
Message-ID:  <20111011013201.GA7948@thunk.org>
Cc:  Lennart Poettering <mzxreary-AT-0pointer.de>, Matt Helsley <matthltc-AT-us.ibm.com>, Kay Sievers <kay.sievers-AT-vrfy.org>, linux-kernel-AT-vger.kernel.org, harald-AT-redhat.com, david-AT-fubar.dk, greg-AT-kroah.com, Linux Containers <containers-AT-lists.osdl.org>, Linux Containers <lxc-devel-AT-lists.sourceforge.net>, "Serge E. Hallyn" <serge-AT-hallyn.com>, Daniel Lezcano <daniel.lezcano-AT-free.fr>, Paul Menage <paul-AT-paulmenage.org>
Archive-link:  Article

On Mon, Oct 10, 2011 at 01:59:10PM -0700, Eric W. Biederman wrote:
> Lennart Poettering <mzxreary@0pointer.de> writes:
> 
> > To make a standard distribution run nicely in a Linux container you
> > usually have to make quite a number of modifications to it and disable
> > certain things from the boot process. Ideally however, one could simply
> > boot the same image on a real machine and in a container and would just
> > do the right thing, fully stateless. And for that you need to be able to
> > detect containers, and currently you can't.
> 
> I agree getting to the point where we can run a standard distribution
> unmodified in a container sounds like a reasonable goal.

Hmm, interesting.  It's not clear to me that running a full standard
distribution in a container is always going to be what everyone wants
to do.

The whole point of containers versus VM's is that containers are
lighter weight.  And one of the ways that containers can be lighter
weight is if you don't have to have N copies of udev, dbus, running in
each container/VM.

If you end up so much overhead to provide the desired security and/or
performance isolation, then it becomes fair to ask the question
whether you might as well pay a tad bit more and get even better
security and isolation by using a VM solution....

	     	       	  	     - Ted


(Log in to post comments)


Copyright © 2011, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds