Slashdot Mirror
Docker Moves Beyond Containers With Unikernel Systems Purchase (thenewstack.io)
joabj writes: Earlier today, Docker announced that it had purchased the Cambridge, U.K.-based Unikernel Systems, makers of the OCaml-based MirageOS, a unikernel or "virtual library-based operating system." Unikernels go beyond containers in stripping virtualization down to the bare essentials in that they only include the specific OS functionality that the application actually needs. Their design builds on decades of research into modular OS design. Although unikernels can be complex to deploy for developers, Docker aims to make the process as standardized as possible, for easier deployment.
Buzzword company buys other buzzword company! Woohoo!!
Could we make things a bit more complicated? Virtualization I understand. I don't understand the need for Docker. It is just another layer that will break. Maybe I am just getting old, but this seems very complicated and prone to breakage with all the layers.
It might be unikernel
It might be OCaml based
It might have to do with container
It might even be linked to virtualization and the ability to strip out to the bare essential
But the point is, what is the market size?
I might be wrong, but I am looking at a niche market, a very narrowly defined niche market
If I am wrong, please correct me, and thanks !
No more DLL hell then, just compile the entire OS into the application :)
Works, indeed :)
You skipped over paravirtualization, which can be damned fast (though not quite as snappy as LXC-based) and is theoretically in a much more secure container since the kernel is not being shared. QubesOS provides a good demonstration of how responsive a properly configured PVM can be. A "cold" boot can render a Firefox window in perhaps three seconds.
The latest version of VirtualBox supports some level of paravirtualization as well, though I haven't had time to tinker with it yet.
Not only will it solve your deployment problems, provide scalability for free, and eliminate all system security issues, it will do your shopping, wash your car, clothes and dishes, pay your bills and taxes, balance your checkbook, and walk the dog, even if you don'thave a dog!
Overhype much?
Why is Snark Required?
All of our commonly used, general purpose, end user operating systems suck. Separation, compartmentalization simply isn't there. Everyone knows the advantages of proper compartmentalization: easy portability, unparalleled security, a mighty robustness against system-crashing errors and reboots, configuration flexibility and avoidance of dependency conflicts, the ability to easily prioritize system resource usage, the ability to roll back snapshots without rebooting the entire system, sharing or cloning base images, etc. But our OSes can't do any of this out of the box.
So people slowly added it back in, first with file permissions and then mandatory access control (Apparmor, SELinux), chroots, FreeBSD chroots, traditional virtualization (at first entirely software-based, then hardware-assisted), PVMs, LXC, Unikernel, and probably a dozen more approaches I'm unaware of. All of these things have advantages and disadvantages, but the important thing to keep in mind is this: they're all trying to fix something that is fundamentally broken. And ultimately all of the best solutions involve figuring out different ways of emulating multiple OSes because the applications we want to run only run on "modern" OSes... none of which are built around a concept of strict compartmentalization.
Enter the Genode aficionados and the hordes of older microkernel partisans who've been screaming about this stuff for decades. They will scoff and say a bunch of undeniably true things... but of course, last time I checked everyone who actually used Genode for everyday tasks was using it to boot VirtualBox or something similar. It's inescapable: we have a bunch existing applications we want to run and we simply can't run it without (in some fashion) running the crappy OS it was designed to run on.
And so we have a dozen different varieties of duct tape to choose from, each with their own advantages and disadvantages. It's interesting. It's fascinating. Currently, I'm leaning towards paravirtalization as the sweet spot of performance and flexibility and security (Qubes OS was the decisive influence on me here), but LXC is faster and simpler and Unikernel, while not simple, sounds like it could be very fast indeed. And I'm sure the dirt-simple appeal of vanilla HVMs will endure regardless of the advances Docker makes.
It's an interesting debate with no single right answer because of the long list of different pros and cons. But it's also interesting to consider how and when all of this is likely to be rendered moot. At some point, a new OS (probably microkernel based) will finally gain enough traction and get enough native end user applications to make it usable without in any fashion having to emulate another OS on top of it. People will start porting other applications to run on it, and eventually the Windows and Debian and Red Hat and OS X and Android and iOS of today will finally be abandoned as the insecure, unstable, kludge-ridden clusterf___s they are.
The question is... will this revolution be driven by an OSS project? Will the microkernel world finally get their Linus? Or will this be the ultimate proprietary walled garden, a massive investment by Apple or Microsoft or Google, some heart-stoppingly expensive super secret project to finally offer their customers a UI that never gets laggy or unresponsive, a core system that is virtually immune to malware, app developer APIs that rarely need changing, real time performance when necessary, and fine-grained app permissions that actually work properly?
Unfortunately, I think my money has to be on the walled garden, and even more unfortunately I'd have to say that Apple stands the best chance of pulling it off given their strict control over hardware and their titanic cashflows. Maybe Google will get there first and maybe, just maybe someone will be able to convince them to open source it.
It's fascinating to watch all of these brilliant people come up with these interesting and inventive kludges. And useful, undeniably useful in the here and now. But at the end of the day, I can't help but think... dust in the wind.
If these are unikernels, GNU Hurd is a mythicaal unicorn.
Wtf is docker?
Docker aims to make the process as standardized as possible, for easier deployment.
You know what we actually need? Tools to make using selinux easier, "for easier deployment". I'm given to understand that there are tools that are supposed to watch activity and build you a profile, but I couldn't even get the tools to work.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
More like DOS in a can.
Ok, so it is somewhat an improvement on that as it has memory protection and can properly multitask if need be.
But these unikernels are beyond that single user, and you need extra libs for anything beyond barebones bootstrap.
The dusty file-cabinet creaks open revealing the secret plan.
Shadowy figure one: "It's taken a few more years than we originally expected, but the day is drawing near. All this virtualization, exo-kernel, uni-kernel crap is just garbage compared to this baby!"
Shadowy figure two: "But we will need to make it 64 bits..."
Shadowy figure one: "No problem, that'll take a few weeks, plus we can fit ALL of it on one die with plenty of cache. GDP, IP, plus we always planned the IO Processor to be x86 compatible, so we have x86 - no problem! It'll be fault-tolerant and run circles around the competition plus we can bolt on that fast vector unit"
Shadowy figure two: "But what about marketing?"
Shadowy figure one: "Are you kidding me,they'll love it, they can re-use some of the the original stuff too."
iAPX 864 - MICRO SUPER COMPUTER.
In a stunning development Intel has released a new 64 bit microprocessor architecture designed to radically address the serious issues with virtualization, containers and other security mechanisms.