gvisor
podman
Our great sponsors
gvisor | podman | |
---|---|---|
64 | 358 | |
14,980 | 21,316 | |
2.7% | 3.3% | |
9.9 | 10.0 | |
6 days ago | 4 days ago | |
Go | Go | |
Apache License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
gvisor
-
Maestro: A Linux-compatible kernel in Rust
Isn't gVisor kind of this as well?
"gVisor is an application kernel for containers. It limits the host kernel surface accessible to the application while still giving the application access to all the features it expects. Unlike most kernels, gVisor does not assume or require a fixed set of physical resources; instead, it leverages existing host kernel functionality and runs as a normal process. In other words, gVisor implements Linux by way of Linux."
- Google/Gvisor: Application Kernel for Containers
- How to Escape a Container
-
OS in Go? Why Not
There's two major production-ready Go-based operating system(-ish) projects:
- Google's gVisor[1] (a re-implementation of a significant subset of the Linux syscall ABI for isolation, also mentioned in the article)
- USBArmory's Tamago[2] (a single-threaded bare-metal Go runtime for SOCs)
Both of these are security-focused with a clear trade off: sacrifice some performance for memory safe and excellent readability (and auditability). I feel like that's the sweet spot for low-level Go - projects that need memory safety but would rather trade some performance for simplicity.
-
Tunwg: Expose your Go HTTP servers online with end to end TLS
It uses gVisor to create a TCP/IP stack in userspace, and starts a wireguard interface on it, which the HTTP server from http.Serve listens on. The library will print a URL after startup, where you can access your server. You can create multiple listeners in one binary.
-
How does go playground work?
The playground compiles the program with GOOS=linux, GOARCH=amd64 and runs the program with gVisor. Detailed documentation is available at the gVisor site.
- Searchable Linux Syscall Table for x86 and x86_64
-
Multi-tenancy in Kubernetes
You could use a container sandbox like gVisor, light virtual machines as containers (Kata containers, firecracker + containerd) or full virtual machines (virtlet as a CRI).
-
Firecracker internals: deep dive inside the technology powering AWS Lambda(2021)
An analogous project from Google with similar use cases is gvisor, which IIRC underlies Cloud Run: https://gvisor.dev/
-
Why did the Krustlet project die?
Yeah, runtimeClass lets you specify which CRI plugin you want based on what you have available. Here's an example from the containerd documentation - you could have one node that can run containers under standard runc, gvisor, kata containers, or WASM. Without runtimeClass, you'd need either some form of custom solution or four differently configured nodes to run those different runtimes. That's how krustlet did it - you'd have kubelet/containerd nodes and krustlet/wasm nodes, and could only run the appropriate workload on each node type.
podman
-
Podman 5.0 has been released
Example of why: https://github.com/containers/podman/issues/5102#issuecommen...
-
Exploring 5 Docker Alternatives: Containerization Choices for 2024
Podman
-
A Gentle Introduction to Containerization and Docker
Even though we will focus on Docker for this article, I wanted to mention that there are more container creation and management tools such as Podman, Rkt, and so on.
-
A Journey to Find an Ultimate Development Environment
By using containerization, the application will always have the same configuration that is used in the development environment and production environment. There is no more "It works on my machine". Some examples of containerization technologies are Docker and Podman.
-
Exploring Podman: A More Secure Docker Alternative
AFAIK podman either already supports pods in quadlet container files, or will in the near future. https://github.com/containers/podman/pull/20762
-
Podman Desktop 1.6 released: Even more Kubernetes and Containers features
Podman as a devcontainers engine doesn't currently work if you use devcontainer features [1] or (and this sounds like you're issue) if you use WSL2.
I haven't submitted the WSL2 issue to the Podman team yet. If you get to it before I do, can you like it here?
https://github.com/containers/podman/issues/18691#issuecomme...
-
Oracle data base
You can also use their Oracle Linux Docker images with the database preinstalled using either Podman or Docker. Just make absolutely sure you are downloading something you are licensed to use, because it seems really easy to accidentally infringe copyright via this method.
-
A call for Podman comparison charts
It's an open source project. https://github.com/containers/podman and https://podman.io - go there, get engaged, see what's going on and most important become part of the community and contribute!
-
Jekyll Docker
If you are using a rootless container management system, you can set the JEKYLL_ROOTLESS environment variable to any non-zero value. For example, you can use the following to initialize a new jekyll project in the current directory using podman.
-
Ahoy! 🦭 Podman Desktop v1.5.2 is ship-shape and ready to board! 🛥️
Podman 4.7.2: Podman 4.7.2 is now included in Windows and Mac installers
What are some alternatives?
Portainer - Making Docker and Kubernetes management easy.
lima - Linux virtual machines, with a focus on running containers
kaniko - Build Container Images In Kubernetes
rancher - Complete container management platform
nerdctl - contaiNERD CTL - Docker-compatible CLI for containerd, with support for Compose, Rootless, eStargz, OCIcrypt, IPFS, ...
Moby - The Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
containerd - An open and reliable container runtime
colima - Container runtimes on macOS (and Linux) with minimal setup
singularity - Singularity has been renamed to Apptainer as part of us moving the project to the Linux Foundation. This repo has been persisted as a snapshot right before the changes.
toolbox - Tool for interactive command line environments on Linux
firecracker - Secure and fast microVMs for serverless computing.
DietPi - Lightweight justice for your single-board computer!