init-snapshot
bocker
Our great sponsors
init-snapshot | bocker | |
---|---|---|
5 | 37 | |
247 | 11,092 | |
2.8% | - | |
0.0 | 0.0 | |
about 3 years ago | over 6 years ago | |
Rust | Shell | |
MIT License | GNU General Public License v3.0 only |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
init-snapshot
-
Firecracker internals: deep dive inside the technology powering AWS Lambda(2021)
At CodeSandbox we use Firecracker to run our VMs (more info here: https://codesandbox.io/blog/how-we-clone-a-running-vm-in-2-s...).
To answer the questions:
> what version of the kernel do you use (the github page says 5.10 but isn't that quite old?)
Right, they have tested with 5.10, but it also works with higher kernel versions. Our host currently runs 5.19 and we're planning to upgrade to 6.1 soon. The guest runs 5.15.63, we use a config very similar to the recommended config by FC team (it's in the FC repo). It's important to mention that we had to disable async pagefaulting (a KVM feature) with more modern kernel versions, as VMs could get stuck waiting for an PF resolve.
> What do you use to build the 'micro' images
We created a CLI that creates a rootfs from a Docker image. It pulls the image, creates a container and then extracts the fs from it to an ext4 disk. For the init, we forked the open sourced init from the Fly team (https://github.com/superfly/init-snapshot) and changed/added some functionality.
> How do you keep timesync of you're not using a timesync daemon?
IIRC we expose the time as a PTP device (handled by kvm) and run phc2sys to sync the time in an interval. Firecracker has some documentation on this, where it recommends chrony. It can also be done with vsock, but it would be more manual.
> Handle kernel and app logs without adding an log daemon, and same through vsocks, etc?
The init forwards stdout/stderr of the command it runs to its own stdout, which Firecracker then logs out by itself. A supervisor reads these and writes the logs to files.
-
Fly.io: The Reclaimer of Heroku's Magic
Unless they’ve changed things, there is no containerization within the VM a la kata. They run their own custom init inside the VM and use it to start the entry point. https://github.com/superfly/init-snapshot is the source.
-
Docker without Docker
Jerome wrote our init in Rust, and, after being cajoled by Josh Triplett, [we released the code (https://github.com/superfly/init-snapshot), which you can go read.
-
Fly’s Prometheus Metrics
> Fly.io transforms container images into fleets of micro-VMs running around the world on our hardware.
Oh boy!
> None of us have ever worked for Google, let alone as SREs. So we’re going out on a limb
Oh.... boy.
> We spent some time scaling it with Thanos, and Thanos was a lot, as far as ops hassle goes.
You know, they have these companies now, that will collect your metrics for you, so that you don't have to deal with ops hassle.
Holy shit. I see they even wrote their own init... in Rust. Yes, the thing that is normally a shell script, is now a compiled program in a new language, that mostly just runs mkdir(), mount() and ethtool(). (https://github.com/superfly/init-snapshot/blob/public/src/bi...)
- Fly.io Rust-based init for virtual machines
bocker
-
Show HN: Bocker-compose, the missing layer to Docker-compose
A (joke?) one-liner I came up with while thinking about solutions to centralized container management across multiple SSH hosts. Shame on me.
The name is inspired by bocker [0], albeit this doesn't re-implement docker-compose in bash, I found it to be fitting enough.
I'd love to see someone come up with a smarter and/or shorter way to do this.
[0] https://github.com/p8952/bocker
-
Barco: Linux Containers from Scratch in C
When I did a talk about docker I also wanted to show a bit of what it does under the hood without going through all the layers and without too much details. This ~120 lines of shell script is really good in providing just an intro into what's needed for containers: https://github.com/p8952/bocker/blob/master/bocker
- Build Your Own Docker with Linux Namespaces, Cgroups, and Chroot
-
Latest Zen Kernel......
i tried it and like the concnpt, but until it can be launched via a systemd userspace service (without previously manually booting it) among other problems i will keep using docker (or bocker)
-
The Staff Engineer's Path – Book Review
> But you couldn't reimplement podman in a few hundred lines of code.
You don't even need a few hundred: https://github.com/p8952/bocker
And then there's 'dokku' which IIRC, started as a bash version of Heroku.
> Not all ideas have the same quality.
They really do. I've heard all kinds of things in my career, but almost none I would want to dedicate a portion of my life building. Not because they are bad ideas or won't work, but because of the person with the idea or it just didn't interest me. Those people went on to be moderately successful (like hundreds of millions worth) but I'm glad I wasn't on that ride.
-
“Implement DNS in a Weekend”
Bocker is in this same category...docker clone in bash that's helpful in seeing what's really happening underneath with nsenter, namespaces, network bridging, cgroups, etc.
https://github.com/p8952/bocker
-
Ask HN: What is the best source to learn Docker in 2023?
Docker implemented in around 100 lines of bash: https://github.com/p8952/bocker
This is the most mindblowing example for enterprise security teams that think Docker is a new threat on a single tenant Linux host.
No, buddies, all this stuff is already there. If you were fine with your visibility before*, you're still fine. Go find a real problem while we play with our developer dopamine.
* NARRATOR: They shouldn't have been.
-
Containers are chroot with a Marketing Budget
Bocker[1] does a reasonably good job of showing the value of Docker was mostly in Docker hub.
[1] https://github.com/p8952/bocker
There is a cool project I've seen called "bocker" (https://github.com/p8952/bocker) which is something of a proof of concept of implementing Docker with bash, which speaks a bit to how Docker is indeed in many ways an amalgam of lower level primitives (such as chroot as you mentioned). Pretty neat!
- bocker: Docker implemented in around 100 lines of bash
What are some alternatives?
nixpacks - App source + Nix packages + Docker = Image
whalebrew - Homebrew, but with Docker images
image-spec - OCI Image Format
s6-overlay - s6 overlay for containers (includes execline, s6-linux-utils & a custom init)
containerd - An open and reliable container runtime
garden - Automation for Kubernetes development and testing. Spin up production-like environments for development, testing, and CI on demand. Use the same configuration and workflows at every step of the process. Speed up your builds and test runs via shared result caching
cloud-hypervisor - A Virtual Machine Monitor for modern Cloud workloads. Features include CPU, memory and device hotplug, support for running Windows and Linux guests, device offload with vhost-user and a minimal compact footprint. Written in Rust with a strong focus on security.
distroless - 🥑 Language focused docker images, minus the operating system.
flintlock - Lock, Stock, and Two Smoking MicroVMs. Create and manage the lifecycle of MicroVMs backed by containerd.
dockerfiles - Various Dockerfiles I use on the desktop and on servers.
decap-cms - A Git-based CMS for Static Site Generators
cloc - cloc counts blank lines, comment lines, and physical lines of source code in many programming languages.