kata-containers
Nomad
Our great sponsors
kata-containers | Nomad | |
---|---|---|
11 | 93 | |
4,842 | 14,398 | |
3.6% | 0.8% | |
10.0 | 9.9 | |
2 days ago | 1 day ago | |
Rust | Go | |
Apache License 2.0 | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
kata-containers
- Maestro: A Linux-compatible kernel in Rust
-
Fly Kubernetes
Seems like Fly.io Machines are trying reimplement Kata Containers with the Firecracker backend [0].
Kata has a guest image and guest agent to run multiple isolated containers [1].
[0] https://katacontainers.io/
[1] https://github.com/kata-containers/kata-containers/blob/main...
-
Kata Containers: Virtual Machines (VMs) that feel and perform like containers
> Last time I looked (a few months ago), the documentation was pretty sparse or outdated.
It still is, though it works somewhat seamlessly when installing with https://github.com/kata-containers/kata-containers/blob/main...
Though only one of the hypervisors works well.
-
Method to block possible internet traffic from LLaMA on MacOS
Better to use a secure VM, can even get container-like VMs with kata-containers
-
Kata Containers vs gVisor?
As I understand,Kata Containers
-
Firecracker MicroVMs
Kubernetes using Kata containers as a containerd backend
https://github.com/kata-containers/kata-containers/blob/main...
-
Container security best practices: Ultimate guide
My home k8s cluster is now "locked down" using micro-vms (kata-containers[0]), pod level firewalling (cilium[1]), permission-limited container users, and mostly immutable environments. Given how quickly I rolled this out; the tools to enhance cluster environment security seem more accessible now than my previous research a few years ago.
I know it's not exactly a production setup, but I really do feel that it's the most secure runtime environment I've ever had accessible at home. Probably more so than my desktops, which you could argue undermines most of my effort, but I like to think I'm pretty careful.
In the beginning I was very skeptical, but being able to just build a docker/OCI image and then manage its relationships with other services with "one pane of glass" that I can commit to git is so much simpler to me than my previous workflows. My previous setup involved messing with a bunch of tools like packer, cloud-init, terraform, ansible, libvirt, whatever firewall frontend was on the OS, and occasionally sshing in for anything not covered.
-
Docker Without Docker
I'm really impressed by fly.io, and the candidness with which they share some of their really awesome technology. Being container-first is the next step for PaaS IMO and they are ahead of the pack.
I aim to build a platform like theirs someday (probably not any time soon) but I don't think I'd do any of what they're doing -- it feels unnecessary. Bear with me as I recently learned that they use nomad[0] and some of these suggestions are kubernetes projects but I'd love to hear why the following technologies were decided against (if they were):
- kata-containers[1] (it does the whole container -> VM flow for you, automatically, nemu, firecracker) with multiple VMM options[2]
- linuxkit[3] (let's say you didn't go with kata-containers, this is another container->VM path)
- firecracker-containerd[4] (very minimal keep-your-container-but-run-it-as-a-VM)
- kubevirt[5] (if you just want to actually run VMs, regardless of how you built them)
- Ceph[6] for storage -- make LVM pools and just give them to Ceph, you'll get blocks, distributed filesystems (CephFS), and object gateways (S3/Swift) out of it (in the k8s space Rook manages this)
As an aside to all this, there's also LXD, which supports running "system" (user namespace isolated) containers, VMs (somewhat recent[7][8]), live migration via criu[9], management/migration of underlying filesystems, runs on LVM or zfs[10], it's basically all-in-one, but does fall behind in terms of ecosystem since everyone else is aboard the "cloud native"/"works-with-kubernetes" train.
I've basically how I plan to run a service like fly.io if I ever did -- so maybe my secret is out, but I sure would like to know just how much of this fly.io got built on (if any of it), and/or what was turned down.
[0]: https://news.ycombinator.com/item?id=26745514
[1]: https://github.com/kata-containers/kata-containers
[2]: https://github.com/kata-containers/kata-containers/blob/2fc7...
[3]: https://github.com/linuxkit/linuxkit
[4]: https://github.com/firecracker-microvm/firecracker-container...
[5]: https://github.com/kubevirt/kubevirt
[7]: https://discuss.linuxcontainers.org/t/running-virtual-machin...
[8]: https://github.com/lxc/lxd/issues/6205
-
Checking Your --privileged Container
Kata Containers https://github.com/kata-containers/kata-containers
Nomad
-
Running Docker based web applications in Hashicorp Nomad with Traefik Load balancing
In previous post, we discussed creating a basic Nomad cluster in the Vultr cloud. Here, we will use the cluster created to deploy a load-balanced sample web app using the service discovery capability of Nomad and its native integration with the Traefik load balancer. The source code is available here for the reference.
-
Building HashiCorp Nomad Cluster in Vultr Cloud using Terraform
Nomad is really awesome!
-
K0s: Kubernetes distro as a single binary with zero host OS dependencies
I only heard of this today, but it looks really interesting. It seems to finally get Kubernetes a bit closer to something like https://www.nomadproject.io/ in terms of complexity to install and operate.
-
Embracing Simplicity: The Advantages of Nomad over Kubernetes
In the rapidly evolving landscape of container orchestration and management, two prominent players have emerged: Kubernetes and HashiCorp's Nomad. While Kubernetes has gained widespread adoption and popularity, Nomad provides a compelling alternative that stands out for its simplicity and efficiency. In this blog post, we'll explore the advantages of using Nomad over Kubernetes and why it might be the right choice for certain use cases.
-
HashiCorp Vault Forked into OpenBao
I can't discern how many are just those "dependabot" bumps but the 1400 forks show some are active https://github.com/hashicorp/nomad/forks?include=active&page... including CircleCI who I would think have a stake in a libre Nomad https://github.com/circleci/nomad/tree/circleci/release-1.5....
Now maybe their goals don't align with the community, and/or they don't want to be in the maintainer business for such a project, but better than nothing
-
Remote execution of code
Could this be a solution? nomad
- Google Kubernetes Engine incident spanning 9 days
-
Homebrew deprecate and add caveat for HashiCorp
It worth noting that Nomad UI(a official web admin panel) has log tailing utility built-in so maybe partial work has already been done. The developers may have other concerns.
The related issue is https://github.com/hashicorp/nomad/issues/10220
-
HashiCorp Adopts Business Source License
While I do understand the reasoning in their FAQ on the subject (https://www.hashicorp.com/license-faq). I however failed to noticed those intentions in their license text (https://github.com/hashicorp/nomad/commit/b3e30b1dfa185d9437...).
Specifically the part in FAQ which says "internal production use is fine", but then license says that "non-production use only" and then "You may make production use of the Licensed Work, provided such use does not include offering the Licensed Work to third parties on a hosted or embedded basis which is competitive with HashiCorp's products.".
IANAL, but even to me this statement is full loopholes. WHO do we consider 3rd party? WHAT do we consider "hosted or embedded basis"? WHEN do we consider it "competitive with Hashicorps products"?
-
anyone using nomad, with a CSI plugin for AWS EBS? Is it working?
My repeated tests show that when an allocation that is using a volume is deallocated, nomad doesn't release the volume. So, it is inaccessable to the next allocation.
What are some alternatives?
firecracker-containerd - firecracker-containerd enables containerd to manage containers as Firecracker microVMs
k3s - Lightweight Kubernetes
kubevirt - Kubernetes Virtualization API and runtime in order to define and manage virtual machines.
Rundeck - Enable Self-Service Operations: Give specific users access to your existing tools, services, and scripts
lxd - Powerful system container and virtual machine manager [Moved to: https://github.com/canonical/lxd]
Dkron - Dkron - Distributed, fault tolerant job scheduling system https://dkron.io
sysbox - An open-source, next-generation "runc" that empowers rootless containers to run workloads such as Systemd, Docker, Kubernetes, just like VMs.
Docker Compose - Define and run multi-container applications with Docker
gvisor - Application Kernel for Containers
dapr - Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge.
ignite - Ignite a Firecracker microVM
podman - Podman: A tool for managing OCI containers and pods.