unikraft
Moby
unikraft | Moby | |
---|---|---|
26 | 212 | |
2,303 | 67,768 | |
17.2% | 0.3% | |
9.8 | 10.0 | |
3 days ago | 2 days ago | |
C | Go | |
GNU General Public License v3.0 or later | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
unikraft
- KraftCloud
- Mirage – A programming framework for building type-safe, modular systems
-
Building a unikernel that runs WebAssembly – part 1
You should also probably check out Unikraft (https://unikraft.org) , supports many languages/apps, x86/ARM64 and QEMU/Firecracker. Is also able to run an ELF built under Linux as a unikernel (see https://unikraft.org/guides/bincompat). Discord is at https://unikraft.org/discord .
- Unikraft is a fast, secure and open-source Unikernel Development Kit
-
What Is a Unikernel?
>"For performance-oriented UDP-based apps, much of the OS networking stack is useless:
the app could simply use the driver API, much like DPDK-style applications already do.
There is currently no way to easily remove just the network stack but not the entire network sub-system from standard OSes."
This page is a great read for any current or future OS developer...
Related:
"Unikraft is a fast, secure and open-source Unikernel Development Kit":
https://unikraft.org/
"Unikraft is an automated system for building specialized OSes known as unikernels."
https://github.com/unikraft/unikraft
-
Build Your Own Docker with Linux Namespaces, Cgroups, and Chroot
unikernel is not the same microkernel.
I've found these after some quick googling:
https://unikraft.org/
-
I don't believe in the success of wasm
Check out https://github.com/unikraft/unikraft
-
A future without containers? ( thoughts )
Wow, just now seeing this topic. I work for a cloud company hosted in AWS. We started out, Netflix/Spotify style microservices. We were all on ec2 images generate by packer (and later with AWS Image Factory). When Docker hit, we kicked the tires but never did anything with it beyond using it for running unit tests, and later, infrastructure tests. 5 years ago, during a hackathon, our little group began experimenting with Unikernels, or library operating systems. Interestingly enough, these Unikernels were all stripped down BSD kernels. OSv is FreeBSD based, and Rumprun is NetBSD based. Services running in EC2 on Unikernels would spin up and start sending and receiving traffic before the AWS EC2 healthchecks completed. They are blazing fast! Only problem in 2017, was the tooling. It would have taken too much effort to use Unikernals with our infrastructure. As soon as they start making Unikernels that can run Java bytecode like native code, the fate of containerization will be sealed, IMO. We could get basic JVM webservers running on OSv, but not Cassandra, not Kafka, not yet. OSv now runs on Firecracker, but I have not tried it out, yet. Some links if you are interested: OSv: https://osv.io Rumprun: https://github.com/rumpkernel/rumprun We used this tooling during the Hackathon, but doesn't look like it has been touched in 3 years: https://github.com/solo-io/unik Unikraft Unikernel Dev kit: https://unikraft.org/ And don't forget Firecracker running in Kubernetes https://www.weave.works/oss/firekube/ And of course, being a FreeBSD subreddit, let's not forget FreeBSD on Firecracker https://www.daemonology.net/blog/2022-10-18-FreeBSD-Firecracker.html
-
Linux as single app ?
and Unikraft
Moby
-
Release Radar • March 2024 Edition
Having been featured in our February 2023, and January 2024 Release Radars, Moby is the original Linux Container runtime. This new version adds a bunch of changes to the Docker CLI and Moby itself with additional features. There's bug fixes and enhancements, with the main thing for users to be on the look out for containers that were created using Docker Engine 25.0.0. These containers might have duplicate MAC addresses, and thus must be recreated. The same goes for those containers created with Moby 25.0+ and with user defined MAC addresses. Read up on all these changes in the release notes.
-
Choosing a Name for Your Computer
Formlabs does this as well for their 3d printers, my earliest encounter of this was when Docker started getting popular: https://github.com/moby/moby/blob/master/pkg/namesgenerator/...
- Docker Inc. refuses to patch HIGH vulnerabilities in Docker
-
Do not install Docker Desktop on GNU/Linux systems
Try to use moby instead since that is the engine in Docker.
https://github.com/moby/moby
-
Exploring Podman: A More Secure Docker Alternative
> Podman is designed to help with this by providing stronger default security settings compared to Docker. Features like rootless containers, user namespaces, and seccomp profiles, while available in Docker, aren't enabled by default and often require extra setup.
Seccomp has been enabled by default since 2015: https://github.com/moby/moby/pull/18780
It is true that Rootless isn't enabled by default but its "extra setup" can be done with a single command (`dockerd-rootless-setuptool.sh install`)
- Moby: Block io_uring_* syscalls in default profile
- Io_uring will be blocked by default on Docker
-
OpenZFS 2.2: Block Cloning, Linux Containers, BLAKE3
Perhaps.
Thing is, https://github.com/moby/moby/blob/670bc0a46c4ca03b75f1e72f73... is using https://github.com/mistifyio/go-zfs which features code like `out, err := zfsOutput("get", "-H", key, d.Name)` (Source: https://github.com/mistifyio/go-zfs/blob/master/zfs.go#L315) to get a single zfs property.
Somebody chose to use a library as abstraction that looks good but is implemented as a MVP (nothing wrong with that). "In the future, we hope to work directly with libzfs" should have raised an alarm somewhere, though.
-
The Twelve-Factor App
AppArmor can restrict /proc and this is even used by docker: https://github.com/moby/moby/blob/master/contrib/apparmor/te...
What are some alternatives?
nanos - A kernel designed to run one and only one application in a virtualized environment
podman - Podman: A tool for managing OCI containers and pods.
mirage - MirageOS is a library operating system that constructs unikernels
containerd - An open and reliable container runtime
unik - The Unikernel & MicroVM Compilation and Deployment Platform
nerdctl - contaiNERD CTL - Docker-compatible CLI for containerd, with support for Compose, Rootless, eStargz, OCIcrypt, IPFS, ...
linuxkit - A toolkit for building secure, portable and lean operating systems for containers
docker-openwrt - OpenWrt running in Docker
distroless - 🥑 Language focused docker images, minus the operating system.
ofelia - A docker job scheduler (aka. crontab for docker)
riscv-rust - RISC-V processor emulator written in Rust+WASM
k3d - Little helper to run CNCF's k3s in Docker