think of it as using a "shared kernel" for multiple separate operating system contexts, with a completely separate userspace for each container

SmartOS has the best isolation for containers, IMO... I don't think even the Windows Server containers are properly isolated for security, but SmartOS claims theirs are, for filesystem, networking, memory, kernel access, etc.

except for Meltdown/Spectre, which still hasn't been patched for SmartOS :P

also, as long as the OS can run on that kernel, you can run different operating systems on the same kernel in different containers

@Bob can you explain in lay-man's terms how that works then?

like you can run similar-aged Fedora or Red Hat on the same system that might be running, say, an Ubuntu host

I thought containers were for applications, specifically, running on any OS?

So what is a practical application for containers?

i am never playing this lifeless planet again, it is just boring

@CanadianLuke there's two sorts of containers: OS containers (usually, isolated with explicit security boundaries like VMs), and application containers (usually, no isolation, no explicit security controls to stop them from breaking out of their container)

Docker is an example of an application container where there's no explicit security boundary; they don't promise that if your tomcat process in a Docker container gets hacked, that the hacker can't just escalate out of the container and get root on the physical box

its not bad on a technical front (although there are gameplay elements that could be improved), it is just dull

SmartOS and (putatively) "LXD on Ubuntu with unprivileged containers" are examples of OS container platforms

maybe that is the point and i'm missing some sort of meta statement it is making about love, life and beer but i doubt it

the security boundary distinction matters because of multi-tenant environments, like public clouds.... you have to ask yourself the question, "If I give a user the ability to execute arbitrary machine code in this (VM / container), can they observe or interfere with other users' activity on the box?"

the claimed answer for all virtual machine hypervisors to that question is an unqualified "NO" (Meltdown/Spectre and other vulns notwithstanding)

the claimed answer for SmartOS containers is also "NO", and for LXD, "We don't think so / we intend to at least make it so they can't eventually"

for Docker the answer is "Yes, sorry"

OK, so if I'm building a web app that depends on technologies A, B and C, would each of those run in a separate container or something?

I'm just not understanding

@CanadianLuke application container or OS container?

for Docker (app containers) you'd put your web server, database, and any web services, etc. in separate app containers each

@Burgi lives upto the images the name counjours?

for SmartOS or LXD, you just create as many containers as you need to separate out workloads that are mutually untrusting of one another, or if you're super paranoid, you can containerize every process you're hosting, but it's wasted effort if access to one process causes application-level compromise anyway

so if you're using OS containers, you would only create an OS container when you'd ordinarily think to create a hypervised VM

@djsmiley2k yeah but the synopsis was really interesting

:/

So Apache in container A, PHP in container B, then MariaDB in container C... How do they communicate with each other then?

@CanadianLuke over IP, of course

Do they get their own port, or their own IP address per container?

> While seeking life on a distant planet, an astronaut discovers an abandoned Russian town. He suspects his mission is a hoax until a mysterious young woman saves him from a strange and deadly phenomenon... Lifeless Planet is a third-person action-adventure that features an old-school sci-fi story and spectacular environments in the spirit of classic action-adventures.

@CanadianLuke they often get their own local IP, but not their own public IP (that's the recommended Docker-style design)

they seem to have forgotten the story

i don't see a story there....

So a new IP range, private to the containers?

astronaut, ok, fine

and each app container would have a copy of the entire userspace separately from the other, so you could run, say, Red Hat 6 for MariaDB, but Red Hat 7 for Apache

and then........

store.steampowered.com/app/261530/…

@CanadianLuke yeah, like something in the 192.168.0.0/16 space, which is by definition private LAN space

So then I would have to use some sort of automation system (i.e. ansible or puppet) to manage new instances, correct?

he finds a soviet town on a supposedly virgin world and nobody left alive

to cut down on the disk space usage of containers having many different userspaces, they often do a copy on write strategy where they de-duplicate unmodified OS files on each container, keeping only one copy on disk

> Lifeless Planet was inspired by Cold War era science fiction stories, posing questions about humankind's desire for space travel. What if you journeyed across the galaxy to another planet, only to find humans had already been there? What kind of person would sign up for a one-way mission, leaving behind planet Earth and everyone they've ever known and love... to go in search of an Earth-like planet?

@CanadianLuke yes, or Google Kubernetes, or Red Hat OpenShift, or whatever Amazon's doing, or Microsoft Windows Server Containers

@djsmiley2k yeah but it has no personality

yeah :/

So if I develop a killer web app, am I creating custom containers for each component? Or just scripting it to grab from a master, then turn itself on?

it feels like a game written in someone's bedroom or as a school project

@CanadianLuke to me, containers seem to be a way of saying 'i'm a terrible sysadmin who can't keep things undercontrol'

@CanadianLuke usually with app containers you would put each component with an IP interface in its own container, so each container basically claims one private IP and one or a small number of ports on that IP

I'm sure therelys likely a better reason than that, but I've never found it xD

then whatever service is your "front-end" that faces the public would have a public IP, or you'd have a non-containerized reverse proxy server as your front-end, maybe

So that allows for larger scaling behind the scenes... As opposed to just having lots of VMs that already know about each other?

It feels like it would make more sense if I was doing more development, but I've been limited lately to shell and batch scripting

@CanadianLuke the overhead is extremely low, and it's designed to promote scalability and reduce "accidental" unintended interactions of components, and to put up natural barriers against layering violations, like if your web app tries to dick with your PostgreSQL configuration, which it absolutely should not rely on

it's there to help developers, not to keep hackers out

Still seems complicated to me. I'm slowly expanding my test bed at home to have two MySQL servers, and two Apache servers

for OS containers, it's just there to replace virtual machines with a higher-efficiency alternative that offers the same advantages as virtual machines

Got a good readme for this stuff?

well, with the notable caveat that OS containers can't run other operating systems entirely in a container... you can't run Windows in an OS container on Linux

but you can run containers and VMs on the same host system

well, I'm biased in favor of OS containers and I don't really like app containers, so let me link you fantastic talks by a very engaging presenter, the current CTO of Joyent, the makers of SmartOS (Keep that context in mind when considering his biases, but he is still pretty correct in almost all his assertions)

I might play around with Docker a bit... linode.com/docs/applications/containers/introduction-to-docker

Possibly use it to run one less server by merging the SmokeDetector instance into the main server.

docs.docker.com/get-started

reddit.com/r/Cynicalbrit/comments/7ogzqu/…

:((

root@li650-40:~ # zypper in docker docker-zsh-completion docker-compose
Loading repository data...
Reading installed packages...
Resolving package dependencies...

The following 24 NEW packages are going to be installed:
  apparmor-parser containerd criu docker docker-bash-completion docker-compose docker-libnetwork
  docker-zsh-completion libprotobuf-c1 python-PyYAML python-backports
  python-backports.ssl_match_hostname python-cached-property python-docker-py python-docker-pycreds
  python-dockerpty python-docopt python-functools32 python-ipaddr python-jsonschema python-protobuf

update to this: it's happening jdfgkdjfg

(well it had to go from a full ssh privkey to a 50 char password but still)

erm, wut?

idk even

I asked a friend (who does that sort of stuff) and he'll try or smth

to what, tattoo you?

no

@allquixotic: I'm wondering if you've read about AMD partnering with enterprise storage tiering software developer Enmotus on bringing their technology to enthusiasts with Ryzen systems

tomshardware.com/news/…

It's way cheaper than a RAID card and it just be a reason for you to switch to Ryzen.

$20 basic version allows up to 128 GB of SSD storage and 2 GB of DRAM in the fastest storage tiers, while $60 Plus version allows up to 1 TB SSD and 4 GB of DRAM. Requires an AMD X399, X370, or B350 system running Windows 10.

OnePlus credit card security update: forums.oneplus.net/threads/…

Affected up to 40k users, between mid-November 2017 and January 11, 2018.

So it's LVM with performance-aware block reallocation? That's kind of neat.

@ToxicFrog Enmotus originally developed this software for server use. AMD partnered with them to create a solution similar to Intel's Smart Response Technology for AMD desktops.

bwDraco: right, but I'm not interested in the history, I'm interested in what it does -- it looks like it has one mode that operates similarly to ZFS's L2ARC, and another mode that's basically LVM except it proactively moves blocks between PVs based on PV access speed and how often that block is needed.

It basically merges SSD and electromechanical storage into one volume, with the software taking care of the tiering and caching. The software is designed to be simple, not requiring a reinstall of the OS or complicated configuration.

Which is neat and not something I've seen before.

My setup here is all-flash (2 TB in two SSDs) so it won't benefit from this, and I kinda think this is a niche solution, but I'm sure @allq is one of those folks who can actually use it.

Right now, he's using a very expensive enterprise RAID card (Microsemi Adaptec 81605ZQ with maxCache) for this purpose.

This is something that I could benefit from, but I'm already using ZFS, so it would be easier to just install an SSD and then enable L2ARC on it.

(you will never convince me to use hardware RAID)

Be careful when selecting an SSD for SLOG – all writes will go through that drive so you need high endurance. If possible, get something like Optane or an enterprise SSD.

SLOG and L2ARC are different things -- L2ARC is for reads, SLOG is offpool storage for the ZIL.

Oh, okay.

I mostly care about read performance, so I'd probably devote the entire disk to L2ARC and leave the ZIL on-pool.

github.com/lanoxx/libwnck/blob/master/libwnck/window.h#L31

Anybody here with experience with Docker?

Wow, that's kinda bullshit IMO. libwnck has been part of the GNOME platform for a very long time. It's really rude to #error users unless you make them specify a ridiculous preprocessor definition l ike that.

(and it's been stable for years)

they've even versioned the library when they had to break the API ffs

I'm migrating my SmokeDetector instance to Docker on my primary server (which still has plenty of capacity available) to obviate the need to run a separate server.

@bwDraco that's really nice... if my RAID card ever dies, or stops getting firmware updates and one's sorely needed, I'll probably just upgrade to Ryzen

but I'll be honest; tiered storage has belonged in the platform for everyone for a long time

(available capacity might be lower with the Meltdown mitigation in place, but I don't expect near-100% CPU usage)

nobody can afford 8 TB of SSD space, so most people end up buying 2 or 3 ~2TB HDDs, a 128 or 256 GB SSD boot drive, and chucking most of their data on the HDDs.... meaning their OS boot is fast, but apps perform at the speed of HDDs

Here's an idea: Have motherboard vendors ship FuzeDrive as a value-add for premium boards.

tiered storage really is a miracle (and in my case, that miracle's performance cost is offloaded to a dual core RAID-on-Chip (RoC) processor on an x8 PCIe add-on board :P

bonus points for mobos that are able to fit an Adaptec, LSI, or home-grown RoC soldered onto the mobo so the CPU doesn't take the hit

on-board hardware RAID in Micro-ATX and bigger form factors... yes please

@allquixotic ASRock has done this before (albeit on an EATX board).

few years later we might get lucky, Intel will catch on, and we'll get it in the PCH on all Z-series boards :D

> 18 x SATA3 (8 x SAS3 12.0 Gb/s + 10 x SATA3 6.0 Gb/s) from LSI SAS 3008 Controller

that's a pioneering idea... bonus points if that LSI 3008 can do tiered storage

...well, this is an HBA, not a RAID controller per se, but it does support RAID 0 and 1.

@Burgi

erh

github.com/allquixotic/tribblify/commit/… (cc @Bob)

Gah - pulsesrc was giving me mono audio by default (viewed codec info in VLC after noticing it sounded like crap!)... github.com/allquixotic/tribblify/commit/…

child's play :)

@allquixotic ooh neat

I see that you started off with mpd

I'm working with mpd too lately

Would this make sense on SuperUser?