Hacker News Reader

Comment by atmosx | Hacker News Reader

I never really understood why Jails never really took off, but everyone now is going crazy about virtualization.

This could be a much longer answer, but jails have nowhere near the level of control and isolation a "real" VM does even with the relatively recent additions of things like vimage and HRL's. Jails are awesome and I have used them for many years, but they are not a replacement for a hypervisor for many(most) use cases.

That said, when a young upstart was trying to sell me on Linux superiority and described Docker to me, all I could do was snicker.

Explain yourself. A hypervisor is not a security layer, so what is your reasoning?

> A hypervisor is not a security layer

Of course it is.

It is an expensive container, that is all. Attackers can escape or even steal data from another running VM.

> Attackers can escape or even steal data from another running VM.

Then there is a bug and you fix it just like any other security layer.

Docker is not the same thing as FreeBSD jails. Docker is available on FreeBSD (as of June this year) and uses jails.

> Docker is not the same thing as FreeBSD jails.

No it is not. Like Norton Anti-Virus, it has a much bigger user base. Other than that...

> Docker is available on FreeBSD (as of June this year) and uses jails.

Huh? I wonder why?

^sarcasm.

Other than that, they're different things. It's like the difference between lxc and lxd.

See https://www.youtube.com/watch?v=LrHW7Vvbie4 for a demo of what lxd can do. Maybe that will clear it up for you.

If the point you're trying to make is linux users love reinventing the wheel and making it more complicated and prone to failure, there really is no need. I believe you.

lxd has absolutely no relevance to this discussion. They are not jails, they are not like jails. As noted in my OP in this thread, jails are not a replacement for hypervisors.

lxd has relevance because it's the same kind of thing as Docker.

> They are not jails, they are not like jails.

That's what I've been saying.

You need to do your research again on docker and lxd. They aren't the same thing at all.

> That's what I've been saying.

No, you've been saying Docker is so much better than jails. Either you don't know jails or docker or both, I can't tell. Just you really want Docker to be awesome.

For my uses at Y!, jails were great: I was using them to setup test environments that were closer to production: each jail had software to match one of the machine types in production, but I didn't need to get a whole bunch of machines that would mostly be idle.

As I was my own jailer, lack of resource limits wasn't a real problem. I greatly benefited from the lack of performance penalties; everything ran at the same speed in or out of the jail. I had one or two systems running in VMs and they were terrible: a) things were clearly slower, b) virtual disk provisioning is terrible, c) timekeeping (hopefully things have gotten better since 2011)

Marketing makes up for having a technically inferior product.