Comment by cyphar | Hacker News Reader

Comment by cyphar | Hacker News Reader

Parent Full thread

> what is the cause of insistence on Docker?

Because it targets developers and is based on technology usable on a very popular platform. SmartOS zones have neither of these properties.

> show me one problem which GNU/Linux has solved that SmartOS already hasn't

Packaging software and software updates. SmartOS uses NetBSD's pkgsrc, which is an interesting choice given the fact that BSDs have a very bad track record for packaging. FreeBSD still doesn't package their base system, and the recommended way of dealing with software on BSD systems is to compile it from source. GNU/Linux has solved this problem such a long time ago that I'm honestly surprised that SmartOS decided to use pkgsrc over something much more powerful like zypper+rpm, dnf+rpm or apt+dpkg.

So there's one problem that SmartOS didn't solve first, and I'd argue hasn't solved yet either. To be clear, I have no problem with SmartOS -- it has a lot of very deep technology. But claiming that it's magic pixie dust that has solved every problem that GNU/Linux has solved (and is working on solving) is being facetous and dishonest.

Also, as far as I'm aware there isn't nearly as much auditing of SmartOS going on as there is of GNU/Linux. Does SmartOS have support for all the features of grsecurity+PaX? What about support for UEFI? Or even support for many different architectures and hardware drivers? GNU/Linux may have many problems, but it beats every other free software operating system in quite a few areas (and beats a few proprietary operating systems in quite a few other areas too).

> SmartOS can do Docker, just so you know, although it doesn't need it to provide containerization, at all, but one does have that choice.

Yes, I know that. I currently am working as part of the OCI on container standardisation and am happy to see people working on that from the Solaris camp (we need to work together on standardising the workflows we want to use). But the one thing that people I work with don't do when working on container standards and canonical implementations of those standards is start screaming about how everyone should abandon a very popular platform because "I hate supporting GNU/Linux because it's not the operating system I like". Because that's just childish.

Packaging software and software updates. SmartOS uses NetBSD's pkgsrc, which is an interesting choice given the fact that BSDs have a very bad track record for packaging. FreeBSD still doesn't package their base system, and the recommended way of dealing with software on BSD systems is to compile it from source.

Compiling from source? pkgsrc, and by extension SmartOS, fully supports installing binary packages. The command to do this is called pkg_add. pkg_rm uninstalls a binary package. SmartOS even went a step further and uses pkgin, which works exactly the same way as apt-get. Please read pkg_add's and pkgin's manual pages before arguing further on this point.

Also here is a short document which clearly illustrates how a binary package is created and installed with pkgsrc:

http://www.perkin.org.uk/posts/creating-local-smartos-packag...

and here is another document pointing out how SmartOs has a nearly 14,000 package library of the latest version of software which normally runs on Linux; versions of which are usually newer than on Linux, and it is built fresh every day into binary packages, completely automatically:

https://www.perkin.org.uk/posts/building-packages-at-scale.h...

So there's one problem that SmartOS didn't solve first, and I'd argue hasn't solved yet either.

And based on your response, I'd argue that you haven't seen or used anything but Linux.

I'm far from being dishonest, and in fact I communicated exactly what my motivation is, and I'm sorry but it's really not my fault you haven't read SmartOS and Solaris documentation. That would be akin to me claiming that Linux is better than FreeBSD but without knowing enough about FreeBSD.

For example, your question about grsecurity+pax is nonsensical in the context of SmartOS: being Solaris based, it doesn't need Linux specific technology like grsecurity. That was precisely my point, if you use a well designed system, all of this Linux hacked-up nonsense goes away, because it was nonsense to begin with. SmartOS has a secure kernel by design, and further delineation can be achieved with role based access control.

It also doesn't need a lightweight virtual machine consisting of a single application because it has zones, and also because there would be nothing to reap your process at the end, and you'd end up with a zombie, an unreaped orphan process. I'm surprised that you don't know that Docker had to re-invent a kludgy copy of init precisely because of this problem, or else you would not have asked me that.

As for insisting on Docker because it's popular, it's flawed picking something based on popularity; if you pick a solution, it should be because it's technically sound and therefore robust, so that you can sleep through the nights when you're on-call without incidents, and read newspapers and drink your espresso during the day because the damn thing just runs and runs without needing any babysitting, like Linux does all the time.

To claim that SmartOS has no development tools, when it readily offers all the popular frameworks, languages, and has the most advanced linkers and compilers in existense us beyond obscene, I'm afraid. Please read the manual pages on the link editor, ld, and the Sun Studio compilers to get an inkling of what I'm writing about. It will tremendously help the quality of our discussion.

> your question about grsecurity+pax is nonsensical in the context of SmartOS

... no? Because many of the grsecurity+pax improvements apply to any kernel that runs on a CPU (it provides active protections against certain forms of kernel vulnerabilities caused by bugs). This includes illumos, thus the question is valid. Unless you're claiming the illumos cannot ever have a security bug.

> pkgsrc, and by extension SmartOS, fully supports installing binary packages.

Apologies, I was thinking of a different packaging system in FreeBSD. However, from my reading of the blog you linked pkgsrc only had support for signatures of packages in 2014. GNU/Linux has had this for a very long time.

My impression about package management being a shit-show on other operating systems is that every single podcast or blog post I read about those operating systems is celebrating that "package management is easy now with pkg" -- while it's actually not IMO as good as certain GNU/Linux package managers.

> and here is another document pointing out how SmartOs has a nearly 14,000 package library of the latest version of software which normally runs on Linux; versions of which are usually newer than on Linux,

Only 14000? Also, what distribution of GNU/Linux, what version of the distribution, how much automated QA happens before releases, etc?

> I'd argue that you haven't seen or used anything but Linux.

Untrue.

> but it's really not my fault you haven't read SmartOS and Solaris documentation.

It's not my fault that you haven't read the source code of runC without stating an ignorant opinon about how it works, based on a mix of outdated information and pure fabrication.

> That would be akin to me claiming that [...]

SmartOS is better than GNU/Linux without knowing about the Linux technology you're arguing about?

> I'm surprised that you don't know that Docker had to re-invent a kludgy copy of init precisely because of this problem, or else you would not have asked me that.

This is all not true, and you should know better. Docker/runC doesn't have an init process in containers. You _can_ run an init process, but it isn't necessary. In addition, the zombie problem doesn't exist because of sub-reapers which are a Linux kernel feature. You might not accept the existence of such features, but that's your perogative.

I asked you because I guessed that you didn't know about the GNU/Linux side of things. Thanks for not letting me down on that one.

> As for insisting on Docker because it's popular, it's flawed picking something based on popularity;

I answered your question of why Docker was popular, now you're complaining that I am talking about Docker because it's popular? What. In addition, I am a maintainer of runC and actually care much more about the OCI than Docker. There are some cool things coming from the Solaris and illumos folks, too bad that you're stuck in your ways and won't even consider the possibility that any GNU/Linux technology is good. That's just insane*.

> To claim that SmartOS has no development tools,

... when did I claim that? I claimed that it doesn't have anything like Linux when it comes to security frameworks like grsecurity+pax, UEFI support, hardware and driver support. You haven't addressed those arguments (claiming that grsecurity+pax isn't useful for SmartOS is showing that you don't know what it is or how it works).

.. no? Because many of the grsecurity+pax improvements apply to any kernel that runs on a CPU (it provides active protections against certain forms of kernel vulnerabilities caused by bugs). This includes illumos, thus the question is valid.

grsecurity is a set of patches for the GNU/Linux kernel. illumos is based on Solaris, so the entire argument about grsecurity is nonsense. illumos uses red zones to prevent buffer overflows, which grsecurity is attempting to address. grsecurity is a commercial product by the way. A single license costs $19,000 USD.

Enhanced auditing and process control which grsecurity provides have been part of Solaris, and therefore illumos, since Solaris 10, some even earlier. GNU/Linux is still playing catch-up, and as long as people like myself, Bryan Cantrill, Adam Leventhal and the rest of the former Sun kernel engineers live, it will be playing catch-up forever.

My impression about package management being a shit-show on other operating systems is that every single podcast or blog post I read about those operating systems is celebrating that "package management is easy now with pkg" -- while it's actually not IMO as good as certain GNU/Linux package managers.

In order for that opinion of yours to actually mean anything, the question is: how many packaging formats do you know to produce packages for? Only then will you be in a position where you would actually be competent to make such a statement, and where your opinion would actually make a difference. I myself have packaged for HP-UX, IRIX, Solaris, GNU/Linux (RPM), GNU/Linux (DPKG), and SmartOS (pkgsrc), so I'm in a position to make such statements, and yet I didn't. You, on the other hand, apparently have no such inhibitions.

Only 14000?

"Only". If you had packaged, you would have known that the same body of software could be delivered by an arbitrary number of packages, since that depends on the packager(s), respectively on the architecture.

Also, what distribution of GNU/Linux, what version of the distribution, how much automated QA happens before releases, etc?

The same thing which happens on GNU/Linux; if you think that packages on GNU/Linux get tested like a classic UNIX vendor would test it, you're naive.

This is all not true, and you should know better. Docker/runC doesn't have an init process in containers. You _can_ run an init process, but it isn't necessary.

Is that right? https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zomb...

In addition, the zombie problem doesn't exist because of sub-reapers which are a Linux kernel feature.

As it stands, I've worked with Linux extensively and I've never heard of such a thing. Please show me that code, for if you actually manage to show me that, I will have learned something new.

In addition, I am a maintainer of runC and actually care much more about the OCI than Docker.

Aaahhh, so that's why you keep on blindly lobbying for Docker. Now we finally get to the bottom of the thing. Couldn't you just be honest from the onset like I was on what your motivation is, so everybody knows where everybody stands?

So basically, you're trying to re-invent project Kevlar, Solaris zones, in a completely generic way so as to be everything and not be anything in particular to anyone. Did you not study UNIX, and the old Henry Spencer's saying

those who do not understand UNIX are condemned to re-invent it -- badly?

You could just bite the bullet and benefit from a complete, enterprise, battle tested solution with a decade of use behind it, and use Solaris zones by using vmadm(1M) in SmartOS, you know. No need to re-invent the wheel. Again.

How many more solutions does GNU/Linux need in order to be able to run lightweight virtual machines? Can't you people engineer one solution which actually works properly, like we have it in illumos? Apparently that's too much to ask. Or you could just use zones, which have been working for a decade, and actually let one run lightweight virtual servers running at the speed of bare metal in production, today:

https://smartos.org/man/1m/vmadm

https://smartos.org/man/1m/zoneadm

https://www.youtube.com/watch?v=hgN8pCMLI2U

As for "OCI", I have no idea what you're writing about. To me, an oldschool UNIX guy, "OCI" stands for "Oracle Call Interface":

http://www.oracle.com/technetwork/database/features/oci/inde...

Finally, a word on your question about setting up Manta. Apparently it's open source:

https://github.com/joyent/manta

...which means you can set it up seven ways 'till Sunday, and do with it whatever you please, however you please. I myself don't use it, because I design my availability into the application I write, and my interest is in the infrastructure layer anyway, where things like DNS are designed to be highly available from the onset (again availability in the application, and not the OS layer).

http://dtrace.org/blogs/dap/2013/07/03/fault-tolerance-in-ma...

Reply on news.ycombinator.com