Hacker News Reader

Comment by csense | Hacker News Reader

Protip: You can compile the Linux kernel with User-mode Linux, ARCH=um to produce a kernel that runs as a regular binary on a host Linux OS.

User-mode Linux is super helpful for diagnosing any pure software kernel bug like this. You don't have to muck with emulators, startup is very fast, and if you need GDB you can use it on the guest kernel like any other C program.

User-mode Linux is a significant enough kernel feature to have its own Wikipedia page: https://en.wikipedia.org/wiki/User-mode_Linux

View on HN

Oh that's really interesting. Thanks for sharing! I might revisit this whole post & bug and try using User-mode, see if I can reproduce it that way.

If I remember correctly, Linode used to use UML for their VPS service. (And probably a lot of other hosts before OpenVZ and KVM became available/more popular.)

Why doesn't docker use it for linux guest on linux host instead of kvm?

You seem to be...confused. Docker guest processes run on the host kernel, Docker just uses cgroups to request the host kernel isolate or instance various components (filesystems, UID/GID spaces, networking...maybe other things).

These instancing / isolation capabilities and interfaces are very Linux-specific. So to run Docker on a non-Linux OS, you need to run Linux in a VM.

If you have a Linux host, I'm not sure why you'd run Docker inside KVM or a user-mode Linux kernel. Wouldn't you rather just run Docker directly inside the host kernel?

It's more interesting when you ask the question "why don't we use it to run docker containers on Darwin"... I dread to imagine what mapping cgroups back and forth between the two APIs might look like, but I also can't imagine I'm the first person to have wondered if it was, at least in principle, possible.

> I'm not sure why you'd run Docker inside KVM or a user-mode Linux kernel. Wouldn't you rather just run Docker directly inside the host kernel?

For better isolation. Privilege escalation would only affect the user mode kernel.

Reply on news.ycombinator.com