undefined | Better HN

0 pointstptacek4mo ago0 comments

"Containers" are that, and fast, in part because they share kernels, so there's no serious rebooting happening. But the consequence of that design is you share a kernel with untrusted cotenants.

And then there's just the idea of being able to pull these out of the sky literally whenever you want one. If you want to try something new out real quick, it makes no sense to figure out which of your existing Sprites to use. Just make a new one. If you're a little OCD, like I am, every once in awhile you can go prune, if you really care.

0 comments

rendaw4mo ago

The post says "hardware isolated" but below in the sandbox it says firecracker, which I thought were supposed to be a secure way to run containers from multiple tenants on a single host. Also I thought Fly machines were already using firecracker.

I'm having trouble understanding the difference to Fly machines. If you spin up a Debian container on a machine with a persistent volume, doesn't that have everything this does? Is this about providing a layer of useful configuration/management software on top?

tptacekOP4mo ago

Subtle to explain. I'll explain better later this week. For now though, just know: every Sprite is under the hood a KVM VM.

j / k navigate · click thread line to collapse

0 comments

rendaw4mo ago

tptacekOP4mo ago

Subtle to explain. I'll explain better later this week. For now though, just know: every Sprite is under the hood a KVM VM.

j / k navigate · click thread line to collapse