firecracker-containerd

include ways to run containers at different levels of isolation (VMs and as micro kernels), so a move to containers can absolutely help security posture, because now you don't have to pull out packer/ansible/etc to build your VM, you can just take the same container you were running and change the runtime. Time to ship/launch improved security features is important, and containers can reduce that burden for teams. Containers are a process isolation and resource control tool -- they can absolutely aid in security posture. Would you say the same about BSD Jails? Just so there's some more value here, here are some projects that are somewhat close to cutting edge (though it's been a while) in this space that I like: - nabla-containers.github.io/ - https://github.com/firecracker-microvm/firecracker-container... - https://github.com/kata-containers/runtime (see https://github.com/kata-containers/documentation/blob/master...) - https://rootlesscontaine.rs/ - https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2... - https://starkandwayne.com/blog/the-capable-kernel-an-introdu... The container ecosystem surfaces a lot of really cool resource limiting and isolation techniques and puts them in very close reach.

ultiple VMM options[2] - linuxkit[3] (let's say you didn't go with kata-containers, this is another container->VM path) - firecracker-containerd[4] (very minimal keep-your-container-but-run-it-as-a-VM) - kubevirt[5] (if you just want to actually run VMs, regardless of how you built them) - Ceph[6] for storage -- make LVM pools and just give them to Ceph, you'll get blocks, distributed filesystems (CephFS), and object gateways (S3/Swift) out of it (in the k8s space Rook manages this) As an aside to all this, there's also LXD, which supports running "system" (user namespace isolated) containers, VMs (somewhat recent[7][8]), live migration via criu[9], management/migration of underlying filesystems, runs on LVM or zfs[10], it's basically all-in-one, but does fall behind in terms of ecosystem since everyone else is aboard the "cloud native"/"works-with-kubernetes" train. I've basically how I plan to run a service like fly.io if I ever did -- so maybe my secret is out, but I sure would like to know just how much of this fly.io got built on (if any of it), and/or what was turned down. [0]: https://news.ycombinator.com/item?id=26745514 [1]: https://github.com/kata-containers/kata-containers [2]: https://github.com/kata-containers/kata-containers/blob/2fc7... [3]: https://github.com/linuxkit/linuxkit [4]: https://github.com/firecracker-microvm/firecracker-container... [5]: https://github.com/kubevirt/kubevirt [6]: https://docs.ceph.com/ [7]: https://discuss.linuxcontainers.org/t/running-virtual-machin... [8]: https://github.com/lxc/lxd/issues/6205 [9]: https://criu.org/Main_Page [10]: https://linuxcontainers.org/lxd/docs/master/storage

own devicemapper snapshotter. From my limited understanding of podman, I believe it's geared more towards security and making containers rootless, which was a pain point in docker initially, since everyone ran containers with root.