Bryan Cantrill on Jails and Solaris Zones

Bryan Cantrill has a wonderful talk about exactly this in Illumos that I recommend at every opportunity [VIDEO]

.. no? Because many of the grsecurity+pax improvements apply to any kernel that runs on a CPU (it provides active protections against certain forms of kernel vulnerabilities caused by bugs). This includes illumos, thus the question is valid. grsecurity is a set of patches for the GNU/Linux kernel. illumos is based on Solaris, so the entire argument about grsecurity is nonsense. illumos uses red zones to prevent buffer overflows, which grsecurity is attempting to address. grsecurity is a commercial product by the way. A single license costs $19,000 USD. Enhanced auditing and process control which grsecurity provides have been part of Solaris, and therefore illumos, since Solaris 10, some even earlier. GNU/Linux is still playing catch-up, and as long as people like myself, Bryan Cantrill, Adam Leventhal and the rest of the former Sun kernel engineers live, it will be playing catch-up forever. My impression about package management being a shit-show on other operating systems is that every single podcast or blog post I read about those operating systems is celebrating that "package management is easy now with pkg" -- while it's actually not IMO as good as certain GNU/Linux package managers. In order for that opinion of yours to actually mean anything, the question is: how many packaging formats do you know to produce packages for? Only then will you be in a position where you would actually be competent to make such a statement, and where your opinion would actually make a diffe

I love Haiku -- and their inspiration in BeOS brings back my memories of deciding not to work for Be in 1996, and then later hitting jackpot at the Be Inc. bankruptcy auction.[1] [1] [VIDEO]

I am watching it now but he's talking about VMs ("KVM") and not "containers". As to why we're in this mess, this rather amusing talk by B. Cantrill discusses the history: [VIDEO] (Linux) Containers are not VMs: [LINK]

Bryan Cantrill has a nice talk which starts with a bit of history on containers (chroot, FreeBSD jails, Solaris zones, etc.). [VIDEO]

This talk by Bryan Cantrill on the history of OS-level virtualization is great. [VIDEO] Apparently the first version of Jails was a few hundred lines of code.

FreeBSD jails were released in 2000 in FreeBSD 4.0. Solaris Zones in 2004/2005. In fact, the original Solaris Zones paper cites jails as inspiration. Jails: Confining the omnipotent root (2000): < [LINK] > Solaris Zones: Operating System Support for Consolidating Commercial Workloads (2004): < [LINK] > Originally, jails didn't virtualise the network stack. That was added later, in FreeBSD 8.0 with VNETs, which were buggy for a long time, but went through extensive testing and are enabled by default since FreeBSD 12.0 (quite recently). Solaris Zones went a step further than the original design, and run a separate network stack for each zone from the start, years before FreeBSD did. BTW, recommended talk about those topics: Papers We Love: Jails and Zones: < [VIDEO] >

I highly recommend this talk, talking about Jails and Zones. Jails was first, but Zones took a lot of lessens from it and went further. [VIDEO]

1st of all yes, many people consider not only chroot to be virtualization (of the file system). Yes it is arguable as it is the birth of lightweight virtualization. But you were wrong in saying no one does. [LINK] [VIDEO] 2nd containers go farther and virtualize network, and other resources.