bk99.de entertain the web since 1997

bk99.de
HN · ContainersCurated

LinuxKit builds small Linux systems for containers

Summary

Docker presents LinuxKit as a toolkit for minimal, immutable and reproducible Linux images on different platforms. LinuxKit was presented at DockerCon in 2017. The project is licensed under an Apache licence.

Ideas

  • LinuxKit assembles system services from separate containers.
  • Minimal images only contain explicitly selected components.
  • Declarative YAML files describe reproducible system compositions.
  • Output can be produced for bare metal, virtual machines and clouds.

Insights

  • An operating system can be built like a versioned software artefact.
  • Small images reduce the attack surface and require precise operational features.
  • Isolating components within the host limits the lateral spread of failures.

Facts

  • Its development takes place publicly on GitHub.

Recommendations

  • Pin the versions of all components and sign the generated images.
  • Deliberately plan diagnostic access into minimal systems.

References

Read the original article

Search the Web Archive

HN · 2025

Apple Container: Linux containers on macOS

Apple develops a Swift-based runtime that starts Linux containers in lightweight virtual machines on Apple Silicon. Apple publishes the project under the Apache 2.0 licence. The tool targets Apple Silicon Macs and uses Linux guest kernels.

HN · 2023

Go, containers and the Linux scheduler

River Phillips shows how unrecognised container CPU limits worsen Go garbage collection and application latency. The test container was given a quota of four CPUs. Adjusting GOMAXPROCS shortened the GC cycle from about 2.5 to under one millisecond.

HN · 2017

Linux containers in 500 lines of code

Liz Rice builds a small container in Go and makes namespaces, cgroups, the root file system and process start directly visible in the code. The example comprises about 500 lines of Go. It uses Linux-specific system calls.