Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

linux namespaces/cgroup may be an implementation detail. But at a high level, each container can have a different view on system resources, and this is the critical point. Different from each other and the host system. The system resource can be filesystem, network access, processes, memory, ... .

chroot only isolates the file system, otherwise all other system resource is shared with the host system.

I don't doubt that other container technologies achieved similar level of isolation or more before Docker. But chroot is really not comparable to Docker.



Dockers for Windows and Macs do not even use "cgroups" and "namespaces" because these technologies are not available on these stacks -- it resorts to plain old VMs. So in a sense, yes, Docker is not just chroot but on the other hand, it is also not just "cgroups" with "namespaces". It turns out Docker is a reference implementation for the concept of containers. But you can replace it with anything that can process images and a "Dockerfile".




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: