Ivan Velichko

I mean most people still see it as a blackbox. The magic is in namespaces, cgroups, etc. I would recommend reading this series: https://iximiuz.com/en/posts/container-learning-path/

https://iximiuz.com - Ivan Velichko - blog that explains Kubernetes, Docker, Linux, etc visually

It does work! Actually, it's my favorite type of containers so far https://iximiuz.com/en/posts/not-every-container-has-an-operating-syst…

Not that I could find. There is always the option to use a sidecar container, eg: https://matthewsanabria.dev/posts/no-shell-for-you-container/ https://iximiuz.com/en/series/mastering-container-debugging/

Yeah, I'm simplifying a bit. It may not cause an immediate exit, but it can leave the service broken in unpredictable ways. See this discussion for instance: https://iximiuz.com/en/posts/go-http-handlers-panic-and-deadlocks/

See also: A Visual Guide to SSH Tunnels: Local and Remote Port Forwarding https://iximiuz.com/en/posts/ssh-tunnels/

what is performance of image building with this? can it build isolation container without image build https://iximiuz.com/en/posts/you-dont-need-an-image-to-run-a-container… ?

FWIW it's not too difficult to convert a docker image to a VM rootfs. See rootfs_builder[0] for example. I'm currently working on a wrapper for QEMU that has docker-like semantics for pull/run/start/stop/exec/etc, but it will pull docker images from docker registries and convert them to qcow2 for you and run them in QEMU. It works on Linux and Windows and should run on MacOS and BSD eventually. [0]: https://github.com/ForAllSecure/rootfs_builder EDIT: Also see https://iximiuz.com/en/posts/from-docker-container-to-bootable-linux-d…

How is this true? A container _is_ an ordinary process. https://iximiuz.com/en/posts/not-every-container-has-an-operating-syst… (we just discussed another article by the same author a few days ago on slimmer containers) "The container process is isolated (namespaces) from the rest of the system and restricted from both the resource consumption (cgroups) and security (capabilities, AppArmor, Seccomp) standpoints. But in the end, this is still a regular process, same as any other process on the host system."

I like the diagrams! Especially the one about Kubernetes API https://iximiuz.com/kubernetes-operator-pattern/kube-api-structure-300… Going to print it out and put it on the wall.

It may not be what fly.io does but there's a walkthrough of the basic idea here https://iximiuz.com/en/posts/from-docker-container-to-bootable-linux-d…

Same way you do with any other app not specifically designed for it; you start 2 copies of it and put loadbalancer in front of it. I did that via some systemd voodoo But TECHNICALLY to do that in one without external proxy you'd need to figure out how to set SO_REUSEPORT for the web socket handler, then start the second one before the first. Haven't actually tried it but someone apparently did: https://iximiuz.com/en/posts/go-net-http-setsockopt-example/ You'd still have any ongoing connections cut unless you unbind socket and then finish any existing connection, which would be pretty hard with default http server. I just put HAProxy instance on my VPS that does all of that, including only allowing traffic once app says "yes I am ok" in healthcheck. Then the app can have "shutting down" phase, where it reports "I am down" on healthcheck but still finished any active connections to the client.

Thanks for writing this up. I saw your original comment a while back was intrigued, and I got it working last weekend on a 2-vm vagrant private network setup, but only by constructing the network prefix by using a 32 bit ULA prefix concatenated on the full 32 bit ipv4. I think it worked (hooked up wireshark to a tcpdump of the vm's interface to the private network and saw the 6-in-4 packets) but I didn't need to use the `6rd-relay_prefix` argument to ip tunnel, do you have any idea why that might be? I suspect 32+32 is the default (vs. your 40+24), and if you want to only use the lower 24 bits of the ipv4, you need to indicate to the kernel what netmask you are using on your ipv4 network ("6rd relay prefix"). I guess that would buy you either more randomness in your ULA prefix, or some more ipv6 subnets per ipv4 vm. You can explore this a bit further and set up some net namespaces, connect them to the host vm via a bridge device, assign them ipv6 addresses from the vm host /64 network, and then set up a default route inside each container to the /32 or /40 you're using via the vm host's address on the host local /64. It's cool to see one container on host 1 talk to another on host 2. You're basically subnetting the /40 for each host; each host is analogous to a household in 6rd, and the containers are like your devices on your lan with globally routable ipv6 addresses (except we're using a ULA prefix instead of a globally routable ipv6 prefix assigned to an ISP, so our…