Project Atomic

Atomic[0] provides this on a Fedora/CentOS + docker base, and it works very well. It's slightly more mature than the CoreOS version as there is support for sharing volumes (volumes mounted with z are sharable, volumes mounted with Z are specific to a container). It's great to see this being adopted more widely - it greatly improves the security of containers, and in my experience, adds nothing to the cost of administrating systems. I'm much happier running our security-sensitive applications in containers with this than I would be without it. 0: http://www.projectatomic.io/

Have you seen project atomic? https://www.projectatomic.io/ Seems like it would align pretty well with your vision

Linuxkit allows you to build your own appliance like OS, while Bottlerocket is more of an end user project. A project that is more similar to Bottlerocket is https://www.talos.dev or https://www.projectatomic.io

If you want this and still want the polish of Fedora + Gnome, try SilverBlue - https://silverblue.fedoraproject.org/ Built on Project Atomic (https://www.projectatomic.io/) and OSTree (https://fedoraproject.org/wiki/Changes/WorkstationOstree) You can achieve the exact same thing. e.g. here - https://discussion.fedoraproject.org/t/minimal-or-custom-silverblue-os…

Docker is still pretty embedded in a lot of workflows, thanks in part to its use by-default in many Kubernetes distributions, and the popularity of Docker Hub - not to mention various tutorials and scripts which refer to docker tooling. But yep, I'd agree with the general premise here - with the emergence of tools like cri-o[0], podman and buildah (which let you build and ship container images without the need to run a background daemon like docker at all, avoiding the associated operational/security/system overheads) - docker may need to evolve or it'll quickly become less favourable. Project Atomic[1] runs a good PPA with many of these packages for anyone interested and using Ubuntu. [0] https://cri-o.io/ [1] http://www.projectatomic.io/

True, but remember the wise words of Dan Walsh "Containers Don't Contain" in that if you run as root inside of a container without careful consideration, bad users can absolutely break out, just like in a chroot. http://www.projectatomic.io/blog/2016/01/how-to-run-a-more-secure-non-… http://www.projectatomic.io/blog/2014/09/yet-another-reason-containers… In newer docker, the defaults are really good, but even then, it is worth reading up.

There is an OS named "Atomic" (it is a Red Hat project, so not particularly obscure), which seems pretty similar to "AtomOS" and "Atomix": http://www.projectatomic.io/

Our official Docker images are in https://gitlab.com/gitlab-org/gitlab-ce/tree/master/docker Good Kubernetes instructions (from a RedHat person if I'm correct) are on http://www.projectatomic.io/blog/2015/01/deploying-a-containerized-git… There is also a great community docker image that has Kubenetes instructions https://github.com/sameersbn/docker-gitlab/tree/master/kubernetes BTW I'm also passionate about making it easier to deploy apps hosted on GitLab to Kubernetes, see https://gitlab.com/gitlab-org/gitlab-ce/issues/3286 for more details.

Pretty sure RedHat is aware of immutable infrastructure: http://www.projectatomic.io/

I am not sure if this is the same, but Redhat's Project Atomic does similar thing using rpm-ostree http://www.projectatomic.io/

This is really RHEL ported as a host to Project Atomic, around for about a year or so now: http://www.projectatomic.io/

Looks a lot like Red Hat's Project Atomic (http://www.projectatomic.io/) "An Atomic Host is a lean operating system designed to run Docker containers, built from upstream CentOS, Fedora, or Red Hat Enterprise Linux RPMs. It provides all the benefits of the upstream distribution, plus the ability to perform atomic upgrades and rollbacks"

I want a distributed (not cloud) file system that handles many files and WAN latency (i.e. not HDFS). It might be a cross between Git and BitTorrent. It feels like deb repos, PyPI, NPM, CPAN, CRAN, etc. should be put in there, with the addition of binaries for popular architectures. And probably Docker-like images, although I think if they are not opaque blobs, it would be better for rsync-like differential compression (which Git implicitly provides). There will be some small files and some big files. I want it to be like Git so I can clone locally, not just go to the cloud. The way that Git is trivial to set up and clone through SSH is nice too. It probably has to have a notion of "user", like a local file system. (This makes the problem a lot harder; git doesn't really have permissions.) BTW Julia's package manager just used git, but I watched a talk that said this ended up being a really bad idea, especially on Windows. As far as I understand IPFS has some of these properties. Has anybody used it? Could I use it for the package repository use case? I don't know much about it, but Project Atomic sounds similar too: https://www.projectatomic.io/ Any other projects that seem like a close fit? BTW I think this would also be useful in the data center, as some companies like Twitter apparently use BitTorrent in data centers to start large jobs quickly (i.e replicate the same 500 MB binary to 1000 machines).

This sounds similar to Project Atomic[1]. The base OS is CentOS or Fedora, system files are managed by OSTree[2], and applications are run as Docker containers. You could probably also use something like Flatpak[3] for desktop apps, which is the approach used by Endless OS[4]. What I find interesting is these two projects are using a similar approach but targeting opposite ends of the spectrum. Atomic is intended as a cutting edge server OS for enterprises that want an integrated stack for running containerized infrastructure (they also started publicizing Atomic Workstation as of the last release, although I found it painful to use due to a lack of docs). Endless is targeting emerging markets, composed primarily of first-time computer users. OSTree+Flatpak allows the desktop to run similarly to a mobile OS, and there’s minimal chance of users breaking the system itself. [1] https://www.projectatomic.io [2] https://ostree.readthedocs.io [3] https://flatpak.org [4] https://endlessos.com/for-developers

Given that you work for SUSE and I kinda like you guys, I really hope that it's different from SLES licensing model. I work at a german govt. institution which uses SLES and we've recently decided to move away from SLES for a simple reason. If you want to use something like immutable infrastructure SLES is painful to use, because you need to do everything through the SMT admin. You won't even know which packages are available in SLES until you signup for it. Sure you can use openSUSE, but it's not the same packages, it's not the same package versions, and the open repo, while nice, is imho not as comfortable to use as ubuntu packages. IMHO it's not very user friendly. And yes yast2 is great, but I'm not talking about graphical user interfaces when I say user friendly. By the way, there are a few more "ContainerOSs" than just CoreOS nowadays. - There's project atomic [1] which became atomic host [2] - There's RancherOS, which I find interesting because it seems to have first class zfs support [3] [1]: http://www.projectatomic.io/docs/kubernetes/ [2]: https://www.redhat.com/en/resources/enterprise-linux-atomic-host-datas… [3]: http://rancher.com/docs/os/v1.0/en/storage/using-zfs/

By default, Docker will use the AUFS storage backend if available, and then fall back to devicemapper on loopback. RHEL, CentOS, and Fedora do not ship the AUFS kernel module because it is not part of the mainline Linux kernel and is unlikely to be included in future, and these distros have an "upstream first, no out-of-tree bits" policy. Instead, they recommend using devicemapper on LVM [1][2]. The same advice is provided in the official Docker documentation [3]: > Docker hosts running the devicemapper storage driver default to a configuration mode known as loop-lvm... The mode is designed to work out-of-the-box with no additional configuration. However, production deployments should not run under loop-lvm mode... The preferred configuration for production deployments is direct lvm. You might consider using CentOS Atomic Host, which comes preconfigured with LVM thin pools. OverlayFS is also an alternative, but it can be problematic. It only implements a subset of the POSIX standard [4], which can cause some programs to fail. [1] http://www.projectatomic.io/blog/2015/06/notes-on-fedora-centos-and-do… [2] https://access.redhat.com/documentation/en/red-hat-enterprise-linux-at… [3] https://docs.docker.com/engine/userguide/storagedriver/device-mapper-d… [4] https://docs.docker.com/engine/userguide/storagedriver/overlayfs-drive…

I think it is fair to say that Red Hat devs hate Docker devs. Early in the Docker days, Red Hat submitted multiple patches to Docker that fixed legitimate issues. Docker rejected[0] most of them. After that, Red Had basically said, "screw you guys, I'm going to build my own container engine with blackjack and hookers!" and Podman, Skopeo, Buildah, etc. popped up. [0] https://projectatomic.io/docs/docker_patches/ — Specifically if you're looking for nerd-drama, read through the rejected PRs.

https://www.projectatomic.io/docs/docker_patches/ specifically, the hooks patch. then see https://developers.redhat.com/blog/2016/09/13/running-systemd-in-a-non… (i.e. 4 years ago when I built containers to do this) though of course as you note they now say to use podman https://developers.redhat.com/blog/2019/04/24/how-to-run-systemd-in-a-…

Originally all the domains had 'svirt' in the name: https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_containers/ These days containers have their own domains: https://www.mankier.com/8/container_selinux As you say, the principle is the same. [edit] container_t is (or was?) an alias for svirt_lxc_net_t: https://danwalsh.livejournal.com/79191.html

Also Atomic/CoreOS - this will probably be cut now, perhaps even before it is complete. http://www.projectatomic.io/blog/2018/06/welcome-to-fedora-coreos/

If you want the portability of Docker/OCI images without running a service etc., you might take a look at Buildah: https://www.projectatomic.io/blog/2017/06/introducing-buildah/ It's a command-line tool for building and running container images.

In Fedora, there is the Fedora Tools container [1], in RHEL, there is the RHEL Tools container. I don't envision either of those going away because they allow you to do all kinds of fancy stuff including things that require kernel compatibility, like SystemTap, core dumps, etc. I am a product manager for containers/rhel/CoreOS at Red Hat, and I very much foresee a similar container for Red Hat CoreOS which will provide similar functionality for troubleshooting kernel, and user space (aka other containers) problems. [1]: https://www.projectatomic.io/blog/2015/09/introducing-the-fedora-tools… [2]: https://developers.redhat.com/blog/2015/03/11/introducing-the-rhel-con…

Atomic uses rpm-ostree, which looks similar to Omaha from a client perspective (update, roll back to previous version): http://www.projectatomic.io/docs/os-updates/

And here's a handy upgrade guide: http://www.projectatomic.io/blog/2017/11/fedora-atomic-26-to-27-upgrad…

> If I recall correctly, CentOS and RHEL will use the device-mapper driver by default and CoreOS the btrfs CentOS & RHEL uses device-mapper with loopback device by default (and logs "Usage of loopback devices is strongly discouraged for production use. Either use --storage-opt dm.thinpooldev or use --storage-opt dm.no_warn_on_loop_devices=true to suppress this warning". Also related article [1] CoreOS uses overlayfs by default now from a while [2] [1] http://www.projectatomic.io/blog/2015/06/notes-on-fedora-centos-and-do… [2] https://lwn.net/Articles/627232/

Allll right. Another atom-named project. Check. http://www.projectatomic.io/ https://atomicobject.com/ https://atomicorp.com/ https://atom.io/ http://tools.ietf.org/html/rfc5023 (Atom Publishing Protocol) (yeah, I know, look who knows how to google)

Containers already fully depend on a shared and complicated kernel to do containment (which is why some say "containers don't contain" e.g. http://www.projectatomic.io/blog/2014/09/yet-another-reason-containers… ). Virtual Machines have a smaller attack interface to the host, so they do have a chance of containing malicious code. Kernels were supposed to contain processes, providing them with a virtual private memory space, virtual storage access so they can't read or write any file you don't want them to, etc... but only openbsd is really trying to make that work.

It's probably just for customers. You can use the Fedora or CentOS based Atomic though: http://www.projectatomic.io/download/ e.g. http://buildlogs.centos.org/rolling/7/isos/x86_64/CentOS-7-x86_64-Atom… (optimised for cloud, no passwd login etc)

> Why aren't containers a good idea to use in production? See Dan Walsh articles here: http://www.projectatomic.io/blog/2014/09/yet-another-reason-containers…

Concerns: http://www.projectatomic.io/docs/inter-container-networking/ is obtuse. IPv4 only. Complete lack of any nod to portability (off systemd, off iptables, off Linux...). Daemon-centric architecture where http://www.projectatomic.io/docs/geard/ always runs as root. SSH access to live applications is apparently encouraged as a feature. How many of these also hold for CoreOS? Probably less, but definitely some.