OpenShift Blog

> Many people might think the word “container” has a specific meaning within the Linux kernel; however the kernel has no notion of a “container”. The word has been synonymous with a variety of Linux tooling which when applied give the resemblance of what we expect a container to be.

Before LXC ( https://LinuxContainers.org ) and CNCF ( https://landscape.cncf.io/ )
and
OCI ( https://opencontainers.org/ ), for shared-kernel VPS hosting ("virtual private server"; root on a shared box), there was OpenVZ (which requires a patched kernel and AFAIU still has features, like bursting, not present in cgroups).

Docker no longer has an LXC driver: libcontainer (opencontainers/runc)
is the story now. The LXC docs have a great list of utilized kernel features that's also still true for docker-engine = runC + moby. The LXC docs: https://linuxcontainers.org/lxc/introduction/ :

> Current LXC uses the following kernel features to contain processes:

> ## Kernel namespaces (ipc, uts, mount, pid, network and user)

>> Namespaces are a feature of the Linux kernel that partitions kernel resources such that one set of processes sees one set of resources while another set of processes sees a different set of resources. https://en.wikipedia.org/wiki/Linux_namespaces

> ## Apparmor and SELinux profiles https://en.wikipedia.org/wiki/AppArmor / https://en.wikipedia.org/wiki/Security-Enhanced_Linux

udica is an interesting tool for creating SELinux policies for containers.

Is it possible for…

It makes sense to weigh up your options. I'll propose one you may want to consider.

By hosting on Heroku (or any other cloud hosting provider) you're saving on devops, but you're also paying over the odds for your hosting. However, if you had an option that retained most of the devops simplicity of Heroku, but also cut costs, evaluating this would make sense.

I would suggest that this option exists, and that option is application containers (Docker, etc...). If you can build your infrastructure around application containers, not only do you have the option of using dedicated hosting when you have access to the processing capacity to do so (and thereby save money), but you also have option to scale into the cloud if/when the local capacity is exceeded. A number of the cloud hosts support Docker, including but not limited to OpenShift:

https://blog.openshift.com/openshift-v3-platform-combines-docker-kubernetes-atomic-and-more/

Furthermore, it's a change you can make gradually. Developers can start using application containers as development environments, and you can roll them out more broadly once the implementation issues have been ironed out.

Does this sound like something you would consider?

EDIT: Worth noting that Heroku also supports deploying using Docker containers:

https://devcenter.heroku.com/articles/docker

For anyone interested in Kubernetes: Red Hat's OpenShift is worth taking a look at.

It's upstream Kubernetes + a PaaS framework built in top of it.

It takes care of role-based access control, has a secured Docker registry (prevents applications from pulling each other's source code), Jenkins integration and can automatically build, push and deploy your applications.

Our team started using it and it's great. The documentation is top-notch (it's probably the best docs I've ever seen in an open source project).

I've seen many teams re-invent the wheel over and over again, when OpenShift already does most of what they need.

Happy to answer questions!

https://www.openshift.org/ (`oc cluster up` and a running Docker is all it takes for a first test)

Docs: https://docs.openshift.org/latest/welcome/index.html

Blog: https://blog.openshift.com/

In Red Hat OpenShift Consulting, we openly advise against “One cluster to rule them all” and the vast majority of our customers heed our advice. Our default delivery models support Sandbox, Nonprod, Prod cluster stand up. Some of us even support the idea that good IaC/EaC practices get our customers to where the cluster can be treated like cattle (much like pods and containers) in well-designed apps. My colleague Raffaele hinted as much when describing the problem as a matter of availability, disaster recovery and federation [0]. At least in OpenShift, multi-tenancy is a solved problem when cluster right-sizing has taken place. RBAC, node labels and selectors, EgressIP, quotas, requests and limits, multi-tenant or networkpolicy plug-ins go a long way.

[0] https://blog.openshift.com/deploying-openshift-applications-multiple-datacenters/

They work on the core container engine stuff. Aleksa Sarai (who posts in here every once in a while as "cyphar") is the maintainer of runC, which is core to most popular container runtimes (containerd/docker, podman, cri-o/kubernetes, etc.).

They also work on building a platform for trivially deploying and scaling Kubernetes within openSUSE as Kubic[1]. SUSE has a variant of this as the SUSE CaaS platform[2] ("container as a service" platform) product. Kubic is analogous to Fedora CoreOS[3], while CaaSP is similar to RHEL CoreOS that's part of OpenShift[4].

[1]: https://kubic.opensuse.org/

[2]: https://www.suse.com/products/caas-platform/

[3]: https://coreos.fedoraproject.org/

[4]: https://blog.openshift.com/openshift-4-install-experience/

I put something together for the US a couple of years back as well. I've been meaning to add some logic around deviation from the mean, etc. but haven't gotten around to it.

http://wwos-bitmason.rhcloud.com/

Some discussion of the app and parsing the USGS data for those interested:

https://blog.openshift.com/use-openshift-to-map-river-levels-with-flask-mongodb-leaflet-and-openstreetmaps/

http://bitmason.blogspot.com/2013/11/over-summer-i-wrote-post-about-writing.html