mkdev

OCI Container Runtimes like OCI's runc are "container runtimes", so the runtime spec[2]

Basically, docker started using lxc, but wanted a go native option, and wrote runc. If you look at [0] you can see how it actually instantiates the container. Here is a random blog that describes it fairly well [1]

crun is the podman related project written in c, which is more efficient than the go based runc.

You can try this even as the user nobody 65534:65534, but you may need to make some dirs, or set envs.

Here is an example pulling an image with podman to make it easier, but you could just make an OCI spec bundle and run it:

mkdir hello
cd hello
podman pull docker.io/hello-world
podman export $(podman create hello-world) > hello-world.tar
mkdir rootfs
tar -C rootfs -xf hello-world.tar
runc spec --rootless
sed -i 's;"sh";"/hello";' config.json
runc run container1

Hello from Docker!

runc doesn't support any form of constraints like a bounding set on seccomp, selinux, apparmor, etc.. but it will apply profiles you pass it.

Basically it fails open, and with the current state of apparmor and selinux it is trivial to bypass the minimal userns restrictions they place.

Historically, before rootless containers this was less of an issue, because you had to be a privileged user to launch a container. But with the holes in the LSMs, no ability to set administrative bounding sets, and the reality that none of the defaults constrain risky…

I made a platform where people can hire a mentor to learn programming (ruby/rails, frontend, devops, big data). I've focused on mentorship with a per-week payment, so not a 1hour tutor or 15min "solve concrete task" service, but a real, long-term mentor dedicated to sharing all the knowledge with students.

Initial customers base grew from the free ebook I wrote and various blog posts available on the website. Lots of success are due to email newsletter, which I'm trying to keep useful and rarely send any ads there.

I'm taking 20% from each payment and that's be growing quiet well so far, especially after entering english-language market. Website is https://mkdev.me/en

> Why should I spend money on not using Docker in 2019?

You should use what works for you - ultimately you know your context and circumstances better and you can make the decisions that affect you/your team better than any of us.

HN is not an indicator of industry trends, but more of a set of interesting articles and viewpoints that come together, though you will often see authors and commenters pushing hard in certain directions.

In this instance, have a look at the author's part 1 under 'Reasons to switch', see if any of the reasons given work for you.

https://mkdev.me/en/posts/dockerless-part-1-which-tools-to-replace-docker-with-and-why

Containers Without Docker: https://dzone.com/articles/containers-with-out-docker

Dockerless: https://mkdev.me/en/posts/dockerless-part-1-which-tools-to-replace-docker-with-and-why https://dzone.com/articles/dockerless-part-1-which-tools-to-replace-docker-wi

What's funny is, Docker is only actually useful because of how many features it has, all its supported platforms, all its bloat. You won't ever be totally satisfied with any alternative because it takes so long to make something like Docker, and someone will always need that one extra feature.

SEEKING WORK - Remote (Based in USA)

Technical Writer && Content Editor

Do you need engaging, original content for your blog or publication? Documentation for your favorite new internal API? A serious revision of your website's copy?

I am a programmer and writer looking for projects writing and editing technical and business content. I also do audio and video.

Most recent work: https://mkdev.me/en/posts/how-to-create-an-api-with-django

Contact: philip@kiely.xyz

https://philipkiely.com