Hacker News new | ask | show | jobs
by csense 1097 days ago
You seem to be...confused. Docker guest processes run on the host kernel, Docker just uses cgroups to request the host kernel isolate or instance various components (filesystems, UID/GID spaces, networking...maybe other things).

These instancing / isolation capabilities and interfaces are very Linux-specific. So to run Docker on a non-Linux OS, you need to run Linux in a VM.

If you have a Linux host, I'm not sure why you'd run Docker inside KVM or a user-mode Linux kernel. Wouldn't you rather just run Docker directly inside the host kernel?
2 comments
regularfry 1097 days ago
It's more interesting when you ask the question "why don't we use it to run docker containers on Darwin"... I dread to imagine what mapping cgroups back and forth between the two APIs might look like, but I also can't imagine I'm the first person to have wondered if it was, at least in principle, possible.
link
als0 1097 days ago
> I'm not sure why you'd run Docker inside KVM or a user-mode Linux kernel. Wouldn't you rather just run Docker directly inside the host kernel?

For better isolation. Privilege escalation would only affect the user mode kernel.

link