[mrbluecoat]

> Docker repurposed SLIRP, a 1990s dial-up tool originally for Palm Pilots, to avoid triggering corporate firewall restrictions by translating container network traffic through host system calls instead of network bridging.

Genuinely fascinating and clever solution!

[mmh0000]

Until recently, Podman used slirp4net[1] for its container networking. About two years ago, they switched over to Pasta[2][3] which works quite a bit differently.

[1] https://github.com/rootless-containers/slirp4netns

[2] https://blog.podman.io/2024/03/podman-5-0-breaking-changes-i...

[3] https://passt.top/passt/about/#pasta-pack-a-subtle-tap-abstr...

[toast0]

I don't think SLIRP was originally for palm pilots, given it was released two years before.

SLIRP was useful when you had a dial up shell, and they wouldn't give you slip or ppp; or it would cost extra. SLIRP is just a userspace program that uses the socket apis, so as long as you could run your own programs and make connections to arbitrary destinations, you could make a dial script to connect your computer up like you had a real ppp account. No incomming connections though (afaik), so you weren't really a peer on the internet, a foreshadowing of ubiquitous NAT/CGNAT perhaps.

[avsm]

> I don't think SLIRP was originally for palm pilots, given it was released two years before.

That's a mistake indeed; "popularised by" might have been better. Before my beloved Palmpilot arrived one Christmas, I was only using SLIRP to ninja in Netscape and MUD sessions onto a dialup connection which wasn't a very mainstream use.

[ufocia]

SLIP not PPP. Those are two very different protocols. Otherwise your comment is fairly accurate. There were dial-in terminals, whether more expensive or not, that could be repurposed for generic Internet access.

I don't recall whether you could technically open listening ports, at least for a single connection, using slirp, but many, if not all systems, limited opening ports under 1024 to superusers, which (would have?) made running servers on standard ports more difficult.

In any case, I'm glad that you pointed out ACM's apparent revisionist history. They should know better.

[redhanuman]

repurposing a Palm Pilot dial-up tool to sneak container traffic past enterprise firewalls is unhinged and yet it worked the best infrastructure hacks are never clever in the moment they are just desperate that the cleverness only shows up after someone else has to maintain it.

[avsm]

VPNKit (the SLIRP component) has been remarkably bug free over the years, and hasn't been much of a burden overall.

There was another component that we didn't have room to cover in the article that has been very stable (for filesystem sharing between the container and the host) that has been endlessly criticised for being slow, but has never corrupted anyone's data! It's interesting that many users preferred potential-dataloss-but-speed using asynchronous IO, but only on desktop environments. I think Docker did the right thing by erring on the side of safety by default.

[Normal_gaussian]

Exactly. "so I hung the radiator out the window" vibes.

[arcanemachiner]

I am trying to decipher the meaning of your comment, to no avail.

[diroussel]

So you’ve never improvised an air conditioning system from a spare bilge pump, a propane tank and a cast iron radiator?

Sir, this is a hacker news.

[ufocia]

Facts! That would've been covered on Hackaday not here.

[justsomehnguy]

Except it's the plain NAT which was named 'bridge' because there were no sysadmin around slap some sense into the authors. Slirp is for 'unprivileged network namespaces' which is for a 'rootless' variants of docker ie attaching a container network to the host without the need for the root-level privileges.