Bryan Cantrill on Jails and Solaris Zones
Why Hacker News recommends it
Recommended repeatedly as the best account of container history and how Zones built on and went beyond Jails.
What it is
Bryan Cantrill's Papers We Love talk on FreeBSD Jails and Solaris Zones, tracing how OS-level virtualization grew out of chroot and the limits of the traditional UNIX security model.
Recommended by 6 HN commenters across 6 different months, 2016 to 2025.
What Hacker News said
Strong rec ketralnis · 2016-07 · on “Running I3 Window Manager on Ubuntu for Windows”
Bryan Cantrill has a wonderful talk about exactly this in Illumos that I recommend at every opportunity [this video]
Strong rec panick21_ · 2024-07 · on “"Doors" in Solaris: Lightweight RPC Using File Descriptors (1996)”
I highly recommend this talk, talking about Jails and Zones. Jails was first, but Zones took a lot of lessens from it and went further. [this video]
Recommends eternalban · 2017-01 · on “Memory Deduplication: The Curse that Keeps on Giving [video]”
I am watching it now but he's talking about VMs ("KVM") and not "containers". As to why we're in this mess, this rather amusing talk by B. Cantrill discusses the history: [this video] (Linux) Containers are not VMs: [LINK]
Recommends jsiepkes · 2017-03 · on “Comprehensive and biased comparison of OpenBSD and FreeBSD [pdf]”
Bryan Cantrill has a nice talk which starts with a bit of history on containers (chroot, FreeBSD jails, Solaris zones, etc.). [this video]
Recommends kohtatsu · 2020-06 · on “Gocker: Docker implemented in 1.3k lines of Go”
This talk by Bryan Cantrill on the history of OS-level virtualization is great. [this video] Apparently the first version of Jails was a few hundred lines of code.
Recommends yakubin · 2023-02 · on “Sun: The Network Is the Computer”
FreeBSD jails were released in 2000 in FreeBSD 4.0. Solaris Zones in 2004/2005. In fact, the original Solaris Zones paper cites jails as inspiration. Jails: Confining the omnipotent root (2000): < [LINK] > Solaris Zones: Operating System Support for Consolidating Commercial Workloads (2004): < [LINK] > Originally, jails didn't virtualise the network stack. That was added later, in FreeBSD 8.0 with VNETs, which were buggy for a long time, but went through extensive testing and are enabled by default since FreeBSD 12.0 (quite recently). Solaris Zones went a step further than the original design, and run a separate network stack for each zone from the start, years before FreeBSD did. BTW, recom
Cites Annatar · 2016-08 · on “Docker Storage: An Introduction”
.. no? Because many of the grsecurity+pax improvements apply to any kernel that runs on a CPU (it provides active protections against certain forms of kernel vulnerabilities caused by bugs). This includes illumos, thus the question is valid. grsecurity is a set of patches for the GNU/Linux kernel. illumos is based on Solaris, so the entire argument about grsecurity is nonsense. illumos uses red zones to prevent buffer overflows, which grsecurity is attempting to address. grsecurity is a commercial product by the way. A single license costs $19,000 USD. Enhanced auditing and process control which grsecurity provides have been part of Solaris, and therefore illumos, since Solaris 10, some even
Cites bcantrill · 2016-09 · on “Haiku Project”
I love Haiku -- and their inspiration in BeOS brings back my memories of deciding not to work for Be in 1996, and then later hitting jackpot at the Be Inc. bankruptcy auction.[1] [1] [this video]