host OS must be the same1 ❧ Lower overhead ❧ Adjustable isolation level ❧ Resource sharing is possible 1or binary-compatible: Solaris branded zones, FreeBSD Linuxulator
CHROOT(2) NAME chroot – change root directory LIBRARY Standard C Library (libc, -lc) SYNOPSIS #include <unistd.h> int chroot(const char *dirname); DESCRIPTION The dirname argument is the address of the pathname of a directory, terminated by an ASCII NUL. The chroot() system call causes dirname to become the root directory, that is, the starting point for path searches of pathnames beginning with ‘/’.
identified; verifiable ❧ Containers' write layer is throwaway ⇒ exchangeable; upgradeable ❧ Volumes are persistent and shareable ⇒ precious user data is clearly declared
one, for a long time ❧ Defined the container paradigm ⇒ prototyped it ❧ Extremely fast & wide adoption ⇒ locked into early design decisions ❧ Implementation-driven https://www.docker.com/
one, for a long time ❧ Defined the container paradigm ⇒ prototyped it ❧ Extremely fast & wide adoption ⇒ locked into early design decisions ❧ Implementation-driven ⇒ Implementation-defined https://www.docker.com/
• manifest JSON file • rootfs/ directory ❧ Identified by SHA–512 checksum (before compression) ❧ Addressed by name and a set of labels https://github.com/appc/spec/blob/master/spec/aci.md
use name as base URL: ❧ https://{name}-{version}-{os}-{arch}.aci ❧ https://{name}-{version}-{os}-{arch}.aci.asc ❧ No public key discovery https://github.com/appc/spec/blob/master/spec/discovery.md
use name as base URL: ❧ https://{name}-{version}-{os}-{arch}.aci ❧ https://{name}-{version}-{os}-{arch}.aci.asc ❧ No public key discovery https://3ofcoins.net/freebsd-base- -10.1.12-freebsd-amd64.aci https://github.com/appc/spec/blob/master/spec/discovery.md
for: <meta name="ac-discovery" content="prefix-match url-tmpl"> <meta name="ac-discovery-pubkeys" content="prefix-match url"> If that fails, strip last component off name and try again. https://github.com/appc/spec/blob/master/spec/discovery.md
for: <meta name="ac-discovery" content="prefix-match url-tmpl"> <meta name="ac-discovery-pubkeys" content="prefix-match url"> If that fails, strip last component off name and try again. Rinse. Repeat. https://github.com/appc/spec/blob/master/spec/discovery.md
ACE sign any data as this pod ❧ /pod/hmac/verify — verify another pod's (or own) signature on data https://github.com/appc/spec/blob/master/spec/ace.md
& lockdown ❧ ZFS for layered storage ❧ Runs Linux images (as allowed by FreeBSD's emulation) ❧ Breaks Linux monoculture (hopefully) ❧ Half year old this Monday https://github.com/3ofcoins/jetpack/
snapshot ❧ Dependent image's rootfs is cloned from parent, then updated ❧ Pod app's rootfs is cloned from image ❧ Each empty volume is a ZFS dataset https://github.com/3ofcoins/jetpack/
❧ Clone new pod from IMG ❧ Copy build dir to a new directory ❧ Run build command CMD… in the build dir ❧ Copy new manifest from build dir ❧ Use pod's rootfs (without build dir) as new image's https://github.com/3ofcoins/jetpack/blob/master/IMAGES.md