Do you run Docker in a VM or on the host node? I’m running a lot of LXC at home on Proxmox but sometimes it’d be nice to run Docker stuff easily as well.
Thanks for the tip, for some reason I assumed I couldn’t run docker in LXC but never actually tried… I prefer to avoid the overhead of a full VM and I find LXCs way easier to manage from the host system. Guess I’ll have something to test this weekend. Cheers!
You’re correct that nesting namespaces is unlikely to introduce measurable performance degradation. For performance, I was thinking mostly in the nested virtual network stack adding latency. Both docker and lxc run their own virtual interfaces.
There’s also the issue of running nested apparmor, selinux, and/or seccomp checks on processes in the child containers. I know that single instances of those are often enough to kill performance on highly latency sensitive applications (SAP netweaver is the example that comes to mind) so I would imagine two instances of those checks would exacerbate those concerns.
Do you run Docker in a VM or on the host node? I’m running a lot of LXC at home on Proxmox but sometimes it’d be nice to run Docker stuff easily as well.
Just create an LXC container to run your dockers, all you have to do is make sure you run the LXC as privileged and enable nesting.
Thanks for the tip, for some reason I assumed I couldn’t run docker in LXC but never actually tried… I prefer to avoid the overhead of a full VM and I find LXCs way easier to manage from the host system. Guess I’ll have something to test this weekend. Cheers!
There are security performance and capability concerns with that approach, apparmor on the first layer lxc probably being the most annoying.
If you want to isolate your docker sandbox from your main host, you should use a vm not a container.
OP’s already running LXC on the host, so… Namespaces are namespaces…
I don’t see what performance issues there would be with that.
You’re correct that nesting namespaces is unlikely to introduce measurable performance degradation. For performance, I was thinking mostly in the nested virtual network stack adding latency. Both docker and lxc run their own virtual interfaces.
There’s also the issue of running nested apparmor, selinux, and/or seccomp checks on processes in the child containers. I know that single instances of those are often enough to kill performance on highly latency sensitive applications (SAP netweaver is the example that comes to mind) so I would imagine two instances of those checks would exacerbate those concerns.