Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks
  • Search
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Brand Logo

Cloudron Forum

Apps | Demo | Docs | Install
  1. Cloudron Forum
  2. App Packaging & Development
  3. Sysbox integration in progress..

Sysbox integration in progress..

Scheduled Pinned Locked Moved App Packaging & Development
27 Posts 7 Posters 4.9k Views 10 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R Rodny Molina

      @girish Question ...

      Have you guys considered the option of removing RO requirement for specific applications? I'm talking about system apps such as docker, systemd, k8s, podman, ci/cd tools, legacy-apps, etc. All that (and more) can be potentially offered to Cloudron users. But as you know, this software needs RW access to diverse sections of the rootfs (such as /run) to create pipes/sockets/dirs, etc.

      The system container running these special apps is fairly secure by virtue of running within dedicated user-namespaces. Also, it's self-contained, in the sense that when you do a docker-commit you are not only capturing the outer sys-container image, but also the inner docker images; that's to say that you can customize these system-apps to your liking, and reduce instantiation latency to the minimum (no i/o needed to fetch inner images).

      Please let me know when have a chance.

      Thanks.

      R Offline
      R Offline
      Rodny Molina
      wrote on last edited by
      #14

      @robi just helped me realize that /run is already bind-mounted as RW, i had missed that. There may be other paths for which RW access is expected though, but i guess that's something that can be evaluated on a per-app basis.

      1 Reply Last reply
      0
      • R Rodny Molina

        @girish Question ...

        Have you guys considered the option of removing RO requirement for specific applications? I'm talking about system apps such as docker, systemd, k8s, podman, ci/cd tools, legacy-apps, etc. All that (and more) can be potentially offered to Cloudron users. But as you know, this software needs RW access to diverse sections of the rootfs (such as /run) to create pipes/sockets/dirs, etc.

        The system container running these special apps is fairly secure by virtue of running within dedicated user-namespaces. Also, it's self-contained, in the sense that when you do a docker-commit you are not only capturing the outer sys-container image, but also the inner docker images; that's to say that you can customize these system-apps to your liking, and reduce instantiation latency to the minimum (no i/o needed to fetch inner images).

        Please let me know when have a chance.

        Thanks.

        girishG Do not disturb
        girishG Do not disturb
        girish
        Staff
        wrote on last edited by
        #15

        @rodny-molina Sure, it's possible to remove the requirement as more use cases come up. Cloudron is currently targeting installing web apps (SaaS equivalents) and not targeting infrastructure apps/system app. I think CI/CD and Jupyter Hub style apps can find sysbox useful though. BTW, did I understand correctly that I can run sysbox and runc runtimes side by side? It does seem like that but wanted to confirm . And is a new release planned soon with the readonly fixes? Would be great if we can also download binaries instead of deb packages.

        mehdiM R 2 Replies Last reply
        0
        • girishG girish

          @rodny-molina Sure, it's possible to remove the requirement as more use cases come up. Cloudron is currently targeting installing web apps (SaaS equivalents) and not targeting infrastructure apps/system app. I think CI/CD and Jupyter Hub style apps can find sysbox useful though. BTW, did I understand correctly that I can run sysbox and runc runtimes side by side? It does seem like that but wanted to confirm . And is a new release planned soon with the readonly fixes? Would be great if we can also download binaries instead of deb packages.

          mehdiM Offline
          mehdiM Offline
          mehdi
          App Dev
          wrote on last edited by
          #16

          @girish I am not 100% sure it's doable, but instead of running Cloudron apps in sysbox, I think it would make a lot of sense to run a sysbox container as an addon service for apps that need to run docker containers, and run them inside the sysbox addon container.

          girishG 1 Reply Last reply
          1
          • mehdiM mehdi

            @girish I am not 100% sure it's doable, but instead of running Cloudron apps in sysbox, I think it would make a lot of sense to run a sysbox container as an addon service for apps that need to run docker containers, and run them inside the sysbox addon container.

            girishG Do not disturb
            girishG Do not disturb
            girish
            Staff
            wrote on last edited by girish
            #17

            @mehdi right, I don't want to move everything to sysbox. Just the ones that want it. But I want to know if it's possible to run them both side by side.

            mehdiM 1 Reply Last reply
            0
            • girishG girish

              @mehdi right, I don't want to move everything to sysbox. Just the ones that want it. But I want to know if it's possible to run them both side by side.

              mehdiM Offline
              mehdiM Offline
              mehdi
              App Dev
              wrote on last edited by
              #18

              @girish I understand that. My point is maybe we should consider putting it in a separate service container, instead of the app itself

              R 1 Reply Last reply
              0
              • mehdiM mehdi

                @girish I understand that. My point is maybe we should consider putting it in a separate service container, instead of the app itself

                R Offline
                R Offline
                Rodny Molina
                wrote on last edited by Rodny Molina
                #19

                @girish @mehdi, you can definitely run Sysbox side-by-side along other runtimes such as runc.

                Sysbox will exclusively interact with its own containers. You just need to program your orchestrator to make use of Sysbox for those containers for which you want enhanced security or extra functionality.

                Ping me if any question.

                https://github.com/nestybox/sysbox#using-sysbox

                ---
                Note that if you omit the --runtime option, Docker will use its default runc runtime to launch regular containers (rather than system containers). It's perfectly fine to run system containers launched with Docker + Sysbox alongside regular Docker containers; they won't conflict and can co-exist side-by-side.
                ---
                
                1 Reply Last reply
                1
                • girishG girish

                  @rodny-molina Sure, it's possible to remove the requirement as more use cases come up. Cloudron is currently targeting installing web apps (SaaS equivalents) and not targeting infrastructure apps/system app. I think CI/CD and Jupyter Hub style apps can find sysbox useful though. BTW, did I understand correctly that I can run sysbox and runc runtimes side by side? It does seem like that but wanted to confirm . And is a new release planned soon with the readonly fixes? Would be great if we can also download binaries instead of deb packages.

                  R Offline
                  R Offline
                  Rodny Molina
                  wrote on last edited by
                  #20

                  @girish said in Sysbox integration in progress..:

                  And is a new release planned soon with the readonly fixes? Would be great if we can also download binaries instead of deb packages.

                  Forgot to answer this one. Yes, we are about to start working on the next release (ETA ~ 2 weeks). Not sure about the binaries though, will get back to you later on this.

                  girishG 1 Reply Last reply
                  2
                  • R Rodny Molina

                    @girish said in Sysbox integration in progress..:

                    And is a new release planned soon with the readonly fixes? Would be great if we can also download binaries instead of deb packages.

                    Forgot to answer this one. Yes, we are about to start working on the next release (ETA ~ 2 weeks). Not sure about the binaries though, will get back to you later on this.

                    girishG Do not disturb
                    girishG Do not disturb
                    girish
                    Staff
                    wrote on last edited by girish
                    #21

                    @rodny-molina Having a binary would really help because usually the deb packages have a tendency to restart existing services and also automatically start their own services.

                    Does the debian package support this scenario - https://github.com/nestybox/sysbox/blob/master/docs/user-guide/install.md#Installing-Sysbox-without-Docker-restart ?

                    R 1 Reply Last reply
                    0
                    • girishG girish

                      @rodny-molina Having a binary would really help because usually the deb packages have a tendency to restart existing services and also automatically start their own services.

                      Does the debian package support this scenario - https://github.com/nestybox/sysbox/blob/master/docs/user-guide/install.md#Installing-Sysbox-without-Docker-restart ?

                      R Offline
                      R Offline
                      Rodny Molina
                      wrote on last edited by
                      #22

                      @girish, right, this 'hitless' scenario is supported by the installer as long as the expected attributes (e.g. bip, address-pools) are already configured in the docker config file. If they are not present and digested by dockerd, then the installer will restart docker.

                      I understand that you may need more flexibility for Cloudron's specific setup. Can we talk to have these installation details fully understood? (rmolina@nestybox.com).

                      girishG 1 Reply Last reply
                      1
                      • R Rodny Molina

                        @girish, right, this 'hitless' scenario is supported by the installer as long as the expected attributes (e.g. bip, address-pools) are already configured in the docker config file. If they are not present and digested by dockerd, then the installer will restart docker.

                        I understand that you may need more flexibility for Cloudron's specific setup. Can we talk to have these installation details fully understood? (rmolina@nestybox.com).

                        girishG Do not disturb
                        girishG Do not disturb
                        girish
                        Staff
                        wrote on last edited by
                        #23

                        @rodny-molina will do. Give me sometime to play around with sysbox before we have a talk, so maybe after your release. I want to give it a try in a couple of our apps to understand how it all fits.

                        timconsidineT 1 Reply Last reply
                        3
                        • robiR Offline
                          robiR Offline
                          robi
                          wrote on last edited by
                          #24

                          From a recent discussion on sharing data between apps, this will be interesting.

                          On the persistence of Inner container images..

                          Conscious tech

                          1 Reply Last reply
                          0
                          • robiR Offline
                            robiR Offline
                            robi
                            wrote on last edited by
                            #25

                            A community update from TYPO3:

                            https://gitlab.typo3.org/core-testing/testing-infrastructure/
                            This is a 'infrastructure as code' repository for a gitlab-runner setup using sysbox, maybe this helps anyone looking into similar things:

                            • bare metal setup with ansible - gitlab-runner with docker executor and sysbox'd test execution in DinD

                            • Hetzner cloud docker+machine - gitlab-runner with docker+machine autoscaling with sysbox on workers

                            Conscious tech

                            1 Reply Last reply
                            0
                            • robiR robi referenced this topic on
                            • robiR robi referenced this topic on
                            • girishG girish

                              @rodny-molina will do. Give me sometime to play around with sysbox before we have a talk, so maybe after your release. I want to give it a try in a couple of our apps to understand how it all fits.

                              timconsidineT Offline
                              timconsidineT Offline
                              timconsidine
                              App Dev
                              wrote on last edited by
                              #26

                              @girish what is current situation with sysbox and Cloudron ?

                              girishG 1 Reply Last reply
                              0
                              • timconsidineT timconsidine

                                @girish what is current situation with sysbox and Cloudron ?

                                girishG Do not disturb
                                girishG Do not disturb
                                girish
                                Staff
                                wrote on last edited by
                                #27

                                @timconsidine Are you asking if we plan to integrate it into Cloudron? There are no plans as such.

                                1 Reply Last reply
                                2
                                • robiR robi referenced this topic on
                                Reply
                                • Reply as topic
                                Log in to reply
                                • Oldest to Newest
                                • Newest to Oldest
                                • Most Votes


                                  • Login

                                  • Don't have an account? Register

                                  • Login or register to search.
                                  • First post
                                    Last post
                                  0
                                  • Categories
                                  • Recent
                                  • Tags
                                  • Popular
                                  • Bookmarks
                                  • Search