<story><title>Tiny Linux distro that runs the entire OS as Docker containers</title><url>https://github.com/rancher/os</url></story><parent_chain><item><author>gumby</author><text>I always felt, perhaps uncharitably, that the point of containers was &amp;quot;those other programmers are idiots so we need to encapsulate everything for the sake of defense&amp;quot;</text></item><item><author>lostmsu</author><text>The whole notion of containers is basically this. That&amp;#x27;s why I am not sure why not just fix the OS. If there&amp;#x27;s anything to fix in the first place.</text></item><item><author>oneplane</author><text>This is starting to smell like a system on top of a system to fix something that could be fixed in the system. Kind-of like implementing a filesystem on top op a filesystem... or putting a database on a filesystem to run another filesystem inside the database, or using a webbrowser as a runtime instead of an operating system.</text></item></parent_chain><comment><author>lobster_johnson</author><text>One huge benefit of containers is that you can treat a program as something atomic: Delete the container and it&amp;#x27;s gone, as if it were never installed.&lt;p&gt;Modern package management systems like APT spend a lot of effort installing and removing files, and they don&amp;#x27;t do it completely; any file created by a program after it is installed will not be tracked.&lt;p&gt;You could accomplish the same thing in other ways (as Apple&amp;#x27;s sandboxing tech does), of course.</text></comment>
<story><title>Tiny Linux distro that runs the entire OS as Docker containers</title><url>https://github.com/rancher/os</url></story><parent_chain><item><author>gumby</author><text>I always felt, perhaps uncharitably, that the point of containers was &amp;quot;those other programmers are idiots so we need to encapsulate everything for the sake of defense&amp;quot;</text></item><item><author>lostmsu</author><text>The whole notion of containers is basically this. That&amp;#x27;s why I am not sure why not just fix the OS. If there&amp;#x27;s anything to fix in the first place.</text></item><item><author>oneplane</author><text>This is starting to smell like a system on top of a system to fix something that could be fixed in the system. Kind-of like implementing a filesystem on top op a filesystem... or putting a database on a filesystem to run another filesystem inside the database, or using a webbrowser as a runtime instead of an operating system.</text></item></parent_chain><comment><author>mschuster91</author><text>tbh, I see the security point in Docker as a huge risk. Basically you&amp;#x27;re depending on everyone in the chain to regularly recompile your images or you will get compromised eventually. There is no such thing as an apt-get dist-upgrade or any way to create real useful audit logs with Docker.&lt;p&gt;On the other hand, deploying stuff is dead easy now. You just tell the hoster &amp;quot;deploy this Docker package, expose port X as HTTP, and put a SSL offloader in the front&amp;quot; and that was it, no more &amp;quot;we need &amp;lt;insert long list&amp;gt; to deploy this&amp;quot; or countless hours spent with the hoster on how to get weird-framework-x to behave correctly.</text></comment>