TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Tarballs, the ultimate container image format

342 点作者 severus_snape大约 7 年前

15 条评论

theamk大约 7 年前
I like simple archives, but can it be not tarballs? For the kinds of application described in this article, tarballs are pretty bad:<p>Either you extract it from scratch every time you run an app, taking a long time penalty...<p>... or you extract once to cache, and assume that nothing changes the cache. This is pretty bad from both operational and security perspective:<p>- backups have to walk through tens of thousands of files, thus becoming much slower<p>- a damaged disk or a malicious actor can change one file in the cache, making damage which is very hard to detect.<p>There are plenty of mountable container formats -- ISO, squashfs, even zip files -- which all provide much faster initial access, and much better security&#x2F;reliability guarantees, especially with things like dm-verity.
评论 #17085391 未加载
评论 #17085745 未加载
评论 #17086106 未加载
评论 #17091017 未加载
paulfitz大约 7 年前
How about sqlar as a container format? <a href="https:&#x2F;&#x2F;sqlite.org&#x2F;sqlar.html" rel="nofollow">https:&#x2F;&#x2F;sqlite.org&#x2F;sqlar.html</a> A regular sqlite database file, with anything you like in it. Mountable as a file system with sqlarfs. Written by the sqlite guy.
评论 #17086649 未加载
RX14大约 7 年前
I really love the work the guix folk are doing. I&#x27;d love to run guixsd on my laptop if it was easy and supported to run plain upstream linux instead of linux-libre. It just seems like such a lovely easy to use project from the little time I&#x27;ve spent playing with it, it&#x27;s actually a small shame they&#x27;re part of the &quot;unsexy&quot; GNU project and subject to GNU politics.
评论 #17083293 未加载
评论 #17085124 未加载
评论 #17083286 未加载
评论 #17090286 未加载
tannhaeuser大约 7 年前
That article made me warm up to guix and its practical side. Are guix app bundles just bare tar archives with &#x2F;usr&#x2F;local prefix semantics or do they need special metadata files? How are compiled binaries with hardcoded and&#x2F;or autoconf&#x27;d prefixes handled for relocation (I guess using Linux namespaces somehow)?
评论 #17088198 未加载
chx大约 7 年前
For relocatable ELF binaries, there&#x27;s also <a href="https:&#x2F;&#x2F;github.com&#x2F;intoli&#x2F;exodus" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;intoli&#x2F;exodus</a>
评论 #17083942 未加载
评论 #17085809 未加载
cyphar大约 7 年前
This is remarkably off-beat for the GNU project. Tar files are <i>far</i> from the most ideal tool for container images because they are sequential archives and thus extraction cannot be done using any parallelism (without adding an index and being in a seekable medium, see the rest of this comment). I should really write a blog post about this.<p>Another problem is that there is no way to just get the latest entry in a multi-layered image without scanning every layer sequentially (this can be made faster with a top-level index but I don&#x27;t think anyone has implemented this yet -- I am working on it for umoci but nobody else will probably use it even if I implement it). This means you have to extract all of the archives.<p>Yet another problem is that if you have a layer which just includes a <i>metadata</i> change (like the mode of a file), then you have to include a full copy of the file into the archive (same goes for a single bit change in the file contents -- even if the file is 10GB in size). This balloons up the archive size needlessly due to restrictions in the tar format (no way of representing a metadata entry in a standard-complying way), and increases the effect of the previous problem I mentioned.<p>And all of the above ignores the fact that tar archives are not actually standardised (you have at least 3 &quot;extension&quot; formats -- GNU, PAX, and libarchive), and different implementations produce vastly different archive outputs and structures (causing problems with making them content-addressable). To be fair, this is a fairly solved problem at this point (though sparse archives are sort of unsolved) but it requires storing the metadata of the archive structure in addition to the archive.<p>Despite all of this Docker and OCI (and AppC) all use tar archives, so this isn&#x27;t really a revolutionary blog post (it&#x27;s sort of what everyone does, but nobody is really happy about it). In the OCI we are working on switching to a format that solves the above problems by having a history for each file (so the layering is implemented in the archiving layer rather than on top) and having an index where we store all of the files in the content-addressable storage layer. I believe we also will implement content-based-chunking for deduplication to allow us to handle minor changes in files without blowing up image sizes. These are things you cannot do in tar archives and are fundamentally limited.<p>I appreciate that tar is a very good tool (and we shouldn&#x27;t reinvent good tools), but not wanting to improve the state-of-the-art over literal <i>tape archives</i> seems a bit too nostalgic to me. Especially when there are <i>clear</i> problems with the current format, with obvious ways of improving them.
评论 #17090749 未加载
评论 #17089893 未加载
geofft大约 7 年前
I realize the title is just a hook for the (very cool!) work in the article, but a couple things that tarballs don&#x27;t&#x2F;can&#x27;t specify that Docker containers can:<p>- environment variables like locales. If your software expects to run with English sorting rules and UTF-8 character decoding, it shouldn&#x27;t run with ASCII-value sorting and reject input bytes over 127.<p>- Entrypoints. If your application expects all commands to run within a wrapper, you can&#x27;t enforce that from a tarball.<p>You can make conventions for both of these like &quot;if &#x2F;etc&#x2F;default&#x2F;locales exists, parse it for environment variables&quot; and &quot;if &#x2F;entrypoint is executable, prepend it to all command lines&quot;, but then you have a convention on top of tarballs. (Which, to be fair, might be easier than OCI—I have no particular love for the OCI format—but the problem is harder than just &quot;here are a bunch of files.&quot;)
评论 #17083425 未加载
评论 #17085236 未加载
matthewbauer大约 7 年前
Nix has a very similar tool called nix-bundle[1].<p>[1]: <a href="https:&#x2F;&#x2F;github.com&#x2F;matthewbauer&#x2F;nix-bundle" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;matthewbauer&#x2F;nix-bundle</a>
nerpderp83大约 7 年前
Tarballs don&#x27;t have a TOC and can&#x27;t easily index into individual entities.<p>One <i>could</i> create a utility to make tarballs with a TOC and the ability to index while still remaining compatible with tar and gzip. Pigz is one step in the direction.
评论 #17084712 未加载
评论 #17085398 未加载
digi_owl大约 7 年前
A quick FYI, Gobolinux operates much the same way.<p>1. Binary packages are simply compressed archives (tarballs) of the relevant branch in the &#x2F;Programs tree.<p>2. branches do not have to actually live inside the &#x2F;Programs tree. There are tools available to move the branches in and out of &#x2F;Programs.<p>All this because Gobolinux leverages symbolic links as much as possible.
评论 #17084731 未加载
评论 #17088567 未加载
kuwze大约 7 年前
Does anyone know how this would apply, for example, to sharing a Guile 2.2 application with Debian&#x2F;Red Hat based distributions? I want to use Guile 2.2 for development, but I am worried because it was only recently was released for major distros (at least with Ubuntu I know it was released with 18.04) and it doesn&#x27;t seem to support the creation of executables.
评论 #17088694 未加载
stuaxo大约 7 年前
Please, can we move to an archive format that isn&#x27;t so sprawlingly massive ?
评论 #17083796 未加载
评论 #17088297 未加载
评论 #17083684 未加载
评论 #17083441 未加载
justinsaccount大约 7 年前
Articles like this are pointless. I get that guix and nix are neat, and I think that every single time something about one of them is posted, but I don&#x27;t have the slightest clue how to use either one of them.<p>Do you want to convince people that something like guix is better than docker? Then take something that is currently distributed using docker and actually show how the guix approach is simpler.<p>i.e. I have a random app I recently worked on where the dockerfile was something like<p><pre><code> FROM python:2.7 WORKDIR &#x2F;app ADD requirements.txt &#x2F;app RUN pip install -r requirements.txt ADD . &#x2F;app RUN groupadd -r notifier &amp;&amp; useradd --no-log-init -r -g notifier notifier USER notifier EXPOSE 8080&#x2F;tcp CMD .&#x2F;notify.py </code></pre> How do I actually take a random application like that and build a guix package of it?<p>Another project I work on is built on top of zeromq, and it would be great to use something like guix to define all the libsodium+zeromq+czmq+zyre dependancies and be able to spit out an &#x27;ultimate container image&#x27; of all of that, but all this post shows me how to do is install an existing guile package.
评论 #17084561 未加载
评论 #17088275 未加载
评论 #17087160 未加载
评论 #17086324 未加载
评论 #17091821 未加载
评论 #17085872 未加载
评论 #17086068 未加载
AdmiralAsshat大约 7 年前
Do tarballs still have that unfixed&#x2F;unfixable bug where the extracted files will have the permissions of the person who untarr&#x27;d the file?
评论 #17083273 未加载
评论 #17083230 未加载
评论 #17083467 未加载
评论 #17083179 未加载
评论 #17083178 未加载
评论 #17087316 未加载
评论 #17083181 未加载
AnIdiotOnTheNet大约 7 年前
Reinventing Application Bundles only 30 years after NeXTStep, poorly.
评论 #17084698 未加载