Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Sandboxing. The new way of doing containers.

I'd think of it as plugins everywhere, like L7 proxies [1]. The code for a network filter could be reloaded in the server upon detection to a configuration change. I believe the startup mad dash is on to capture who is going to run the container runtimes, and host the plugin repositories.

So my guess is that Fermyon Technologies with Spin could be looking to follow the Vercel with NextJS model where everything will be open source and runnable from the development runtime, but there eventually will be features like Edge Functions [2] in five years that will only be available when you deploy to their hosted service. They'll likely work towards that with web services with Spin [3] and CMS with Bartholomew [4] for starters. Instead of everything linked together in a NodeJS app directly, your code will run from a WASM library in a sandbox.

But my guess about the Vercel model could be slightly wrong after checking out their solid founding team [5] -- the bios emphasize the WASM and Kubernetes worlds. The problem if it is something like the Docker model is that the standard will just be made with the big players like OpenContainer [6] and the enterprise business sold off [7], and/or folded into one of the cloud infra players (with the data centers).

[1] https://github.com/proxy-wasm/spec

[2] https://vercel.com/docs/concepts/functions/edge-functions

[3] https://spin.fermyon.dev/

[4] https://github.com/fermyon/bartholomew

[5] https://www.fermyon.com/about

[6] https://opencontainers.org

[7] https://www.mirantis.com/blog/mirantis-acquires-docker-enter...



It is more like, container folks rediscovered what we were doing with app servers.


To be fair I don't think this is really the same - if I understand correctly, app servers were always a poor approximation for actual co tainers.

Browser containers may be better, but you share the same problem with app containers that you share physical memory and a kernel space.

Same type of challenges though, yes. Just a brand "new" secure sticker on the front, whatever that's actually worth.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: