Docker has always used microVMs (well, since 2016)
7 points by typesanitizer
7 points by typesanitizer
I kinda doubt they were doing it for the security benefits first and foremost, they've been doing it because it wouldn't work otherwise on Windows and Mac. I have no source for this, but the fact that I have never seen any marketing material tout the advantages of MicroVMs (and Docker has generally been marketing heavy) supports this opinion.
Docker Desktop on Mac and Windows put all containers in a single VM, as did Podman. So this isn’t security unless you consider container-to-container attacks out of scope. In contrast, Apple’s container tool puts every container in its own VM.
I think the author of the post lost me by mixing "we did <something container> since 2015" and "now we're doign microvms". I am still not completely sure.
We did actually have a mode in the Docker for Mac beta (then called pinata circa 2015) which had multiple VM support, but we didn't ship it because the users didn't like it. Back then, most people were pulling up a Ruby on Rails or LAMP stack, and just wanted high performance across the compose/stack swarm. This implies all the containers in a group needed to be in the same VM, and we spent most of the time optimising the external sharing (networking and filesystem) to the host. You can read some of the history here and the Linux distro we made is still pretty cool in that it uses namespaces to avoid too much service visibility in the root by default.
They were doing it on non-linux platforms as a comparability layer, OCI is a Linux feature.
Docker Desktop, that is. Née Docker for Mac, but it also runs on Linux and Windows? Not sure about the particulars. It's been a non-free(?) product since 2021. Headline seems to be a bit misleading there, despite the arguably cool technology.