发布于 2016-05-13 23:51:19 | 99 次阅读 | 评论: 0 | 来源: 网友投递
Rocket CoreOS 的容器引擎
Rocket （也叫 rkt）是 CoreOS 推出的一款容器引擎，和 Docker 类似，帮助开发者打包应用和依赖包到可移植容器中，简化搭环境等部署工作。Rocket 和 Docker 不同的地方在于，Rocket 没有 Docker 那些为企业用户提供的“友好功能”，比如云服务加速工具、集群系统等。反过来说，Rocket 想做的，是一个更纯粹的业界标准。
Rocket v1.6.0 发布了，此次发布Rocket安全性得以提升。提供了隔离防护，为每一个应用程序分配一个命名空间。具体改进如下：
stage1: implement read-only rootfs (#2624). Using the Pod manifest readOnlyRootFS option mounts the rootfs of the app as read-only using systemd-exec unit option ReadOnlyDirectories, see appc/spec.
stage1: capabilities: implement both remain set and remove set (#2589). It follows the Linux Isolators semantics from the App Container Executor spec, as modified by appc/spec#600.
stage1/init: create a new mount ns for each app (#2603). Up to this point, you could escape the app's chroot easily by using a simple program downloaded from the internet 1. To avoid this, we now create a new mount namespace per each app.
api: Return the pods even when we failed getting information about them (#2593).
stage1/usr_from_coreos: use CoreOS 1032.0.0 with systemd v229 (#2514).
下载地址：https://github.com/coreos/rkt/releases/tag/v1.6.0