Comment by naikrovek

Kubernetes is an operating system on top of an operating system. Its complexity is insane.

The base OS should be providing a lot/all of these features by default.

Plan9 is as you describe out of the box, but what I want is what plan9 might be if it were designed today and could be with a little work. Isolation would not be terribly difficult to add to it. The default namespace a process gets by default could limit it to its own configuration directory, its own data directory, and standard in and out by default. And imagine every instance of that application getting its own distinct copy of that namespace and none of them can talk to each other or scan any disk. They only do work sent to them via stdin, as dictated in the srv configuration for that software.

Everything doesn’t HAVE to be a file, but that is a very elegant abstraction when it all works.

> call the ip() command and run your app in an isolated namespace with a single command if you wanted to.

I should not have to opt in to that. Processes should be isolated by default. Their view of the computer should be heavily restricted; look at all these goofy NPM packages running malware, capturing credentials stored on disk. Why can an NPM package see any of that stuff by default? Why can it see anything else on disk at all? Why is everything wide fucking open all the time?

Why am I the goofy one for wanting isolation?