.. no? Because many of the grsecurity+pax improvements apply to any kernel that runs on a CPU (it provides active protections against certain forms of kernel vulnerabilities caused by bugs). This includes illumos, thus the question is valid.

grsecurity is a set of patches for the GNU/Linux kernel. illumos is based on Solaris, so the entire argument about grsecurity is nonsense. illumos uses red zones to prevent buffer overflows, which grsecurity is attempting to address. grsecurity is a commercial product by the way. A single license costs $19,000 USD.

Enhanced auditing and process control which grsecurity provides have been part of Solaris, and therefore illumos, since Solaris 10, some even earlier. GNU/Linux is still playing catch-up, and as long as people like myself, Bryan Cantrill, Adam Leventhal and the rest of the former Sun kernel engineers live, it will be playing catch-up forever.

My impression about package management being a shit-show on other operating systems is that every single podcast or blog post I read about those operating systems is celebrating that "package management is easy now with pkg" -- while it's actually not IMO as good as certain GNU/Linux package managers.

In order for that opinion of yours to actually mean anything, the question is: how many packaging formats do you know to produce packages for? Only then will you be in a position where you would actually be competent to make such a statement, and where your opinion would actually make a difference. I myself have packaged for HP-UX, IRIX, Solaris, GNU/Linux (RPM), GNU/Linux (DPKG), and SmartOS (pkgsrc), so I'm in a position to make such statements, and yet I didn't. You, on the other hand, apparently have no such inhibitions.

Only 14000?

"Only". If you had packaged, you would have known that the same body of software could be delivered by an arbitrary number of packages, since that depends on the packager(s), respectively on the architecture.

Also, what distribution of GNU/Linux, what version of the distribution, how much automated QA happens before releases, etc?

The same thing which happens on GNU/Linux; if you think that packages on GNU/Linux get tested like a classic UNIX vendor would test it, you're naive.

This is all not true, and you should know better. Docker/runC doesn't have an init process in containers. You _can_ run an init process, but it isn't necessary.

Is that right? https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zomb...

In addition, the zombie problem doesn't exist because of sub-reapers which are a Linux kernel feature.

As it stands, I've worked with Linux extensively and I've never heard of such a thing.
Please show me that code, for if you actually manage to show me that, I will have learned something new.

In addition, I am a maintainer of runC and actually care much more about the OCI than Docker.

Aaahhh, so that's why you keep on blindly lobbying for Docker. Now we finally get to the bottom of the thing. Couldn't you just be honest from the onset like I was on what your motivation is, so everybody knows where everybody stands?

So basically, you're trying to re-invent project Kevlar, Solaris zones, in a completely generic way so as to be everything and not be anything in particular to anyone. Did you not study UNIX, and the old Henry Spencer's saying

those who do not understand UNIX are condemned to re-invent it -- badly?

You could just bite the bullet and benefit from a complete, enterprise, battle tested solution with a decade of use behind it, and use Solaris zones by using vmadm(1M) in SmartOS, you know. No need to re-invent the wheel. Again.

How many more solutions does GNU/Linux need in order to be able to run lightweight virtual machines? Can't you people engineer one solution which actually works properly, like we have it in illumos? Apparently that's too much to ask. Or you could just use zones, which have been working for a decade, and actually let one run lightweight virtual servers running at the speed of bare metal in production, today:

https://smartos.org/man/1m/vmadm

https://smartos.org/man/1m/zoneadm

https://www.youtube.com/watch?v=hgN8pCMLI2U

As for "OCI", I have no idea what you're writing about. To me, an oldschool UNIX guy, "OCI" stands for "Oracle Call Interface":

http://www.oracle.com/technetwork/database/features/oci/inde...

Finally, a word on your question about setting up Manta. Apparently it's open source:

https://github.com/joyent/manta

...which means you can set it up seven ways 'till Sunday, and do with it whatever you please, however you please. I myself don't use it, because I design my availability into the application I write, and my interest is in the infrastructure layer anyway, where things like DNS are designed to be highly available from the onset (again availability in the application, and not the OS layer).

http://dtrace.org/blogs/dap/2013/07/03/fault-tolerance-in-ma...