Intel has announced the discontinuation of the Clear Linux project, which developed a distribution with strict application isolation implemented through containers separated using full virtualization. Starting today, Intel will cease support and will no longer release updates or patches for vulnerabilities. GitHub repositories where the distribution was developed will soon be archived.
Users of Clear Linux are advised to migrate their systems to other distributions. It is noted that Intel will continue to actively support the Linux ecosystem and participate in the development of various open projects and Linux distributions to add support for its hardware and optimize their performance. It is expected that the employees involved in the development of Clear Linux will be affected by mass layoffs, during which the company's staff will be reduced by 5,000 people.
It should be noted that the core of Clear Linux contains only the minimal set of tools to run containers and is updated atomically through the replacement of Btrfs working snapshots. All applications are packaged as Flatpak or bundles, running in separate containers. Inside the containers, a specially optimized copy of Clear Linux runs, containing the necessary bundles for the target application.
The version of the distribution encompasses the state of all components within it — changing any part of the system always leads to a change in the overall version of the entire distribution. The system does not save its state (stateless) and does not contain pre-configured settings in the /etc directory after installation, but generates settings on the fly based on the templates specified at startup.
For container isolation, the Kata Containers toolkit is used, which employs full virtualization based on a hypervisor. KVMKata Containers has managed to minimize the startup time of KVM-based isolated environments and reduce memory consumption, bringing these metrics closer to those of regular containers. To decrease memory usage, the DAX mechanism is applied (direct file system access bypassing the page cache without using block device levels), while the KSM (Kernel Shared Memory) technology is utilized for deduplicating identical memory areas.
Source: opennet.ru
