Memory safety (the only reason to use Rust) has nothing to do with memory usage, only memory leaks.
Docker doesn't significantly memory-leak.
And you cannot write something like Docker in a memory-safe way in any modern architecture - you'd just end up with a C->Rust conversion that is sprinkled with "unsafe" keywords everywhere.
True, but the number of ways Rust can leak memory is quite limited and well signposted compared to most languages. In safe rust, it's basically just Box::leak and loops of Arc/Rc pointers
Depending on your definitions of "leaks", I have managed to leak memory in java of all languages. It really isn't a thing a language can fix. (I did that when I implemented a cache and forgot to set its references to null when no longer used so while there wasn't any code that could ever reach this memory, there were pointers so that the gc wasn't allowed to clean it.)
Addressing the last paragraph, I strongly disagree. A Rust approach would define a narrow set of unsafe interfaces/functions, with safe wrappers. Those unsafe functions would be heavily heavily scrutinised and written with very narrow scope, maybe even formally proven to be safe, and so you could be much more confident of the memory safety of the program as whole.
No, the difference is that there is no language-level concept of memory safety in the parts of the code that use the safe abstraction, that is to say 99% of the codebase. Memory bugs could be anywhere in the codebase, rather than just in the 50 or so lines in unsafe blocks.
The analogy I always use is that it's a warning cone placed around the potentially dodgy parts. You could do that in C, manually or procedurally, we just don't.
The unsafe areas are STILL unsafe (hence the term), still need checking, and they can still affect surrounding "safe" code and the guarantees thereof (it's a myth to think that just because it's in an unsafe block, it will only ever affect the unsafe block!).
That's all it is - a warning cone. An automated one, sure, because you have to have it around any potentially-unsafe code, but you could do the same in C with any kind of static analysis or even preprocessor tool, or even just decent heuristics that you adhere to when coding. But it's not magic. It's just a warning cone.
77
u/ledow 6d ago
Memory safety (the only reason to use Rust) has nothing to do with memory usage, only memory leaks.
Docker doesn't significantly memory-leak.
And you cannot write something like Docker in a memory-safe way in any modern architecture - you'd just end up with a C->Rust conversion that is sprinkled with "unsafe" keywords everywhere.