Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is the actual purpose of Docker?

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 159 posts

Re: Ask HN: What is the actual purpose of Docker?

#101

Post by sudioStudio64 »

I think the main thing is to provide an abstraction for applications so that they aren't tightly coupled to the operating system of the server that's hosting them. That's a big deal.

Some people have mentioned security...patching in particular. Containers won't help if you don't have patching down. At the very least it lets you patch in the lab and easily promote the entire application into production.

I think that the security arguments are a canard. By making it easier and faster to deploy you should be able to patch app dependencies as well. I, for one, would automate the download and install of the latest version of all libs in a container as part of the app build process. Hell, build them all from source.

IT departments need to be able to easily move applications around instead of the crazy build docs that have been thrown over the wall for years.

Re: Ask HN: What is the actual purpose of Docker?

#102

Post by justizin »

davexunit wrote: post #91
jordigh wrote: post #69

Earlier quoted context omitted.

I want to downvote the first paragraph but upvote the second one. Doesn't Docker also help cause problems like ssh private key reuse? I am sure that there are mitigations, but it's sad to have ways to prevent some activity that the software makes easy to do.

>I want to downvote the first paragraph but upvote the second one. I had the very same feeling. Containers are very useful, but the Docker suite of tools just don't have a very good security story.

They have the same security story as other linux systems.

Re: Ask HN: What is the actual purpose of Docker?

#103

Post by pekk »

hosh wrote: post #89

You're coming at this from the wrong direction, namely virtualization. What differentiates Docker is not virtualization, so much as package management. Docker is a package management tool that happens to allow you to execute the content of the package with some sort of isolation. Further, when you look at it from that angle, you start seeing the flaws with it, as well as it's potential. It's no accident that Rocket a…

Somehow this wasn't well explained, leading to a really persistent misunderstanding that comes up any time Docker is mentioned; you can see in this very thread someone claiming to be an expert with Linux and saying that Docker is no good because it doesn't sufficiently abstract away from the kernel, as if that were its purpose. There is always someone on hand to claim that Docker is nothing more than cgroups, again, as if the packaging part of this didn't even exist.

Re: Ask HN: What is the actual purpose of Docker?

#104

Post by mugsie »

justizin wrote: post #102
davexunit wrote: post #91

Earlier quoted context omitted.

>I want to downvote the first paragraph but upvote the second one. I had the very same feeling. Containers are very useful, but the Docker suite of tools just don't have a very good security story.

They have the same security story as other linux systems.

while promising a much better one...

Re: Ask HN: What is the actual purpose of Docker?

#105

Post by mugsie »

JustSomeNobody wrote: post #96
KaiserPro wrote: post #13

docker and openVZ aim to do the same thing. docker is a glorified chroot and cgroup wrapper. There is also a library of prebuilt docker images (think of it as a tar of a chroot) and a library of automated build instructions. The library is the most compelling part of docker. everything else is basically a question of preference. You will hear a lot about build once, deploy anywhere. whilst true in theory, your mileag…

On OpenVZ, I can edit /etc/network/interfaces for each CT and can assign a static IP, for one example. Can I not do that for Docker? Sorry if this is naive, I don't know much of anything about Docker.

no, for many reasons:

You should have no way to login to the docker container

Dockers networking does not allow that for that IP to be visable.

Re: Ask HN: What is the actual purpose of Docker?

#106

Post by dasil003 »

debaserab2 wrote: post #95
dasil003 wrote: post #83

Earlier quoted context omitted.

> Docker is a cute little tool that gives people who aren't that great at Linux the illusion that they know what they're doing. That's a rather embittered perspective, ironic considering how new Linux is in the grand scheme of things. A more germane perspective is that Docker is a new tool which acknowledges that UX matters even for system tools.

I'm not sure if I agree that the UX of docker is all that great if you're inferring that docker somehow is more intuitive or easier to understand. The sheer amount of confusion from so many people out there about what docker does is evidence to that.

You're conflating the fundamental technicality and irreducible complexity of the issues that Docker is attempting to solve with the UI they are wrapping around it. It doesn't matter if you have Steve Jobs himself risen from the grave, there is no way to make Docker be as easy to understand and use as Instagram. That doesn't mean it's not a step-change if you consider the UX of Docker vs raw LXC.

Re: Ask HN: What is the actual purpose of Docker?

#107

Post by davexunit »

justizin wrote: post #102
davexunit wrote: post #91

Earlier quoted context omitted.

>I want to downvote the first paragraph but upvote the second one. I had the very same feeling. Containers are very useful, but the Docker suite of tools just don't have a very good security story.

They have the same security story as other linux systems.

That's... just not true.

Re: Ask HN: What is the actual purpose of Docker?

#108

Post by yellowapple »

arenaninja wrote: post #80
zwischenzug wrote: post #33

Some key points: - Docker is nothing new - it's a packaging of pre-existing technologies (cgroups, namespaces, AUFS) into a single place - Docker has traction, ecosystem, community and support from big vendors - Docker is _very_ fast and lightweight compared to VMs in terms of provisioning, memory usage, cpu usage and disk space - Docker abstracts applications, not machines, which is good enough for many purposes Som…

Docker is indeed fast and lightweight. It's amazing how much CPU power is freed up from not running a full on VM in VirtualBox. That said, I'm wary of running it in production

In my experience, the performance gains are much less significant v. a virtual machine running on a proper bare-metal hypervisor (like Xen).

Re: Ask HN: What is the actual purpose of Docker?

#109

Post by josegonzalez »

crdoconnor wrote: post #39
grhmc wrote: post #29

Earlier quoted context omitted.

Agreed about preventing issues getting to production, but that doesn't exclusively mean heavyweight virtualization. It also doesn't "cover up" broken build scripts. Our build scripts get tested a dozen times a day and cannot tolerate half-assed broken build scripts. Our deployment pipeline (after verifying the image is good enough to be deployed) packs the docker image into a machine image along with several other co…

>Agreed about preventing issues getting to production, but that doesn't exclusively mean heavyweight virtualization. Well, it gets you a step closer to accurately mimicking production. >It also doesn't "cover up" broken build scripts. That seems to be what that 'build once' rule is for. If your building process isn't risky, why the need to prohibit running it twice?

So that your build process is faster. If I can use the same container for local dev, continuous integration, staging, and production, that means I only had to build it once and the pipeline to get something from a developer's laptop to a production instance is much quicker.

Just because I can install the operating system doesn't mean I want to do this on every deploy of an application.

Re: Ask HN: What is the actual purpose of Docker?

#110

Post by justincormack »

davexunit wrote: post #100
hmans wrote: post #32

Docker is the industry-accepted standard to run web applications as root.

It's unfortunate that Docker still doesn't use user namespaces.

No, they are new and have had many security issues. Just run your containers not as root, you can use capabilities if you like.
Post reply on HN