Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is the actual purpose of Docker?

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 159 posts

Re: Ask HN: What is the actual purpose of Docker?

#111

Post by segmondy »

tinco wrote: post #55

> What's the difference between Docker and normal virtualization technology (OpenVZ/KVM)? Are there any good examples of when and where to use Docker over something like OpenVZ? Docker is exactly like OpenVZ. It became popular because they really emphasize their OpenVZ Application Templates feature, and made it much more user friendly. So users of Docker, instead of following this guide: https://openvz.org/Applicatio…

Docker and OpenVZ are not the same. Docker is single application focus. OpenVZ provides the entire OS in a container. OpenVZ has support for live migration.

Re: Ask HN: What is the actual purpose of Docker?

#112

Post by geggam »

joesmo wrote: post #76
KaiserPro wrote: post #13

docker and openVZ aim to do the same thing. docker is a glorified chroot and cgroup wrapper. There is also a library of prebuilt docker images (think of it as a tar of a chroot) and a library of automated build instructions. The library is the most compelling part of docker. everything else is basically a question of preference. You will hear a lot about build once, deploy anywhere. whilst true in theory, your mileag…

"However if you wish to assign ip addresses to each service, docker is not really mature enough for that. Yes its possible, but not very nice. You're better off looking at KVM or vmware." I don't understand. If you can't assign IPs to each service (or it's difficult/unreliable to do so) how can processes talk to each other and the outside world?

Its messy

Re: Ask HN: What is the actual purpose of Docker?

#113

Post by debaserab2 »

dasil003 wrote: post #106
debaserab2 wrote: post #95

Earlier quoted context omitted.

I'm not sure if I agree that the UX of docker is all that great if you're inferring that docker somehow is more intuitive or easier to understand. The sheer amount of confusion from so many people out there about what docker does is evidence to that.

You're conflating the fundamental technicality and irreducible complexity of the issues that Docker is attempting to solve with the UI they are wrapping around it. It doesn't matter if you have Steve Jobs himself risen from the grave, there is no way to make Docker be as easy to understand and use as Instagram. That doesn't mean it's not a step-change if you consider the UX of Docker vs raw LXC.

I'm only pointing out that docker has some pretty big UX problems as a whole (whether or not they can reduce the complexity of them enough to actually solve them is another thing). I wouldn't bill docker's UX as it's killer feature.

Re: Ask HN: What is the actual purpose of Docker?

#114

Post by justizin »

davexunit wrote: post #107
justizin wrote: post #102

Earlier quoted context omitted.

They have the same security story as other linux systems.

That's... just not true.

You have an SSL vulnerability, you need to patch the docker image, just like you'd have to patch a linux system.

Now you say something of substance!

Re: Ask HN: What is the actual purpose of Docker?

#115

Post by klibertp »

segmondy wrote: post #111
tinco wrote: post #55

> What's the difference between Docker and normal virtualization technology (OpenVZ/KVM)? Are there any good examples of when and where to use Docker over something like OpenVZ? Docker is exactly like OpenVZ. It became popular because they really emphasize their OpenVZ Application Templates feature, and made it much more user friendly. So users of Docker, instead of following this guide: https://openvz.org/Applicatio…

Docker and OpenVZ are not the same. Docker is single application focus. OpenVZ provides the entire OS in a container. OpenVZ has support for live migration.

> OpenVZ provides the entire OS in a container.

Docker does that, too. Actually, I'm running docker containers as a fast and easy replacement for VirtualBox VMs.

Re: Ask HN: What is the actual purpose of Docker?

#116

Post by zwischenzug »

arenaninja wrote: post #87
zwischenzug wrote: post #84

Earlier quoted context omitted.

Why? Security?

Yep. I don't understand the security implications well enough to guard against them. As much as I like cutting edge tech I prefer to not actually cut myself with it!

PM if you want to talk more.

Re: Ask HN: What is the actual purpose of Docker?

#117

Post by davexunit »

justincormack wrote: post #110
davexunit wrote: post #100

Earlier quoted context omitted.

It's unfortunate that Docker still doesn't use user namespaces.

No, they are new and have had many security issues. Just run your containers not as root, you can use capabilities if you like.

But certain namespaces cannot be created without CAP_SYS_ADMIN. Sure, you can drop privileges later, but a privilege escalation exploit in the container gives the attacker root access outside of that container, too. Sure, user namespaces have had issues, but they seem a hell of a lot safer than no isolation at all. Furthermore, user namespaces allow unprivileged users to create containers, too, which is particularly exciting.

Re: Ask HN: What is the actual purpose of Docker?

#118

Post by davexunit »

justizin wrote: post #114
davexunit wrote: post #107

Earlier quoted context omitted.

That's... just not true.

You have an SSL vulnerability, you need to patch the docker image, just like you'd have to patch a linux system. Now you say something of substance!

Docker hosts pre-built images that have known exploits in them. They also bundle insecure versions of libraries with their software: https://github.com/docker/compose/issues/1601

Re: Ask HN: What is the actual purpose of Docker?

#119

Post by dasil003 »

debaserab2 wrote: post #113
dasil003 wrote: post #106

Earlier quoted context omitted.

You're conflating the fundamental technicality and irreducible complexity of the issues that Docker is attempting to solve with the UI they are wrapping around it. It doesn't matter if you have Steve Jobs himself risen from the grave, there is no way to make Docker be as easy to understand and use as Instagram. That doesn't mean it's not a step-change if you consider the UX of Docker vs raw LXC.

I'm only pointing out that docker has some pretty big UX problems as a whole (whether or not they can reduce the complexity of them enough to actually solve them is another thing). I wouldn't bill docker's UX as it's killer feature.

Docker's UX is not a feature, it's just part of its DNA that assisted in gaining rapid mindshare, sort of like Vagrant before it, by being more approachable than older tools like OpenVZ and VirtualBox respectively.

Re: Ask HN: What is the actual purpose of Docker?

#120

Post by alextgordon »

davexunit wrote: post #97
alextgordon wrote: post #14

1. Stateless servers. Put your code and configuration in git repos, then mount them as volumes in your docker container. The absolute star feature of docker is being able to mount a file from the host to the container. You can tear down the host server, then recreate it with not much more than a `git clone` and `docker run`. 2. Precise test environment. I can mirror my entire production environment onto my laptop. No…

>The absolute star feature of docker is being able to mount a file from the host to the container. This is a simple bind-mount and isn't special at all. mount("/foo", "/container/foo", "none", MS_BIND); Also, virtual machines have had things like 9p that allow the same thing.

I don't think there is enough RAM in my laptop to run five VMs simultaneously :)
Post reply on HN