Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why use Docker and what are the business cases for using it?

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 137 posts

Re: Ask HN: Why use Docker and what are the business cases for using it?

#121

Post by falcolas »

justincormack wrote: post #61
falcolas wrote: post #46

Earlier quoted context omitted.

Remember that environment variables are visible to processes outside the container (i.e. users), if they have the same or higher privileged user. They are not a great place to store passwords or any other confidential information.

The environment of a process is only available to root or the same uid.

    vagrant@monitor:/proc$ sudo -u nginx cat 1779/environ
UPSTART_INSTANCE=runlevel=2UPSTART_JOB=rcTERM=linuxPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/binRUNLEVEL=2PREVLEVEL=NUPSTART_EVENTS=runlevelPWD=/previous=N

It's not uncommon to allow users to sudo up to particular system users for commands, nor it is uncommon for compromised programs to give the attacker a shell as the user of the compromised program.

Anything owned by that user is vulnerable. A common problem which is typically resolved by reading a config file while root and downgrading to a lower privilege user. For example, you wouldn't want anyone who could become the nginx user to get the SSL key, or the password to your S3 bucket, or...

Re: Ask HN: Why use Docker and what are the business cases for using it?

#122

Post by justincormack »

falcolas wrote: post #121
justincormack wrote: post #61

Earlier quoted context omitted.

The environment of a process is only available to root or the same uid.

vagrant@monitor:/proc$ sudo -u nginx cat 1779/environ UPSTART_INSTANCE=runlevel=2UPSTART_JOB=rcTERM=linuxPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/binRUNLEVEL=2PREVLEVEL=NUPSTART_EVENTS=runlevelPWD=/previous=N It's not uncommon to allow users to sudo up to particular system users for commands, nor it is uncommon for compromised programs to give the attacker a shell as the user of the compromised p…

You do not give the nginx user sudo ability, and any user who has sudo is root, and should be treated as such.

Re: Ask HN: Why use Docker and what are the business cases for using it?

#123

Post by vosper »

osipov wrote: post #35
takeda wrote: post #23

Earlier quoted context omitted.

Great, but what are the benefits of running Docker in AWS? You are still running VMs and you are being charged for running them. With Docker you are simply putting yet another layer of complexity, because now you have to run more beefier VMs, you now have problem with network communication between containers running on different hosts. So you will most likely need to use overlay network. You also decrease resiliency,…

>what are the benefits of running Docker in AWS? I don't see benefits to running Docker in AWS. In my opinion, AWS implemented its Docker-based Container Service very poorly. I advise my customers against using AWS when want to use Docker. There are many bare metal as a service providers out in the marketplace. >the argument about running the same container in dev/test/prod Is this issue really caused by Docker becau…

Would you mind elaborating on some of the issues you see with Elastic Container Service? I'd hoped it would be something like an AWS-specific Mesos, but I haven't looked into it closely.

Re: Ask HN: Why use Docker and what are the business cases for using it?

#124

Post by irvani »

We at PeachDish use Docker and Bitbucket to scale our BeanStalk environment. Docker has helped us deploy test site much easier as one can be assured that everything needed to run the app is in the dock. It helps us build consistent environments for testing.

Re: Ask HN: Why use Docker and what are the business cases for using it?

#125

Post by justizin »

mdaniel wrote: post #112
pekk wrote: post #97

Earlier quoted context omitted.

This is also a use case for not developing on OS X, which doesn't have anything to do with production anyway.

Can you clarify? Do you mean that one should only develop upon the platform that will be used in production?

Yes, the previous commenter is a purist with no battery life on their laptop.

Further, if you're in the middle of upgrading your production OS, does this mean that you need two developer machines?

C'mon!

Re: Ask HN: Why use Docker and what are the business cases for using it?

#126

Post by jacques_chester »

rcconf wrote: post #38

My apologies if I'm hijacking the original poster. Does Docker handle multi-environment configuration management? For example: qa, stage and live have the same config files, but different values. Currently we're using Ansible and we set variables for a specific environment, then we feed those variables into config files based on where we're deploying to (config files are not duplicated, only variables that feed into…

It sounds like you're reinventing a PaaS, which is a road many people go down when they build their devops environment from the ground up.

In the long run it's a bad idea: you wind up with a snowflake PaaS that only you maintain and only you can understand or extend. The amount of engineering effort behind Heroku, Cloud Foundry or OpenShift is enormous and you can get support on a high level.

I'm biased, because I work for Pivotal (who founded Cloud Foundry), but in my view rolling your own PaaS is a strategic error at this point.

Re: Ask HN: Why use Docker and what are the business cases for using it?

#127

Post by jacques_chester »

d0m wrote: post #58

Something noting is that more and more PaaS (Platform as a service) are using docker.. so sometimes you're not making the decision as a developer to use a docker, you're just forced to use it. I'm saying this because I know docker solves a lot of pain on the devops side, but on the "software" side it's been painful all the time I've touched it. I.e. practically speaking, it makes releasing much slower, sometimes I'm…

> Something noting is that more and more PaaS (Platform as a service) are using docker

To expand on this:

* Heroku have introduced Docker-based tools to run their buildpacks outside of their staging servers,

* Cloud Foundry has, in public beta, the Diego scheduler, which can accept and manage Docker images,

* OpenShift 3 uses Docker and Kubernetes as its core components.

Disclaimer: I work for Pivotal, who founded Cloud Foundry.

Re: Ask HN: Why use Docker and what are the business cases for using it?

#128

Post by jacques_chester »

whalesalad wrote: post #91
cheald wrote: post #89

The only truly compelling case I've seen for Docker is Amazon's ECS, which takes a cluster of EC2 machines and will automatically distribute containers among them where ever there is capacity, according to declared resource needs of a given container. The ability to waste less of your EC2 resources is a very clear business win. Everything else is still nice, but it's basically "dev environments suck less".

FYI this is very similar to Mesos + Marathon. However, both feel way too verbose and painful to use. I'm very interested in seeing how Docker Swarm plays out. This ecosystem is still so raw.

> However, both feel way too verbose and painful to use

Try Lattice: http://lattice.cf/

Disclaimer, I work for Pivotal, which developed Lattice based on Cloud Foundry components.

Re: Ask HN: Why use Docker and what are the business cases for using it?

#129

Post by stevelandiss »

I consider it as a replacement for deploying applications as a virtual machine. That is, if I want to host compute and let anyone run any random program in a reproducible manner on my server, I could let them run it in docker and be done with it. So as am IT admin, I find this a useful alternative to letting people run arbitrary programs and add restrictions around it. I think this is more of an IT-OPS tool than something a developer would want to spend time with

Re: Ask HN: Why use Docker and what are the business cases for using it?

#130

Post by stevelandiss »

atsheehan wrote: post #87
lastofus wrote: post #64

Does Docker provide anything useful to someone who develops on OS X and deploys to Linux VMs (Digital Ocean, Linode, AWS)? Current setup is something like: - Develop locally (OS X) - Test deploy to local Vagrant Linux VM (provisioned by Ansible) - Deploy to staging/live Linux VM w/ Ansible (or Fabric if I'm being lazy) I've been following the Docker hype for some time now, but ever time I look into it, I couldn't fin…

An alternative to Docker is Packer ( https://packer.io/ ). It will create and register an AMI for EC2 so you don't have to run any configuration scripts once it is deployed. It's made by the same company that makes Vagrant and uses a similar setup. If you run Ansible to provision the Vagrant VM, I believe you can use the same script to provision the Packer image.

Agreed, but a docker image is lighter in weight and takes less time to deploy and consumes less resources on the target server
Post reply on HN