Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is the actual purpose of Docker?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 159 posts

Re: Ask HN: What is the actual purpose of Docker?

#61

Post by perlgeek »

caw wrote: post #30
grhmc wrote: post #23

Earlier quoted context omitted.

The problem is Vagrant + Ansible violates the rule of "build once." I don't care about the isolation for isolation sake, I care about it for the artifact sake.

How is building a Vagrant box via Ansible configuration any different than building a Docker container with a docker file? You can use both tools to build an image once and then rebuild for the updates. I don't see how the tool in any way violates that constraint. What is this rule to only build once? I can see not wanting to create multiple artifacts of your codebase, but with machines it is possible to continually…

> What is this rule to only build once?

If your cycle is "build, test, build, deploy", then you are not deploying those artifacts that you tested.

Any number of factors (different dependency version, toolchain difference, environment differences, non-reproducible builds) could lead to the second build being different from the first one, and then you deploy an untested artifact.

Not to mention that rebuild can be resource intenstive.

Re: Ask HN: What is the actual purpose of Docker?

#62

Post by hueving »

grhmc wrote: post #7

For me, it is the ultimate in the idea in Continuous Delivery of "build once." I can be very confident that the docker image I build in the first stage of my pipeline will operate correctly in production. This is because that identical image was used for unit tests, to integration and functional testing, to the staging environment and finally production. There is no difference than configuration. This is the core tha…

This was already done at the development shop I last worked at with VM images. Docker didn't do anything in particular to help this except for reducing the image size.

Re: Ask HN: What is the actual purpose of Docker?

#63

Post by hueving »

danesparza wrote: post #26

I'm stunned that nobody has brought up the idea of 'immutable architecture' -- the idea that you create an image and deploy it, and then there is no change of state after it's deployed. If you want a change to that environment, you create a new image and deploy that instead. Docker gives you the ability to version your architecture and 'roll back' to a previous version of a container.

Nobody is mentioning it because VM's already did this for more than a decade.

Re: Ask HN: What is the actual purpose of Docker?

#65

Post by mpdehaan2 »

crdoconnor wrote: post #18
grhmc wrote: post #7

For me, it is the ultimate in the idea in Continuous Delivery of "build once." I can be very confident that the docker image I build in the first stage of my pipeline will operate correctly in production. This is because that identical image was used for unit tests, to integration and functional testing, to the staging environment and finally production. There is no difference than configuration. This is the core tha…

I get this by using vagrant + ansible rather than docker. Easy to spin up or destroy the environment in the same way in a VM, staging server or live environment. I don't really see the point of lightweight virtualization. It provides an illusion of isolation which will likely come crashing down at some probably very inconvenient point (e.g. when you discover a bug caused by a different version of glibc or a different…

Vagrant + ansible is a developer environment tool. Docker is a tool around making containers redistributable for production usage.

Packer is not quite an apt comparison, but would be a better comparison, than Vagrant.

The advantage is you do the steps that could possibly fail at build time. The downside is you need to learn to get away from doing runtime configuration for upgrades.

http://michaeldehaan.net/post/118717252307/immutable-infrast...

I wrote Ansible, and I wouldn't even want to use it in Docker context to build or deploy VMs if I could just write a docker file - assumes I might not need to template anything in it, probably. I would still use Ansible to set up my "under cloud" as it were, and I might possibly use it to control upgrades (container version swapping) - until software grows to control this better (it's getting there).

However, if you were developing in an environment that also wanted to target containers, using a playbook might be a good way to have something portable between a Docker file and Vagrant if a simple shell script and the Vagrant shell provisioner wouldn't do.

I'd venture in many cases it would.

Re: Ask HN: What is the actual purpose of Docker?

#66

Post by hueving »

It serves as an amazing excuse to re-invent the wheel at your own workplace. It's a hot technology, and if you're not using it, it's because you're inept. Rip all of the stable things out that everyone knew how to use and slap containers in there! If it's not working, it's because your not using enough containers.

No security patching story at your workplace? No problem, containers don't have one either! If someone has shipped a container that embedded a vulnerable library, you better hope you can get a hold of them for a rebuild or you have to pull apart the image yourself. It's the static linking of the 21st century!

Re: Ask HN: What is the actual purpose of Docker?

#67

Post by jdoss »

SEJeff wrote: post #60
jdoss wrote: post #37

Earlier quoted context omitted.

> Docker has much wider adoption than OpenVZ does now. I don't think your statement is true at this point in time. OpenVZ is used by a ton of companies in the hosting industry and by large companies such as Groupon and smaller ones like TravisCI [1]. I would't make a statement that that Docker has a wider adoption than OpenVZ at this point in time. Maybe in five years, yes it may have a wider adoption than OpenVZ. Op…

And Docker is massively used at Groupon, so your argument isn't valid. https://engineering.groupon.com/2014/misc/dotci-and-docker/ http://www.meetup.com/Docker-Chicago/events/220936626/ Source: I work at 600 W Chicago, the Groupon World HQ, where they frequently host Docker meetups on the 6th floor.

I never said Docker wasn't used at Groupon and just because it is used in some cases, doesn't make my point any less valid. It is going to take a lot more than a few years to take over OpenVZ/Virtuozzo in market share when most of the commodity hosting industry uses it.

Re: Ask HN: What is the actual purpose of Docker?

#69

Post by jordigh »

hueving wrote: post #66

It serves as an amazing excuse to re-invent the wheel at your own workplace. It's a hot technology, and if you're not using it, it's because you're inept. Rip all of the stable things out that everyone knew how to use and slap containers in there! If it's not working, it's because your not using enough containers. No security patching story at your workplace? No problem, containers don't have one either! If someone h…

I want to downvote the first paragraph but upvote the second one.

Doesn't Docker also help cause problems like ssh private key reuse? I am sure that there are mitigations, but it's sad to have ways to prevent some activity that the software makes easy to do.

Re: Ask HN: What is the actual purpose of Docker?

#70

Post by falcolas »

odiroot wrote: post #10
grhmc wrote: post #7

For me, it is the ultimate in the idea in Continuous Delivery of "build once." I can be very confident that the docker image I build in the first stage of my pipeline will operate correctly in production. This is because that identical image was used for unit tests, to integration and functional testing, to the staging environment and finally production. There is no difference than configuration. This is the core tha…

How do you handle different configurations then? Especially if you need to provide N values (or structured data). Also, how do you manage your containers in production?

Configuration files, made available to containers as a read-only mount via the volume flag. No external network or service dependencies that way.

I'm not terribly fond of using environment variables for configuration, personally. That method requires either a startup shim or development work to make your program aware of the variables, and your container manager has to have access to all configuration values for the services it starts up.

Post reply on HN