Ask HN: What is the actual purpose of Docker? • Hacker News Board

Re: Ask HN: What is the actual purpose of Docker?

#71

Post by shawnee_ » Tue, Jul 07, 2015, 3:22 PM UTC

Docker is a cute little tool that gives people who aren't that great at Linux the illusion that they know what they're doing. Throw in the use of some "Container" semantics and people become convinced it's that easy (and secure) to abstract away the containers from the kernel.

But it's not, at least in my experience; not to mention that as of now, anything running Docker in production (probably a bad idea) is wide open to the OpenSSL security flaw in versions of 1.0.1 and 1.0.2, despite the knowledge of this issue being out there for at least a few days.

Docker's currently "open" issue on github: https://github.com/docker/compose/issues/1601

Other references: https://mta.openssl.org/pipermail/openssl-announce/2015-July... http://blog.valbonne-consulting.com/2015/04/14/as-a-goat-im-...

Re: Ask HN: What is the actual purpose of Docker?

#72

Post by platz » Tue, Jul 07, 2015, 3:26 PM UTC

grhmc wrote: post #7

For me, it is the ultimate in the idea in Continuous Delivery of "build once." I can be very confident that the docker image I build in the first stage of my pipeline will operate correctly in production. This is because that identical image was used for unit tests, to integration and functional testing, to the staging environment and finally production. There is no difference than configuration. This is the core tha…

of course, you loose the "identical image" as soon as you build again or run the dockerfile.

Re: Ask HN: What is the actual purpose of Docker?

#73

Post by javajosh » Tue, Jul 07, 2015, 3:29 PM UTC

shawnee_ wrote: post #71

Docker is a cute little tool that gives people who aren't that great at Linux the illusion that they know what they're doing. Throw in the use of some "Container" semantics and people become convinced it's that easy (and secure) to abstract away the containers from the kernel. But it's not, at least in my experience; not to mention that as of now, anything running Docker in production (probably a bad idea) is wide op…

>Docker is a cute little tool that gives people who aren't that great at Linux the illusion that they know what they're doing.

Well, that's what I personally hoped. Then you run into problems, distro specific problems, and find yourself unable to deal with it without actually becoming great at linux under a deadline. Docker can actually introduce tremendous complexity at both the Linux and application level because you have to understand how an image was prepared in order to use it, configure it, etc. (Of course, a big part of the problem is that there's no way that I know of to interactively examine the filesystem of an image without actually running the image, and accessing the FS from the tools that the image itself runs. This has to be some sort of enormous oversight either on my part or on Docker's).

Re: Ask HN: What is the actual purpose of Docker?

#74

Post by justincormack » Tue, Jul 07, 2015, 3:31 PM UTC

jdoss wrote: post #37

justincormack wrote: post #8

OpenVZ is not upstream in the kernel; the container stuff that got merged is what Docker uses. Docker has much wider adoption than OpenVZ does now.

> Docker has much wider adoption than OpenVZ does now. I don't think your statement is true at this point in time. OpenVZ is used by a ton of companies in the hosting industry and by large companies such as Groupon and smaller ones like TravisCI [1]. I would't make a statement that that Docker has a wider adoption than OpenVZ at this point in time. Maybe in five years, yes it may have a wider adoption than OpenVZ. Op…

Travis moved to Docker after that [1]. And the "hosting industry" is not the thing it used to be since cloud.

[1] http://blog.travis-ci.com/2014-12-17-faster-builds-with-cont...

Re: Ask HN: What is the actual purpose of Docker?

#75

Post by SEJeff » Tue, Jul 07, 2015, 3:37 PM UTC

jdoss wrote: post #67

SEJeff wrote: post #60

Earlier quoted context omitted.

And Docker is massively used at Groupon, so your argument isn't valid. https://engineering.groupon.com/2014/misc/dotci-and-docker/ http://www.meetup.com/Docker-Chicago/events/220936626/ Source: I work at 600 W Chicago, the Groupon World HQ, where they frequently host Docker meetups on the 6th floor.

I never said Docker wasn't used at Groupon and just because it is used in some cases, doesn't make my point any less valid. It is going to take a lot more than a few years to take over OpenVZ/Virtuozzo in market share when most of the commodity hosting industry uses it.

FWIW: The two companies that contributed the most to the namespace code in the upstream Linux kernel (that Docker uses) were Parallels and Google, both of which know a lot about containers at Scale. For those that don't know, Parallels wrote virtuozzo.

(from linux.git):

$ git log --pretty=oneline --no-merges --author='@parallels.com' | wc -l 695

I also suspect that it won't take super long for container technologies like Docker to take over OpenVZ/Virtuozzo if not only for projects like Kubernetes, which is backed by Google, and is the basis for commercial PaaS offerings such as Openshift v3 from Redhat. Virtuozzo is great tech, but using it for a new buildout seems like a bad idea for the forseeable future. Docker is not as good, but will be soon, and is supported out of the box on every modern distribution.

Re: Ask HN: What is the actual purpose of Docker?

#76

Post by joesmo » Tue, Jul 07, 2015, 3:45 PM UTC

KaiserPro wrote: post #13

docker and openVZ aim to do the same thing. docker is a glorified chroot and cgroup wrapper. There is also a library of prebuilt docker images (think of it as a tar of a chroot) and a library of automated build instructions. The library is the most compelling part of docker. everything else is basically a question of preference. You will hear a lot about build once, deploy anywhere. whilst true in theory, your mileag…

"However if you wish to assign ip addresses to each service, docker is not really mature enough for that. Yes its possible, but not very nice. You're better off looking at KVM or vmware."

I don't understand. If you can't assign IPs to each service (or it's difficult/unreliable to do so) how can processes talk to each other and the outside world?

Re: Ask HN: What is the actual purpose of Docker?

#77

Post by cpr » Tue, Jul 07, 2015, 3:57 PM UTC

crdoconnor wrote: post #18

grhmc wrote: post #7

For me, it is the ultimate in the idea in Continuous Delivery of "build once." I can be very confident that the docker image I build in the first stage of my pipeline will operate correctly in production. This is because that identical image was used for unit tests, to integration and functional testing, to the staging environment and finally production. There is no difference than configuration. This is the core tha…

I get this by using vagrant + ansible rather than docker. Easy to spin up or destroy the environment in the same way in a VM, staging server or live environment. I don't really see the point of lightweight virtualization. It provides an illusion of isolation which will likely come crashing down at some probably very inconvenient point (e.g. when you discover a bug caused by a different version of glibc or a different…

The kernel is a concern, but I thought the libraries were container-specific.

Re: Ask HN: What is the actual purpose of Docker?

#78

Post by FireBeyond » Tue, Jul 07, 2015, 3:57 PM UTC

joesmo wrote: post #76

KaiserPro wrote: post #13

docker and openVZ aim to do the same thing. docker is a glorified chroot and cgroup wrapper. There is also a library of prebuilt docker images (think of it as a tar of a chroot) and a library of automated build instructions. The library is the most compelling part of docker. everything else is basically a question of preference. You will hear a lot about build once, deploy anywhere. whilst true in theory, your mileag…

"However if you wish to assign ip addresses to each service, docker is not really mature enough for that. Yes its possible, but not very nice. You're better off looking at KVM or vmware." I don't understand. If you can't assign IPs to each service (or it's difficult/unreliable to do so) how can processes talk to each other and the outside world?

Host / port mapping, service discovery via things like docker-discover, docker-register, or Consul, etc.

Re: Ask HN: What is the actual purpose of Docker?

#79

Post by bpicolo » Tue, Jul 07, 2015, 4:03 PM UTC

shawnee_ wrote: post #71

Docker is a cute little tool that gives people who aren't that great at Linux the illusion that they know what they're doing. Throw in the use of some "Container" semantics and people become convinced it's that easy (and secure) to abstract away the containers from the kernel. But it's not, at least in my experience; not to mention that as of now, anything running Docker in production (probably a bad idea) is wide op…

Docker and docker-compose are -not- the same thing. That does not indicate a security flaw of any sort in docker containers themselves.

Re: Ask HN: What is the actual purpose of Docker?

#80

Post by arenaninja » Tue, Jul 07, 2015, 4:05 PM UTC

zwischenzug wrote: post #33

Some key points: - Docker is nothing new - it's a packaging of pre-existing technologies (cgroups, namespaces, AUFS) into a single place - Docker has traction, ecosystem, community and support from big vendors - Docker is _very_ fast and lightweight compared to VMs in terms of provisioning, memory usage, cpu usage and disk space - Docker abstracts applications, not machines, which is good enough for many purposes Som…

Docker is indeed fast and lightweight. It's amazing how much CPU power is freed up from not running a full on VM in VirtualBox. That said, I'm wary of running it in production