Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is the actual purpose of Docker?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 159 posts

Re: Ask HN: What is the actual purpose of Docker?

#91

Post by davexunit »

jordigh wrote: post #69
hueving wrote: post #66

It serves as an amazing excuse to re-invent the wheel at your own workplace. It's a hot technology, and if you're not using it, it's because you're inept. Rip all of the stable things out that everyone knew how to use and slap containers in there! If it's not working, it's because your not using enough containers. No security patching story at your workplace? No problem, containers don't have one either! If someone h…

I want to downvote the first paragraph but upvote the second one. Doesn't Docker also help cause problems like ssh private key reuse? I am sure that there are mitigations, but it's sad to have ways to prevent some activity that the software makes easy to do.

>I want to downvote the first paragraph but upvote the second one.

I had the very same feeling. Containers are very useful, but the Docker suite of tools just don't have a very good security story.

Re: Ask HN: What is the actual purpose of Docker?

#92

Post by hosh »

hueving wrote: post #63
danesparza wrote: post #26

I'm stunned that nobody has brought up the idea of 'immutable architecture' -- the idea that you create an image and deploy it, and then there is no change of state after it's deployed. If you want a change to that environment, you create a new image and deploy that instead. Docker gives you the ability to version your architecture and 'roll back' to a previous version of a container.

Nobody is mentioning it because VM's already did this for more than a decade.

This isn't true.

The way VMs handle this doesn't carry the same semantics as the way you can with Docker. There's a finer-grain composability with Docker that is much more awkward with VMs.

Docker may not be as great as a virtualization tool as VMs -- security concerns, complexity, etc. -- but it is a much better package management tool.

Re: Ask HN: What is the actual purpose of Docker?

#93

Post by hosh »

zwischenzug wrote: post #33

Some key points: - Docker is nothing new - it's a packaging of pre-existing technologies (cgroups, namespaces, AUFS) into a single place - Docker has traction, ecosystem, community and support from big vendors - Docker is _very_ fast and lightweight compared to VMs in terms of provisioning, memory usage, cpu usage and disk space - Docker abstracts applications, not machines, which is good enough for many purposes Som…

Yes, packaging is a big deal!

Re: Ask HN: What is the actual purpose of Docker?

#94

Post by yellowapple »

juliangregorian wrote: post #86
shawnee_ wrote: post #71

Docker is a cute little tool that gives people who aren't that great at Linux the illusion that they know what they're doing. Throw in the use of some "Container" semantics and people become convinced it's that easy (and secure) to abstract away the containers from the kernel. But it's not, at least in my experience; not to mention that as of now, anything running Docker in production (probably a bad idea) is wide op…

Fine, I'll bite: what non-cute tool do big boys who are "great at Linux" and do know what they're doing use?

In my experience (as one of those "big boys"), it's usually more traditional virtualization, typically on top of a bare-metal hypervisor like Xen (nowadays via Amazon EC2, though there are plenty of bigger companies that run their own Xen hosts), ESXi, SmartOS, or something similar. Even more recent is the use of "operating systems" dedicated to a particular language or runtime; Ling (Erlang on Xen) is an excellent example of this.

On one hand, this tends to offer a slightly stronger assurance against Linux-level security faults while also enabling the use of non-Linux stacks (such as BSD or Solaris or - God forbid - Windows, along with just-enough-OS (or no OS whatsoever)). Proper virtualization like this offers another layer of security, and it's generally perceived to be a stronger one.

On the other hand, the security benefits provided on an OS level (since now even an OS-level compromise won't affect the security of the whole system, at least not immediately) are now shunted over to the hypervisor. Additionally, the fuller virtualization incurs a slight performance penalty in some cases, and certainly includes the overhead of running the VM.

On the third hand, bare-metal hypervisors tend to be very similar to microkernels in terms of technical simplicity and compactness, thus gaining many of the inherent security/auditing advantages of a microkernel over a monolithic kernel. Additionally, in many (arguably most) environments, the slight degradation of performance (which isn't even guaranteed, mind you) is often much more tolerable than the risk of an OS-level bug compromising whole hosts, even if the risk of hypervisor-level bugs still exists.

Re: Ask HN: What is the actual purpose of Docker?

#95

Post by debaserab2 »

dasil003 wrote: post #83
shawnee_ wrote: post #71

Docker is a cute little tool that gives people who aren't that great at Linux the illusion that they know what they're doing. Throw in the use of some "Container" semantics and people become convinced it's that easy (and secure) to abstract away the containers from the kernel. But it's not, at least in my experience; not to mention that as of now, anything running Docker in production (probably a bad idea) is wide op…

> Docker is a cute little tool that gives people who aren't that great at Linux the illusion that they know what they're doing. That's a rather embittered perspective, ironic considering how new Linux is in the grand scheme of things. A more germane perspective is that Docker is a new tool which acknowledges that UX matters even for system tools.

I'm not sure if I agree that the UX of docker is all that great if you're inferring that docker somehow is more intuitive or easier to understand. The sheer amount of confusion from so many people out there about what docker does is evidence to that.

Re: Ask HN: What is the actual purpose of Docker?

#96

Post by JustSomeNobody »

KaiserPro wrote: post #13

docker and openVZ aim to do the same thing. docker is a glorified chroot and cgroup wrapper. There is also a library of prebuilt docker images (think of it as a tar of a chroot) and a library of automated build instructions. The library is the most compelling part of docker. everything else is basically a question of preference. You will hear a lot about build once, deploy anywhere. whilst true in theory, your mileag…

On OpenVZ, I can edit /etc/network/interfaces for each CT and can assign a static IP, for one example. Can I not do that for Docker? Sorry if this is naive, I don't know much of anything about Docker.

Re: Ask HN: What is the actual purpose of Docker?

#97

Post by davexunit »

alextgordon wrote: post #14

1. Stateless servers. Put your code and configuration in git repos, then mount them as volumes in your docker container. The absolute star feature of docker is being able to mount a file from the host to the container. You can tear down the host server, then recreate it with not much more than a `git clone` and `docker run`. 2. Precise test environment. I can mirror my entire production environment onto my laptop. No…

>The absolute star feature of docker is being able to mount a file from the host to the container.

This is a simple bind-mount and isn't special at all.

    mount("/foo", "/container/foo", "none", MS_BIND);
Also, virtual machines have had things like 9p that allow the same thing.

Re: Ask HN: What is the actual purpose of Docker?

#98

Post by xorcist »

juliangregorian wrote: post #86
shawnee_ wrote: post #71

Docker is a cute little tool that gives people who aren't that great at Linux the illusion that they know what they're doing. Throw in the use of some "Container" semantics and people become convinced it's that easy (and secure) to abstract away the containers from the kernel. But it's not, at least in my experience; not to mention that as of now, anything running Docker in production (probably a bad idea) is wide op…

Fine, I'll bite: what non-cute tool do big boys who are "great at Linux" and do know what they're doing use?

It depends on what you want to do, of course, but the standard tools for software packaging is deb and rpm.

The management tools are fairly decent, and the question "which CVEs are we vulnerable to our production environment" or "were are we still using Java 6" shouldn't be more than a keypress away.

Neither deb/rpm nor containers are an excuse for not using configuration management tools however. Don't believe anyone who says so.

Re: Ask HN: What is the actual purpose of Docker?

#99

Post by davexunit »

crdoconnor wrote: post #53
grhmc wrote: post #38

Earlier quoted context omitted.

> How is building a Vagrant box via Ansible configuration any different than building a Docker container with a docker file? Unless you're snapshotting that vagrant box and then deploying that to all your servers somehow, you are building multiple times. > What is this rule to only build once? I'd recommend reading the book Continuous Delivery. It is a fantastically helpful read. I prefer not to update my machines, b…

>Unless you're snapshotting that vagrant box and then deploying that to all your servers somehow, you are building multiple times. You're also configuring many things in many different potentially complex ways. The docker method of using environment variables as a configuration hack to get around this is pretty horrible, IMHO. Especially compared to ansible's YAML/jinja2 configuration.

>Especially compared to ansible's YAML/jinja2 configuration.

YAML/jinja2 is just terrible. When you have to introduce a templating system to programmatically generate your YAML configuration files, what you have really needed the whole time is an actual programming language.

Post reply on HN