Live data from Hacker News

The Curious Case of Linux Containers

medium.com

21–27 of 27 posts

Re: The Curious Case of Linux Containers

#21
post #2

We solve all of those use cases in our cluster management system of which Docker is a key enabling component, except for point 5, though we do have other components that require multiple steps to provision. I bet we could run Hadoop if we needed it. It's easy to point at Docker and say it's a trivial wrapper around some technologies that have been around for years and call everyone crazy for buying into the 'Docker i…

I'm quite new to containers, but it seems to me that Docker revolutionizes sysadmin the same way npm revolutionizes Javascript. It's not that it magically makes your problems any easier to solve, it's that it lets you declare your solution in a formal way without unstated dependencies, and then distribute your solution in a way that lets others declare a dependency on it.

(More broadly I feel like this same thing has been happening in various parts of the IT landscape over the past few years, to the extent that their ought to be a name for it, if there isn't already?)

Re: The Curious Case of Linux Containers

#22
Are cgroups meant to be secure against malicious code trying to get out and install rootkits on the underlying system?

AFAIK, hardware-level virtualization is. If code running under Xen can get out, that's considered a bug in Xen and it gets fixed, right?

OTOH, chroot is not considered to be secure. It isn't designed to be secure. It is not a security tool. Code in a chroot jail is expected to be able to leave without subverting the security mechanisms which, by and large, don't exist in the first place.

So, are cgroups Xen or chroot?

Re: The Curious Case of Linux Containers

#23
I don't like containers for the purpose of deployment. All they do is hide complexity from DevOps people - But the complexity is still very much there. Hiding complexity from DevOps people is useful in a PaaS context, but it is an anti-pattern when you consider pretty much every other use case.

Docker encourages developers to keep adding more and more different technologies to a system. If you consider most popular applications today, they are usually made up of hundreds of different technologies - Each of which requires their own bootstrap/setup logic.

Maybe if each micro-service was made up of fewer different technologies, deployment wouldn't be such a headache and you wouldn't need Docker to begin with.

Re: The Curious Case of Linux Containers

#24
post #7

What I find curious about all the container discussions and narrative is the strange lack of context. Sure discuss Docker but also discuss namespaces, cgroups, overlayfs, aufs, and all the other critical enabling technologies where a lot of major problems with containers exist and will be solved. For instance user namespaces, cgroups are not namespace aware, how to integrate overlayfs or aufs so they can be mounted b…

Docker chooses to run containers without an init. I don't think Docker chooses one way or the other, and people do run Docker with an init: http://phusion.github.io/baseimage-docker/

My favourite is Alpine Linux with s6-overlay: https://github.com/just-containers/s6-overlay

Re: The Curious Case of Linux Containers

#25
post #22

Are cgroups meant to be secure against malicious code trying to get out and install rootkits on the underlying system? AFAIK, hardware-level virtualization is. If code running under Xen can get out, that's considered a bug in Xen and it gets fixed, right? OTOH, chroot is not considered to be secure. It isn't designed to be secure. It is not a security tool. Code in a chroot jail is expected to be able to leave withou…

Containers (which are more than just cgroups) are supposed to be secure.

In practice, the attack surface is much bigger for containers than VMs, so there are far more "break out of container" vulnerabilities out there than "break out of VM" vulnerabilities.

Most containers are run in a VM, usually one being run for you by Amazon or Google.

Re: The Curious Case of Linux Containers

#26
post #7

What I find curious about all the container discussions and narrative is the strange lack of context. Sure discuss Docker but also discuss namespaces, cgroups, overlayfs, aufs, and all the other critical enabling technologies where a lot of major problems with containers exist and will be solved. For instance user namespaces, cgroups are not namespace aware, how to integrate overlayfs or aufs so they can be mounted b…

LXC containers which have a normal init Incorrect. You can do custom application (eg. single-process) or init-based containers with LXC.

I think in discussions its useful to deal with defaults because there are always workarounds. For Docker the default is to run init less containers so you do not get a normal OS environment. For LXC the default is run init in the container so you get a container with a normal OS environment out of the box, more like a VM.

lxc-start by default will start the container's init and any apps installed with services will start with container start. lxc-start has no options or documentation I have seen that enables users to launch as a single process without starting the container init so it will be useful to share how that works.

With Docker you launch the app in the container directly from the host and if the app is a daemon for instance Nginx, you need to disable daemon mode or it won't work as there is no init process to manage background processes. So with Nginx you would need to disable daemon mode in nginx.conf or start it with 'nginx -g "Daemon off"' in Docker. In contrast with LXC you install Nginx and it will work as it would on bare metal or VMs. There is no need to think about how the app manages its processes

To run multiple processes or daemons in Docker you need to use a shell script, or use a third party process manager like supervisord for instance. The entire Docker ecosystem, and tooling is built and defined around single process containers.

A ton of problems around deployments especially for multi process apps, daemons, databases or any apps that require cron, logging, agents etc emanate here. This becomes a process in itself to know how the apps operates and then to configure it accordingly. Your deployments also become docker specific, for instance Nginx with a Wordpress stack deployed on bare metal or VM can move seamlessly to an LXC container and vice versa because they all run normal OS environments.

This can't happen with Docker and you need to re-engineer deployments. Why take on this extra load, and create incompatibility from a non standard OS environment, or worse give up the init that comes for free for for a third party process manager to do the exact same thing, only with more effort and cognitive load? This doesn't make much sense unless there is an extremely clear upside and use case.

Re: The Curious Case of Linux Containers

#27
post #26

Earlier quoted context omitted.

LXC containers which have a normal init Incorrect. You can do custom application (eg. single-process) or init-based containers with LXC.

I think in discussions its useful to deal with defaults because there are always workarounds. For Docker the default is to run init less containers so you do not get a normal OS environment. For LXC the default is run init in the container so you get a container with a normal OS environment out of the box, more like a VM. lxc-start by default will start the container's init and any apps installed with services will s…

I agree, docker is half-baked.
Post reply on HN