Live data from Hacker News

Docker 1.11: The first OCI-compliant runtime, built on containerd

blog.docker.com

41–50 of 64 posts

Re: Docker 1.11: The first OCI-compliant runtime, built on containerd

#41
> A few months ago we added the ability to sign images with hardware Yubikeys in the experimental channel of Docker. This is now available in the stable release.

I understand that you used to have to install a separate version of Docker to access this feature, but does the change in 1.11 also mean you no longer have to set the DOCKER_CONTENT_TRUST environment variable, or will that be made default at a later time?

Re: Docker 1.11: The first OCI-compliant runtime, built on containerd

#42
post #3

Standardisation at the format level will help with portability across different platform implementations.

It is standardisation of the file describing what parameters were used to build a container, ultimately every "implementation" has been a tarball of a linux filesystem which is usable with any linux container system (and possibly soon Windows).

Re: Docker 1.11: The first OCI-compliant runtime, built on containerd

#43
post #39
post #17

Earlier quoted context omitted.

If you want something stable I'd stay away from containers and use well-tested technologies like VMs and configuration management. In my experience many of the tools in the container ecosystem are in the early adopter phase, promising a lot of convenience for some use cases, but too buggy and feature incomplete to really deliver yet. Not to mention the breaking changes and occasional migration to a new tool.

Or simply use containers technology that's been around for a decade and is battle tested and stable, like FreeBSD Jails - https://www.freebsd.org/doc/handbook/jails.html Linux is not the only OS around, and Docker is not the only container technology available, that's important thing to remember.

Thing is, on top of being stable, it should be useful. If you're using containers just for your own code - fine. If you mix and match other repos and ecosystems like we and many others do, good luck with FreeBSD. 60% of the time, interesting repos already have a Dockerfile and if they don't, it's usually pretty easy to write one. With FreeBSD containers, I'd have to do all the wiring myself - if and only if it even compiles and works out of the box on a non-Linux system.

Re: Docker 1.11: The first OCI-compliant runtime, built on containerd

#44
post #39
post #17

Earlier quoted context omitted.

If you want something stable I'd stay away from containers and use well-tested technologies like VMs and configuration management. In my experience many of the tools in the container ecosystem are in the early adopter phase, promising a lot of convenience for some use cases, but too buggy and feature incomplete to really deliver yet. Not to mention the breaking changes and occasional migration to a new tool.

Or simply use containers technology that's been around for a decade and is battle tested and stable, like FreeBSD Jails - https://www.freebsd.org/doc/handbook/jails.html Linux is not the only OS around, and Docker is not the only container technology available, that's important thing to remember.

[deleted]

Re: Docker 1.11: The first OCI-compliant runtime, built on containerd

#45
post #25
post #17

Earlier quoted context omitted.

If you want something stable I'd stay away from containers and use well-tested technologies like VMs and configuration management. In my experience many of the tools in the container ecosystem are in the early adopter phase, promising a lot of convenience for some use cases, but too buggy and feature incomplete to really deliver yet. Not to mention the breaking changes and occasional migration to a new tool.

We were using docker up to about a year ago, and ripped it out for just this reason - we didn't have the time available to keep coding the workarounds. Great if you have the time, not so great if you don't.

I too had a production deploy using Docker and but droped it because of changes like this and some instability.

Started using Ansible (ok, maybe comparing oranges to apples here) and its better for my use case.

Re: Docker 1.11: The first OCI-compliant runtime, built on containerd

#46
post #34

> DNS round robin load balancing: It’s now possible to load balance between containers with Docker’s networking. If you give multiple containers the same alias, Docker’s service discovery will return the addresses of all of the containers for round-robin DNS. wait wait wait. I'm kind of new into docker world. And so far i've been struggling in understanding how to replicate a container in order to scale. For example…

> Anytime I add a new machine (e.g., web4) i've to change the conf of HAProxy and restart it. This brings down the system for a moment. (is this the right approach btw?)

You might find this story from a year ago interesting:

"True Zero Downtime HAProxy Reloads" http://engineeringblog.yelp.com/2015/04/true-zero-downtime-h...

HN discussion (with some answers from the post author): https://news.ycombinator.com/item?id=9369051

I'm curious as to how much of an actual issue you experience though. Barring an error that prevents HAproxy from starting, it should be pretty quick? Maybe not quick enough for streaming media/realtime audio-visual communication though.

Re: Docker 1.11: The first OCI-compliant runtime, built on containerd

#47
post #34

> DNS round robin load balancing: It’s now possible to load balance between containers with Docker’s networking. If you give multiple containers the same alias, Docker’s service discovery will return the addresses of all of the containers for round-robin DNS. wait wait wait. I'm kind of new into docker world. And so far i've been struggling in understanding how to replicate a container in order to scale. For example…

> (is this the right approach btw?) This is why I use hipache for load balancing / routing - it is the only solution I've found where you can change the routing or add new backends in a live system without any downtime. Here is the main problem though: Its load balancing isn't exactly smart, for example it won't keep the same client IP on the same replica, thus creating problems when a client writes something on one…

you might want to take a look at fabio:

https://github.com/eBay/fabio

Re: Docker 1.11: The first OCI-compliant runtime, built on containerd

#48

Does this mean we are now at a point where LXD/LXC & docker will play nicely with each other?

I don't see any movement towards the OCI spec by the LXC/LXD team. Canonical isn't shown on the list of members (https://www.opencontainers.org/about/members).

This answer from Mark Shuttleworth seems to sum up their position: https://answers.launchpad.net/ubuntu/+question/268502

Re: Docker 1.11: The first OCI-compliant runtime, built on containerd

#49
post #17

You know, standardization is a great thing. But, fuck, another major release with huge changes... What ever happened to stable architectures with hardening burn in periods? What new bugs are going to creep in due to these huge changes? How is this going to break our work arounds for previous versions? It's a great time to be in operations, containers are a huge step forward, but how are we supposed to be confident in…

If you want something stable I'd stay away from containers and use well-tested technologies like VMs and configuration management. In my experience many of the tools in the container ecosystem are in the early adopter phase, promising a lot of convenience for some use cases, but too buggy and feature incomplete to really deliver yet. Not to mention the breaking changes and occasional migration to a new tool.

You are mostly right but devops people should still play around with the newest tools to form their own opinions.

It's complicated.

I wouldn't stop considering containers per-se (SmartOS zones/FreeBSD jails are fine!) but the whole tooling surrounding the management of Linux containers and corresponding images is still in the "cambrian" phase. Security issues and the general over-selling of the technology (Docker and CoreOS especially are almost too good at marketing their products..) shouldn't discourage you to play around with "those toys" though. Even for certain production scenarios there is a bunch of setups which work fine already (RedHat's OpenShift platform comes to mind).

Re: Docker 1.11: The first OCI-compliant runtime, built on containerd

#50
post #34

> DNS round robin load balancing: It’s now possible to load balance between containers with Docker’s networking. If you give multiple containers the same alias, Docker’s service discovery will return the addresses of all of the containers for round-robin DNS. wait wait wait. I'm kind of new into docker world. And so far i've been struggling in understanding how to replicate a container in order to scale. For example…

You can use nginx to have zero-time redeployments without gross hacks haproxy requires to do that.
Post reply on HN