Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Some questions about Docker and rkt

jvns.ca

Post reply on HN
Print view View original

11–20 of 92 posts

Re: Some questions about Docker and rkt

#11

Post by rkachowski »

benjaminwootton wrote: post #6
inopinatus wrote: post #5

Earlier quoted context omitted.

I don't think this is ranting. It reads to me more like a formatted dump of someone's evaluation notes. Some stream-of-consciousness is to be expected.

It's probably not wise to post it in that case. It's like "I bought this car and it has this engine and stuff and I have to put oil in it. I'm not sure why but why can't it just run on sunlight? And why do we need 4 wheels because I heard that bikes can travel around 2. Not exactly sure why but that must be better." Admit I'm a Docker fanboi but I don't think you can simulateously analyse and critique something when…

I understand that it can come off like that, but from reading the rest of her articles you can tell these kind of questions arise from sincerity and not some kind of conceited dismissal.

This kind of approach is really useful for someone coming in with zero prior knowledge of the situation - these are the exact questions you'd ask if you were oblivious to the subject. Something like "I don't understand what the Docker daemon is for" isn't meant to dismiss the daemon, but just sincerely pointing out that she doesn't understand what it's for.

I feel posting articles like this is a good way to move forward in learning something. When learning something and writing about it exposing your ignorance directly rather than posturing puts you in a good position. Less knowledgable readers know to take this point into consideration, and more knowledgable (or angry) readers may point out the errors in your statements.

Being proved wrong is a great way to learn more, as long as one can accept it without taking it personally (hence pointing out unknowns in the post). And as being proved wrong is a luxury that doesn't really exist in the programming world outside of education, exposing your views to the community is an important way to learn from others.

Re: Some questions about Docker and rkt

#12

Post by _wp_ »

benjaminwootton wrote: post #6
inopinatus wrote: post #5

Earlier quoted context omitted.

I don't think this is ranting. It reads to me more like a formatted dump of someone's evaluation notes. Some stream-of-consciousness is to be expected.

It's probably not wise to post it in that case. It's like "I bought this car and it has this engine and stuff and I have to put oil in it. I'm not sure why but why can't it just run on sunlight? And why do we need 4 wheels because I heard that bikes can travel around 2. Not exactly sure why but that must be better." Admit I'm a Docker fanboi but I don't think you can simulateously analyse and critique something when…

I don't think that's particularly fair on Julia. I have found her posts very useful, even the ones written in this style. Documenting her journey from newbie to proficiency is very useful to others wanting to learn the topic in question as they can relate to the questions in posts like these and see whether she found answers later on in her archive.

Re: Some questions about Docker and rkt

#13

Post by majewsky »

benjaminwootton wrote: post #6
inopinatus wrote: post #5

Earlier quoted context omitted.

I don't think this is ranting. It reads to me more like a formatted dump of someone's evaluation notes. Some stream-of-consciousness is to be expected.

It's probably not wise to post it in that case. It's like "I bought this car and it has this engine and stuff and I have to put oil in it. I'm not sure why but why can't it just run on sunlight? And why do we need 4 wheels because I heard that bikes can travel around 2. Not exactly sure why but that must be better." Admit I'm a Docker fanboi but I don't think you can simulateously analyse and critique something when…

But these are exactly the questions that I want answered. Much too often I have people talking about certain parts of a system that are so far above my current understanding that I'm too intimidated to jump in and ask "But why ?".

Re: Some questions about Docker and rkt

#14

Post by majewsky »

shriphani wrote: post #9

While this thread has visibility, I am curious about your typical security model with docker. From my experience, whoever is running docker seems to be able to run root commands on the host [1]. So any best practices for running docker ? [1] http://reventlov.com/advisories/using-the-docker-command-to-...

In production, you usually don't want to have users running around and spawning containers anyway. You will likely have an orchestrator like Kubernetes or Mesos or Swarm, who will be running as root and spawning containers for you.

Of course, that just replaces the question of "how is access to the docker daemon secured?" with "how is access to the orchestrator API secured?".

Re: Some questions about Docker and rkt

#16

Post by r4um »

shriphani wrote: post #9

While this thread has visibility, I am curious about your typical security model with docker. From my experience, whoever is running docker seems to be able to run root commands on the host [1]. So any best practices for running docker ? [1] http://reventlov.com/advisories/using-the-docker-command-to-...

Other security controls aside, for the user thing we make it mandatory to have USER directive in the Dockerfile, else the docker builds fail.

Re: Some questions about Docker and rkt

#17

Post by omginternets »

mtrycz wrote: post #2

While the info is kinda useful, the writing style reminds me of Stan, the salesman of Monkey Island.

I agree. The content is most definitely there and I learned a few things, but the signal-to-noise ratio is a bit high for my tastes. The "like"s and whatnot are distracting, I find.

I would humbly suggest that Julia work on her writing style. She's in a good position to do so: there's stuff to be said and now it's just a question of tweaking the manner in which it's said.

Edit: why the hate? I didn't think I was being a jerk...

Re: Some questions about Docker and rkt

#18

Post by justincormack »

In terms of the daemon model of Docker, I guess it does look a bit complicated, and is not explained very well.

In production you will do docker run -d nginx, not run it in the foreground, so the client (docker) process is not really in the picture - if you run in the foreground it is just there to stream the standard IO, and so you can kill the process with ^C from the shell.

The docker daemon (dockerd) is there to listen for new requests, but since 1.11 it no longer runs containers. Since 1.12 you can restart it without killing your containers (with the right config option) see https://docs.docker.com/engine/admin/live-restore/ so you can eg do a daemon upgrade without downtime. It is still handling some things, eg logs, so it is best if it does restart.

The process that actually runs containers is containerd. This is a very simple daemon with a grpc socket interface. That uses runc (the OCI standard runner) but that does not stay running, only a small process called containerd-shim does, which is there to act as a parent for the actual container process, so that containerd can be restarted.

You can use containerd as a runtime, with runc containers, but runc is not that user friendly. You can use https://github.com/jfrazelle/riddler to get something you can run from a docker container. You could also use runc from systemd if you want. However runc doesnt do a lot of setup, eg the layered filesystem handling is all part of how dockerd sets things up for runc, so you would have to do that yourself if you dont want to waste a lot of disk space.

It does sound a bit complicated, but it is just separation of concerns and breaking up the once monolithic docker binary into a client and a set of servers that all do smaller tasks and which can be restarted independently.

Re: Some questions about Docker and rkt

#19

Post by justincormack »

shriphani wrote: post #9

While this thread has visibility, I am curious about your typical security model with docker. From my experience, whoever is running docker seems to be able to run root commands on the host [1]. So any best practices for running docker ? [1] http://reventlov.com/advisories/using-the-docker-command-to-...

You can use authorization plugins to control what commands are allowed.

However generally you don't give people access to run any docker command in production, you have some system that lets them deploy containers with predetermined settings, which don't include being able to set --privileged or add capabilities or change security policies.

Re: Some questions about Docker and rkt

#20

Post by pawadu »

rmchugh wrote: post #8
mtrycz wrote: post #2

While the info is kinda useful, the writing style reminds me of Stan, the salesman of Monkey Island.

Personally, I really like her writing style. She's very honest about the things she doesn't know, which I find a lot easier to relate to than blogposts by some random internet gurus. Behind the self-deprecation she has a lot of really interesting things to say and is really enthusiastic about learning new technologies. Her full archive is well worth reading.

Dear god, this a thousand times.
Post reply on HN