Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Some questions about Docker and rkt

jvns.ca

Post reply on HN
Print view View original

31–40 of 92 posts

Re: Some questions about Docker and rkt

#31

Post by majewsky »

shriphani wrote: post #26
majewsky wrote: post #14

Earlier quoted context omitted.

In production, you usually don't want to have users running around and spawning containers anyway. You will likely have an orchestrator like Kubernetes or Mesos or Swarm, who will be running as root and spawning containers for you. Of course, that just replaces the question of "how is access to the docker daemon secured?" with "how is access to the orchestrator API secured?".

How about something that isn't spawned by an orchestrator - for instance the marathon load-balancer - they provide only a docker image which clearly is meant to be run using `docker run`

I would still run it using an orchestrator, if only to have it restart the container automatically on failure or after your node reboots.

Re: Some questions about Docker and rkt

#32

Post by inyourtenement »

omginternets wrote: post #28
inyourtenement wrote: post #27

Earlier quoted context omitted.

She wrote a blog post, put it online for ... who knows? It could be literally any reason. For her own later reference, to help crystallize her thoughts, or just for fun. Somebody else posts it to Hacker News. Dudes (always dudes!) tell her to change her writing style. Why? Why should she? Why do they care?

>Why? Why should she? Why do they care? In a word: constructive criticism Again, I thought the piece was informative. I figured I'd voice my opinion in the form of suggestions, since this is a forum for such things. Lesson learned. The only feedback one can give is positive. >dudes, always dudes What does sex/gender have to do with this? From your comment, it follows that you'd be less upset if women had commented. T…

You asked why the hate, one explanation I'm offering is that nobody appreciates your criticism on her style and tone.

I'm glad that your assumptions about my feelings feel wrong. That's because they are. I pointed out "dudes, always dudes" because it literally is always dudes. Nobody but dudes are going to jump into HN comments to complain about a woman's writing style and tone.

And since you appreciate constructive criticism, take another look at your comment: "signal-to-noise ratio is a bit high for my tastes".

Re: Some questions about Docker and rkt

#33

Post by justincormack »

lima wrote: post #24

Another issue with Docker: it does not interact well with process supervision (say systemd). The "docker run" process that you run with systemd is only a proxy for the real container process, which is started by the Docker daemon - so in reality, you have two init systems, Docker _and_ systemd. This means that many supervision features won't work (signals, seccomp, cgroups...). rkt fixes this by not having a global d…

cgroups, seccomp etc are set by docker so they do work. I think it is weird to view these as exclusively owned by the init process.

Docker works on systems without systemd (indeed, it runs on Windows), so relying on features that systemd has (currently, many are only recent additions) is not really an option.

Re: Some questions about Docker and rkt

#34

Post by inyourtenement »

benjaminwootton wrote: post #6
inopinatus wrote: post #5

Earlier quoted context omitted.

I don't think this is ranting. It reads to me more like a formatted dump of someone's evaluation notes. Some stream-of-consciousness is to be expected.

It's probably not wise to post it in that case. It's like "I bought this car and it has this engine and stuff and I have to put oil in it. I'm not sure why but why can't it just run on sunlight? And why do we need 4 wheels because I heard that bikes can travel around 2. Not exactly sure why but that must be better." Admit I'm a Docker fanboi but I don't think you can simulateously analyse and critique something when…

I can't imagine having the nerve to tell someone not to post what they want on their own blog.

Re: Some questions about Docker and rkt

#35

Post by inopinatus »

justincormack wrote: post #18

In terms of the daemon model of Docker, I guess it does look a bit complicated, and is not explained very well. In production you will do docker run -d nginx, not run it in the foreground, so the client (docker) process is not really in the picture - if you run in the foreground it is just there to stream the standard IO, and so you can kill the process with ^C from the shell. The docker daemon (dockerd) is there to…

Such structures can be hard to document with both clarity and brevity. Take a look at how Wietse Venema describes the elements of Postfix, for a nuanced masterclass in the art. http://www.postfix.org/OVERVIEW.html

Re: Some questions about Docker and rkt

#37

Post by gnufied »

I will try and answer networking question.

At scale a single host can be running may be 20 containers and port collision becomes a real problem. So imagine if a container opened a port directly on host -we have to be careful that they don't step on each other toes.

Even if all containers used some sort of contract about which port they are going to use - there are all sort of corner cases waiting to happen such as ephemeral ports(the port you bind to when you connect externally) taking over a port taken by real server app.

I have seen two approaches being used to solve this problem:

1. Using Smartstack (http://nerds.airbnb.com/smartstack-service-discovery-cloud/) the applications running inside container can run on any port but the port on which they are externally available is decided by orchestration service. Typically, no one talks to application inside container directly but they go through the haproxy configured on localhost. The advantage is - smartstack can remove a service if it is failing healthcheck etc.

2. The kubernetes/openshift approach of Software defined networking(https://github.com/coreos/flannel). Although they also integrate with load balancers, so that is not the only way.

I know if someone is just getting started with containers, it seems bit overwhelming to digest all this. But having worked in some large companies which are using containers at scale, it kinda makes sense.

Re: Some questions about Docker and rkt

#38

Post by kraftman »

Maybe Docker networking gets more complicated later on but for what I do with it I find it pretty easy and useful. Docker compose makes it pretty simple to control which ports get exposed on the host and which are limited the the docker network.

Re: Some questions about Docker and rkt

#39

Post by zaphar »

benjaminwootton wrote: post #6
inopinatus wrote: post #5

Earlier quoted context omitted.

I don't think this is ranting. It reads to me more like a formatted dump of someone's evaluation notes. Some stream-of-consciousness is to be expected.

It's probably not wise to post it in that case. It's like "I bought this car and it has this engine and stuff and I have to put oil in it. I'm not sure why but why can't it just run on sunlight? And why do we need 4 wheels because I heard that bikes can travel around 2. Not exactly sure why but that must be better." Admit I'm a Docker fanboi but I don't think you can simulateously analyse and critique something when…

Docker is still pretty new. If you were the owner of a horse and someone was trying to sell you one of those new fangled cars you would have a bunch of questions about why exactly this car is better than your horse. And should you be going with the cheaper Ford? or one of the more expensive models?

She's not writing a critique she's asking questions about tradeoffs from the viewpoint of someone who doesn't know the answers.

Re: Some questions about Docker and rkt

#40

Post by Karunamon »

inyourtenement wrote: post #27
omginternets wrote: post #17

Earlier quoted context omitted.

I agree. The content is most definitely there and I learned a few things, but the signal-to-noise ratio is a bit high for my tastes. The "like"s and whatnot are distracting, I find. I would humbly suggest that Julia work on her writing style. She's in a good position to do so: there's stuff to be said and now it's just a question of tweaking the manner in which it's said. Edit: why the hate? I didn't think I was bein…

She wrote a blog post, put it online for ... who knows? It could be literally any reason. For her own later reference, to help crystallize her thoughts, or just for fun. Somebody else posts it to Hacker News. Dudes (always dudes!) tell her to change her writing style. Why? Why should she? Why do they care?

Is the sexism really necessary?
Post reply on HN