Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WTF is a container?

techcrunch.com

Post reply on HN
Print view View original

51–60 of 262 posts

Re: WTF is a container?

#51

Post by chewchew »

dancek wrote: post #35
chewchew wrote: post #27

Earlier quoted context omitted.

Docker gives you the building blocks, but that means you have more pieces to arrange and manage. Take a look at Docker Compose if you haven't already, since the Docker CLI only gets you so far when you're creating apps that consist of multiple containers. I think the best approach for your cert issue is to abstract that into a separate service (nginx is an option, but I'd recommend the Rancher approach below). Yes, t…

Thanks, I'll have to look into Rancher. I'm already using Docker-compose. Also good to know about automatic restarts. I don't know how I missed that, I had to read a lot of docs to get where I am. Still, the amount of tooling that exists and the knowledge needed to pick the right ones for a given situation goes to show that this isn't as simple as packing a shipping container and letting someone ship it...

You're right, it's not quite that easy yet, but it probably will be eventually. Docker just provides the building blocks. SaaS providers like Docker Cloud will get better and continue to abstract complexity away until it really is that easy.

You don't need to use Rancher if you're just running one app. If that's all you need to do, then it could be as simple as running docker-compose on a linux server and mounting the certs into the nginx container as a host volume (https://github.com/jwilder/nginx-proxy). This is a fine approach until you want to split your containers across several hosts (redundancy or scaling) and you have several apps to worry about.

Re: WTF is a container?

#52

Post by ownagefool »

dancek wrote: post #5

I agree that containers (both for shipping and servers) are a great idea. And because I'm tired of always configuring servers, I decided to give it a try some time ago. I wrapped my IRC client (weechat + glowing-bear) in a Docker container. Oh, not a container though, because I also needed https, which meant I needed either a mechanism to build and update letsencrypt certs in the weird format that weechat expects, or…

I think the container example is actually more apt than you think.

Running out of memory is a bit like running out of space in the container.

If I dropship a container on your yard, you're going to have a container but your options in what to do with it are limited.

Now if your container has a lifecycle and a scheduler because it needs to be in China on Wednesday, you suddenly have a lot more complexity.

Docker itself being a buggy piece of crap is neither here now there in the grand scheme of things.

Re: WTF is a container?

#53

Post by majewsky »

bpizzi wrote: post #23
fenomas wrote: post #10

I'm only a beginner, but the analogy that makes sense to me is that containers do for app deployment what npm does for Javascript development. That is, the magical part isn't that Docker simulates an operating system and so on - the magic is that it allows a chunk of logic to precisely declare its dependencies - including on other pieces of logic which declare their own dependencies - and then Docker knows how to (in…

To me it's more like a lightweight virtualization: processes inside containers have no clues that there are others processes running in others containers alongside its own, all of that without eating too much memory (at least well under the amount that virtual machines would use). Added benefits: - the 'host' os can be very light and tailored to run Docker and nothing more (cf CoreOS), - we can design orchestration s…

> processes inside containers have no clues that there are others processes running in others containers alongside its own

Except, of course, if you're dealing with privileged containers. Docker [1] gives you detailed control over what to share between container and host, and what to isolate (with the default being more rather than less isolation).

For example, I'm currently working on a container that mounts disks in the host's mount namespace. In that case (and many others), the selling point of Docker [1] is not the isolation, but the deployment story.

[1] Or any other container runtime. I'm saying "Docker" because that's the one I'm familiar with.

Re: WTF is a container?

#54

Post by majewsky »

parito wrote: post #40
choxi wrote: post #25

Earlier quoted context omitted.

You're right that LXC containers have a similar API compared to Docker, but I think developers often underestimate the benefit of the community around a certain technology. Docker has significantly better documentation, extensions, package management tools, and third-party integrations. Overall, Docker has an incredibly more robust community than LXC or closer competitors like Kubernetes, and those features are just…

The point of the LXC is, you get a full blown standalone linux, rather than a single process - this simplifies everything a lot, meaning you don't have to have that much documentation about it in the first place.

Can you clarify what "full-blown standalone Linux" means? It sounds like running a separate kernel, but since we're talking containers rather than VMs, this can't be it.

Re: WTF is a container?

#55

Post by [deleted] »

parito wrote: post #40
choxi wrote: post #25

Earlier quoted context omitted.

You're right that LXC containers have a similar API compared to Docker, but I think developers often underestimate the benefit of the community around a certain technology. Docker has significantly better documentation, extensions, package management tools, and third-party integrations. Overall, Docker has an incredibly more robust community than LXC or closer competitors like Kubernetes, and those features are just…

The point of the LXC is, you get a full blown standalone linux, rather than a single process - this simplifies everything a lot, meaning you don't have to have that much documentation about it in the first place.

[deleted]

Re: WTF is a container?

#56

Post by majewsky »

parito wrote: post #39
flukus wrote: post #32

Earlier quoted context omitted.

Do you have any examples of what LXC does better than docker? I'm very new to the whole containerization thing but I've already come across a couple of the issues you've mentioned.

Shameless copypaste from well written piece by Flockport: Docker restricts the container to a single process only. The default docker baseimage OS template is not designed to support multiple applications, processes or services like init, cron, syslog, ssh etc. As we saw earlier this introduces a certain amount of complexity for day to day usage scenarios. Since current architectures, applications and services are de…

> Docker restricts the container to a single process only.

This is definitely not true. I'm running syslogd inside a container (next to the actual process) without any trouble.

> ssh

I'll take `kubectl exec` over SSH any-time because it's a much more plausible way to handle credentials. Also, it does not require an always-running daemon inside the container, which reduces the TCB and the memory footprint.

> Take a simple application like WordPress. You would need to build 3 containers that consume services from each other.

It's not required, but it's a good practice to take advantage of the capabilities of your container orchestration software of choice.

> a MySQL container plus [...] separate containers for persistent data for the Mysql DB

Why would you need a separate container for data? The thing you're looking for is a "volume" (in the simplest case just a bind-mount from the host into the container, as you even explain further down).

Re: WTF is a container?

#57

Post by majewsky »

chewchew wrote: post #11
dkarapetyan wrote: post #8

> The promise behind software containers is essentially the same. Instead of shipping around a full operating system and your software (and maybe the software that your software depends on), you simply pack your code and its dependencies into a container that can then run anywhere — and because they are usually pretty small, you can pack lots of containers onto a single computer. Already got it wrong. Current contain…

It's up to you to make your containers bloated or keep them slim. You can use the alpine versions of the official Dockerhub images. Python on Alpine is 30 MB (vs 267 MB for the debian one). https://hub.docker.com/r/library/python/tags/ You can create containers that are just a few MB with compiled languages like Go (5 MB). https://www.iron.io/microcontainers-tiny-portable-containers... From the article: "Rather than…

Alpine containers are nice if you're just looking at size. But they break down once you `docker exec` into them to try to debug something:

  $ docker exec -ti mycontainer /bin/bash
  stat /bin/bash: no such file or directory
  $ docker exec -ti mycontainer /bin/sh
  / # curl https://localhost:5000/
  /bin/sh: curl: not found
  / # strace $command
  /bin/sh: strace: not found

Re: WTF is a container?

#58

Post by ChoHag »

nvarsj wrote: post #45
dancek wrote: post #5

I agree that containers (both for shipping and servers) are a great idea. And because I'm tired of always configuring servers, I decided to give it a try some time ago. I wrapped my IRC client (weechat + glowing-bear) in a Docker container. Oh, not a container though, because I also needed https, which meant I needed either a mechanism to build and update letsencrypt certs in the weird format that weechat expects, or…

Docker is a poorly engineered and over-hyped technology. The concept is great - and in fact, many companies have built great tooling around Linux cgroups. It lets you efficiently binpack applications on a single server - which is why 'containers' were created in the first place. The side benefit of letting you define your OS libraries, and other things, is a nice bonus, and way overblown in my opinion. Docker and its…

The concept is great but it's also not original. It's called "processes". Docker is little more than a mass of complication laid atop fork+exec.

That's why nobody can get it right - because we already did.

Re: WTF is a container?

#59

Post by chewchew »

beachstartup wrote: post #34
chewchew wrote: post #27

Earlier quoted context omitted.

Docker gives you the building blocks, but that means you have more pieces to arrange and manage. Take a look at Docker Compose if you haven't already, since the Docker CLI only gets you so far when you're creating apps that consist of multiple containers. I think the best approach for your cert issue is to abstract that into a separate service (nginx is an option, but I'd recommend the Rancher approach below). Yes, t…

> but that means you have more pieces to arrange and manage wait. aren't these things supposed to give us less pieces to arrange and manage? > The problems that you're having are pretty easy to fix with some tooling yes, of course the solution is more tools. what exactly was the problem again?

> wait. aren't these things supposed to give us less pieces to arrange and manage? No, not fewer pieces. You'll have more pieces, but you can combine the pieces and control them individually or as a group. You can think of Legos, since you have many pieces but they all fit together in the same way.

Docker compose lets you group these containers together, and that is what ultimately makes it feel like you have fewer pieces to manage. With that, you can start/stop a stack of containers (e.g. django, nginx, postgres, redis) with a single command, but still inspect and manage each component separately. This is something you might normally do with bash scripts, but with Docker you can take that same app to an orchestration platform and run it on any host. Run it on your laptop, run it on a linux server, run it on a SaaS provider like Docker Cloud, run it on a private cloud with an orchestration platform.

> yes, of course the solution is more tools. what exactly was the problem again? Docker is just the foundation. Nothing more. I'm fine with learning more tools because I feel that the foundation is solid. The problem is being able to ship and manage your apps. That is much, much easier for me now and I'm very glad I invested the time.

Re: WTF is a container?

#60

Post by ChoHag »

Take an operating system. Remove all the advantages of a shared environment like dynamic libraries, package management, clarity. Stick a chroot before every fork. Boom! Containers.
Post reply on HN