WTF is a container? • Hacker News Board

Re: WTF is a container?

#61

Post by Kubuxu » Mon, Oct 17, 2016, 9:05 AM UTC

majewsky wrote: post #54

parito wrote: post #40

Earlier quoted context omitted.

The point of the LXC is, you get a full blown standalone linux, rather than a single process - this simplifies everything a lot, meaning you don't have to have that much documentation about it in the first place.

Can you clarify what "full-blown standalone Linux" means? It sounds like running a separate kernel, but since we're talking containers rather than VMs, this can't be it.

It is shared kernel, separate userspace.

It uses: X-namespaces (network, pid, user, ...) and cgroups to separate those userspaces from each other.

I have community server running debian in which there are 10+ LXC containers running in which people are given normal root access, one container per user.

Re: WTF is a container?

#62

Post by Hondor » Mon, Oct 17, 2016, 9:06 AM UTC

I never quite understood containers and this article makes them seem kind of similar to what OSs already do.

How is a container different from just installing all the dependencies along with an application? Coming from a Windows background, this is pretty common to avoid DLL hell. Nobody distributes a Windows application that requires the user to go and install some 3rd party library before it'll work.

Isolation from each other seemed like one advantage, but that's not even security strength isolation so you can't count on it to protect the host OS from malware in a container.

A claim I often see, and that's repeated here, is that containers can run anywhere. But can they really run in any more places than an ordinary application with dependencies included, or even statically compiled into it? You still need Linux and the same CPU architecture, right?

Re: WTF is a container?

#63

Post by DasIch » Mon, Oct 17, 2016, 9:09 AM UTC

nvarsj wrote: post #45

dancek wrote: post #5

I agree that containers (both for shipping and servers) are a great idea. And because I'm tired of always configuring servers, I decided to give it a try some time ago. I wrapped my IRC client (weechat + glowing-bear) in a Docker container. Oh, not a container though, because I also needed https, which meant I needed either a mechanism to build and update letsencrypt certs in the weird format that weechat expects, or…

Docker is a poorly engineered and over-hyped technology. The concept is great - and in fact, many companies have built great tooling around Linux cgroups. It lets you efficiently binpack applications on a single server - which is why 'containers' were created in the first place. The side benefit of letting you define your OS libraries, and other things, is a nice bonus, and way overblown in my opinion. Docker and its…

I think the real problem with Docker is Docker Inc. The pressures and constraints the company is under promotes the creation of new features that can be marketed and new software that competes with products from the competition.

They have effectively no incentive on getting rid of bugs in the core product or to test features they do add exhaustively.

Sooner or later someone actually using containers will produce a docker replacement that will take over unless Docker focusses on what actually matters.

Re: WTF is a container?

#64

Post by Leynos » Mon, Oct 17, 2016, 9:11 AM UTC

nvarsj wrote: post #45

dancek wrote: post #5

I agree that containers (both for shipping and servers) are a great idea. And because I'm tired of always configuring servers, I decided to give it a try some time ago. I wrapped my IRC client (weechat + glowing-bear) in a Docker container. Oh, not a container though, because I also needed https, which meant I needed either a mechanism to build and update letsencrypt certs in the weird format that weechat expects, or…

Docker is a poorly engineered and over-hyped technology. The concept is great - and in fact, many companies have built great tooling around Linux cgroups. It lets you efficiently binpack applications on a single server - which is why 'containers' were created in the first place. The side benefit of letting you define your OS libraries, and other things, is a nice bonus, and way overblown in my opinion. Docker and its…

Deletion from registry v2 is definitely supported now. It's just a total PITA, and took them a while to implement. But I got my disc space back, so I'm not complaining. :P

Re: WTF is a container?

#65

Post by axlee » Mon, Oct 17, 2016, 9:12 AM UTC

Hondor wrote: post #62

I never quite understood containers and this article makes them seem kind of similar to what OSs already do. How is a container different from just installing all the dependencies along with an application? Coming from a Windows background, this is pretty common to avoid DLL hell. Nobody distributes a Windows application that requires the user to go and install some 3rd party library before it'll work. Isolation from…

> Nobody distributes a Windows application that requires the user to go and install some 3rd party library before it'll work.

A-hem, DirectX, VC++...?

Re: WTF is a container?

#66

Post by fenomas » Mon, Oct 17, 2016, 9:14 AM UTC

kpil wrote: post #14

fenomas wrote: post #10

I'm only a beginner, but the analogy that makes sense to me is that containers do for app deployment what npm does for Javascript development. That is, the magical part isn't that Docker simulates an operating system and so on - the magic is that it allows a chunk of logic to precisely declare its dependencies - including on other pieces of logic which declare their own dependencies - and then Docker knows how to (in…

Not really - Linux package management systems do exactly that. The magic - if there is any - is to combine it all together; separation, discovery, relatively easy packaging and dependencies.

Sure, at a different level. Package managers at the app level, docker at the deployment level, npm at the development level, or something vaguely along those lines.

I wasn't suggesting this was unique to Docker - precisely the opposite, that it's a generally useful pattern, being applied here to deployment.

Re: WTF is a container?

#67

Post by Hondor » Mon, Oct 17, 2016, 9:16 AM UTC

axlee wrote: post #65

Hondor wrote: post #62

I never quite understood containers and this article makes them seem kind of similar to what OSs already do. How is a container different from just installing all the dependencies along with an application? Coming from a Windows background, this is pretty common to avoid DLL hell. Nobody distributes a Windows application that requires the user to go and install some 3rd party library before it'll work. Isolation from…

> Nobody distributes a Windows application that requires the user to go and install some 3rd party library before it'll work. A-hem, DirectX, VC++...?

Those things are usually included in the installer, or at least downloaded on the fly so you don't notice. So it's still self-contained from the user's point of view. Yes, sometimes they're installed globally like DirectX, so that can cause yucky interactions between applications.

Re: WTF is a container?

#68

Post by raesene6 » Mon, Oct 17, 2016, 9:21 AM UTC

Hondor wrote: post #62

I never quite understood containers and this article makes them seem kind of similar to what OSs already do. How is a container different from just installing all the dependencies along with an application? Coming from a Windows background, this is pretty common to avoid DLL hell. Nobody distributes a Windows application that requires the user to go and install some 3rd party library before it'll work. Isolation from…

Containers (and especially multi container orchestration software like docker compose or Kubernetes Pods) let you describe an application that might contain multiple processes (so a really simple example could be a web server with a database backend) in a single file and have that deployed to any system that runs the containerization software.

So to that extent its more flexible than a single app. which bundles its dependencies.

The other advantage is that you're not reliant on the software vendor or OSS project to create the package, so you as a user of the application, can create your own packages with your own customization.

As to where you can run them, yep at the moment the image is tied to an OS and architecture, so either Linux or Windows depending on the Docker engine version, although there are moves afoot for Multi-arch support on the registries (https://github.com/docker/docker/issues/15866)

Re: WTF is a container?

#69

Post by vidarh » Mon, Oct 17, 2016, 9:23 AM UTC

Hondor wrote: post #62

I never quite understood containers and this article makes them seem kind of similar to what OSs already do. How is a container different from just installing all the dependencies along with an application? Coming from a Windows background, this is pretty common to avoid DLL hell. Nobody distributes a Windows application that requires the user to go and install some 3rd party library before it'll work. Isolation from…

> How is a container different from just installing all the dependencies along with an application?

Once the image is built, you can get another installation that is guaranteed to be identical. You can do that with VM images too, but you can not reasonably do that if you try to install multiple applications side by side in a single VM without further isolation - there are too many ways they can interact.

> Isolation from each other seemed like one advantage, but that's not even security strength isolation so you can't count on it to protect the host OS from malware in a container.

That's only true to the extent that they don't have a long enough track record. Many container technologies do have a decent track record when it comes to security.

But even so there are plenty of reasons for isolation in cases where the security requirements are not the primary reason for further isolation. E.g. making it impossible for an app to accidentally reading/writing files it shouldn't is in itself helpful.

> A claim I often see, and that's repeated here, is that containers can run anywhere. But can they really run in any more places than an ordinary application with dependencies included, or even statically compiled into it? You still need Linux and the same CPU architecture, right?

Try to get an application - statically compiled or not - to run across different Linux distributions, and you will see why this matters.

Needing Linux and the same CPU architecture isn't much of a limiting factor on servers. Being able to not having to account for distribution peculiarities or version differences is a big deal.

Re: WTF is a container?

#70

Post by chewchew » Mon, Oct 17, 2016, 9:25 AM UTC

parito wrote: post #39

flukus wrote: post #32

Earlier quoted context omitted.

Do you have any examples of what LXC does better than docker? I'm very new to the whole containerization thing but I've already come across a couple of the issues you've mentioned.

Shameless copypaste from well written piece by Flockport: Docker restricts the container to a single process only. The default docker baseimage OS template is not designed to support multiple applications, processes or services like init, cron, syslog, ssh etc. As we saw earlier this introduces a certain amount of complexity for day to day usage scenarios. Since current architectures, applications and services are de…

Distributed storage is still a big issue for sure. There are some options, but none are ideal. One option is to map to host and use NFS to share across hosts. Another option is to use something like Convoy or Flocker, which come with their own complexities and limitations. Hopefully more progress is made on this front.

As for the wordpress app and other issues mentioned, it's actually very simple:

    nginx:
        build: ./nginx/
        ports:
            - "80:80"
        volumes_from: 
            - php-fpm
        links:
            - php-fpm
    php-fpm:
        build: ./php-fpm/
        volumes: 
            - ${WORDPRESS_DIR}:/var/www/wordpress
        links:
            - db
    db:
        image: mysql
        environment:
            MYSQL_DATABASE: wordpress
            MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
        volumes:
        - /data/mydb:/var/lib/mysql

This isn't a "production" config, but that wouldn't look that much different. The real beauty is that I found this compose file with a simple search and very easily made minor tweaks (e.g. not publicly exposing the mysql ports).

You might run into permissions issues if you use host mounted volumes, but I have not. Normally I prefer to use named volumes (docker-compose v2) and regularly backup the volumes up to S3 using Convoy or a simple sidecar container with a mysqldump script.