Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WTF is a container?

techcrunch.com

Post reply on HN
Print view View original

141–150 of 262 posts

Re: WTF is a container?

#141

Post by nine_k »

nvarsj wrote: post #45
dancek wrote: post #5

I agree that containers (both for shipping and servers) are a great idea. And because I'm tired of always configuring servers, I decided to give it a try some time ago. I wrapped my IRC client (weechat + glowing-bear) in a Docker container. Oh, not a container though, because I also needed https, which meant I needed either a mechanism to build and update letsencrypt certs in the weird format that weechat expects, or…

Docker is a poorly engineered and over-hyped technology. The concept is great - and in fact, many companies have built great tooling around Linux cgroups. It lets you efficiently binpack applications on a single server - which is why 'containers' were created in the first place. The side benefit of letting you define your OS libraries, and other things, is a nice bonus, and way overblown in my opinion. Docker and its…

Ok, throw Docker away.

Did anybody have better experience with e.g. Rkt?

Re: WTF is a container?

#142

Post by sidlls »

saji13 wrote: post #86
pjmlp wrote: post #74

Earlier quoted context omitted.

As others say Docker is probably over-hyped technology. However, I do see it as positive, because its hype, regardless if good or not, has created the traction for Go and OCaml on the data center, thus eventually leading to less C code for such use cases. So hype or not, maybe we do get some security improvements on the overall stack.

Out of curiosity, why is less C code a good thing?

There are legitimate reasons to not want to use C, but I find around here it's mainly reflexive hate and language zealotry.

It's popular to hate on C (and C++) because the languages are so ubiquitous and long-used that a large body of terrible, unsecure, and poorly written code exists using them. Other languages haven't had the same success as these two yet, so haven't had their warts exposed enough to be dumped in the "automatically hated" category. Java comes close, but it also is typically lumped in the "automatically hate it" bucket and for similar reasons.

Re: WTF is a container?

#143

Post by AlexB138 »

user5994461 wrote: post #140
shawnee_ wrote: post #133

Earlier quoted context omitted.

Trying to debug why our app in the container isn't working is not fun at all. My experience with AWS was similar, and I got to a point where I had to stop accepting clients who had built (or insisted on building) their infrastructure on AWS. It actually kind of reminds me of a pyramid scheme where they ensnare you with a seemingly good deal, but in order to get that you've gotta buy in just a little (time, cost, etc)…

You entirely missed the point. AWS is not relevant. All the issues are coming from docker.

I think you missed his point. He was speaking generally about the costs of working on new tech stacks that other people just accept.

Re: WTF is a container?

#144

Post by happyslobro »

Azeralthefallen wrote: post #101

I remember going to AWS Reinvent last year and having some beers with a bunch of people who did devops. We started talking about tools, and they were utterly flabbergasted, that we had not embraced docker. They went on an on about how simple docker made HA, and handling fail overs/maintenance. More or less made it seem like it was the greatest thing since sliced bread. Me and a few coworkers decided to try and docker…

We have similar stories. We even brought in a devops consulting firm, who insisted on a pure AWS / Docker (ECS & co) stack. After a couple months of shocks, crises and occasional all-nighters, I just started deploying backup instances on Heroku, so that the QA and design teams wouldn't get blocked by the weekly clusterforks. After a few weeks of smooth sailing on that front, we just activated logging and auto scaling addons, and blessed the Heroku stack with the production domain name and CDN.

Heroku gets expensive quickly at scale, but the engineering required to make "the future" work on AWS was unmeasurable (because it never really succeeded for us).

I don't even know what to blame for the whole episode. Docker's incomplete architecture (2015)? AWS's inability to abstract and manage complexity into something that just works as described on their product pages? The consultants? Myself, for putting faith in that triad of unfamiliar but crucial people, services and products? Whatever, it's no longer a current problem for me.

Re: WTF is a container?

#145

Post by jjnoakes »

ChoHag wrote: post #58
nvarsj wrote: post #45

Earlier quoted context omitted.

Docker is a poorly engineered and over-hyped technology. The concept is great - and in fact, many companies have built great tooling around Linux cgroups. It lets you efficiently binpack applications on a single server - which is why 'containers' were created in the first place. The side benefit of letting you define your OS libraries, and other things, is a nice bonus, and way overblown in my opinion. Docker and its…

The concept is great but it's also not original. It's called "processes". Docker is little more than a mass of complication laid atop fork+exec. That's why nobody can get it right - because we already did.

How is "your own network, your own view of the file system, your own view of the process table, your own view of the user IDs, ..." the same as "processes"?

Re: WTF is a container?

#146

Post by pjmlp »

sidlls wrote: post #142
saji13 wrote: post #86

Earlier quoted context omitted.

Out of curiosity, why is less C code a good thing?

There are legitimate reasons to not want to use C, but I find around here it's mainly reflexive hate and language zealotry. It's popular to hate on C (and C++) because the languages are so ubiquitous and long-used that a large body of terrible, unsecure, and poorly written code exists using them. Other languages haven't had the same success as these two yet, so haven't had their warts exposed enough to be dumped in t…

It was already clear in the late 70's and early 90's that C wasn't a reliable option to write safe systems.

Dennis M. Ritchie himself on the history of the language[0]

"To encourage people to pay more attention to the official language rules, to detect legal but suspicious constructions, and to help find interface mismatches undetectable with simple mechanisms for separate compilation, Steve Johnson adapted his pcc compiler to produce lint [Johnson 79b], which scanned a set of files and remarked on dubious constructions."

Lint which is still mostly ignored by the masses to this day. At CppCon 2015, about 1% of the audience acknowledge using static analyzers.

Per Brinch Hansen letter to C.A.R. Hoare in 1993a [1]

"The 1980s will probably be remembered as the decade in which programmers took a gigantic step backwards by switching from secure Pascal-like languages to insecure C-like languages. I have no rational explanation for this trend. But it seems to me that if computer programmers cannot even agree that security is an essential requirement of any programming language, then we have not yet established a discipline of computing based on commonly accepted principles."

There are many other sources of similar statements since C exists, so the hate isn't something new.

Regarding C++, yes unfortunately it inherits C flaws, but at least the community tends to embrace language features to improve the language safety and push for type based programming.

[0] https://www.bell-labs.com/usr/dmr/www/chist.html

[1] brinch-hansen.net/papers/1999b.pdf

Re: WTF is a container?

#147

Post by LgWoodenBadger »

tigershark wrote: post #130
chewchew wrote: post #27

Earlier quoted context omitted.

Docker gives you the building blocks, but that means you have more pieces to arrange and manage. Take a look at Docker Compose if you haven't already, since the Docker CLI only gets you so far when you're creating apps that consist of multiple containers. I think the best approach for your cert issue is to abstract that into a separate service (nginx is an option, but I'd recommend the Rancher approach below). Yes, t…

Seriously? If something crashes continuously in production then the solution is "just pass the --restart=always flag. I really wonder if you guys are really using docker in prod. I would never use something like that to manage important transactions.

Isn't this the much-lauded and respected Erlang approach to failures?

Re: WTF is a container?

#148

Post by jjnoakes »

IshKebab wrote: post #87
ChoHag wrote: post #58

Earlier quoted context omitted.

The concept is great but it's also not original. It's called "processes". Docker is little more than a mass of complication laid atop fork+exec. That's why nobody can get it right - because we already did.

I totally agree. The real issue is dynamic libraries and how hard it is to compile C/C++ code statically with GCC. If you could just pass `-static` to gcc and it actually worked like you expect this would never have happened. Fortunately that seems to be changing somewhat. Go is totally static, and Rust can easily be made totally static using muscl. You can even do totally static C/C++ apps fairly easily with muscl.

Dynamic libraries (in the C/C++ sense) only scratch the surface. Containers give you your own file system namespace (among other namespaces), which means all of the files that make up your complicated application unit can be put together and work together in isolation, separate from the machine's main file system.

Re: WTF is a container?

#149

Post by technofiend »

vacri wrote: post #82
Philipp__ wrote: post #49

Earlier quoted context omitted.

Docker is just overhyped deal with it. There are some nice ideas, but nothing that we couldn't or haven't seen before. FreeBSD Jails and Solaris Zones exist for more than ten years. Where they addressed many things that Docker didn't.

Can you download a BSD Jail image from an application's website, and have it 'just work'?

I work for a Fortune 50. I can't just download anything. When some third party curates a store of containers and guarantees their safety then maybe. Until then docker, rkt and the rest are a distant dream.
Post reply on HN