Live data from Hacker News

WTF is a container?

techcrunch.com

161–170 of 262 posts

Re: WTF is a container?

#161
post #154

Earlier quoted context omitted.

Dynamic libraries (in the C/C++ sense) only scratch the surface. Containers give you your own file system namespace (among other namespaces), which means all of the files that make up your complicated application unit can be put together and work together in isolation, separate from the machine's main file system.

What advantages do file system namespaces have over separating by directories and users?

A big one is managing software which you didn't write: if you have two things which expect to be able to write to /etc/mydaemon.conf etc. you either need to burn a VM for each one, fork the startup scripts or take the Debian-style approach of maintaining patches which make everything configurable, or manage something like maintaining chroots directory hierarchies.

(repeat for network namespacing: it's really nice not to need to play games to have your CI server start 3 running jobs which all think they're listening on port 80)

None of that is impossible – in the case of chroot there's many years of precedent - but if you do it regularly, there's a strong appeal to automating a common pattern.

This is especially true when your goal is supporting development teams: with something like Docker, normal users don't need root just to start a daemon on a privileged port or write to a couple of files. If you work in a large or security-conscious environment, that's a fairly big draw.

(Not saying that Docker is perfect or necessarily the long-term winner in this space, only that there's a usability gap which a lot of people fall into).

Re: WTF is a container?

#162
post #82

Earlier quoted context omitted.

Docker is just overhyped deal with it. There are some nice ideas, but nothing that we couldn't or haven't seen before. FreeBSD Jails and Solaris Zones exist for more than ten years. Where they addressed many things that Docker didn't.

Can you download a BSD Jail image from an application's website, and have it 'just work'?

Don't know about BSD Jails, but you certainly could download OpenVZ images and run them.

Re: WTF is a container?

#163
post #146

Earlier quoted context omitted.

It was already clear in the late 70's and early 90's that C wasn't a reliable option to write safe systems. Dennis M. Ritchie himself on the history of the language[0] "To encourage people to pay more attention to the official language rules, to detect legal but suspicious constructions, and to help find interface mismatches undetectable with simple mechanisms for separate compilation, Steve Johnson adapted his pcc c…

Where is this mythical C++ community that promotes safe and auditable programs? Whenever I'm forced to use a C++ program it's buggier than the C equivalent.

They are here:

https://isocpp.org/

http://cppcon.org/

https://github.com/isocpp/CppCoreGuidelines/blob/master/CppC...

http://erdani.com/index.php/books/modern-c-design/

https://msdn.microsoft.com/en-us/library/hh279654.aspx

http://stroustrup.com/Tour.html

http://elementsofprogramming.com/book.html

Most of the C++ bugs I found happened to be written by former C developers that disregard using C++ stronger type safety, RAII, the standard library containers and usually use naked pointers alongside malloc() and free().

And that is the biggest problem with C++, its copy-paste compatibility with C, which allowed its adoption by C compiler vendors, but made it as safe as C when developers disregard best practices.

Re: WTF is a container?

#164
It's amazing how slow the development community en masse has been in "discovering" containers. I remember I worked for web hosting company that offered containers as a web hosting solution back in 1999, I then ran my own little host offering FreeBSD jails and then Linux containers (based on the excellent Linux-VServer project) in 2003, and I do remember how when I tried to explain to (pretty technical) people how this is way more efficient than stuff like Xen they'd go "but it's a hypervisor..." (as if that meant "magic"). I eventually gave up on it and sold my little hosting operation because it was too much work and not enough money, it looks like it was about 10 years ahead of it's time.

Re: WTF is a container?

#165
post #62

I never quite understood containers and this article makes them seem kind of similar to what OSs already do. How is a container different from just installing all the dependencies along with an application? Coming from a Windows background, this is pretty common to avoid DLL hell. Nobody distributes a Windows application that requires the user to go and install some 3rd party library before it'll work. Isolation from…

Fewer than a statically linked binary, they rely on a bunch of brand new kernel APIs.

Re: WTF is a container?

#166
The analogy in the article is inferior.

Here comes the standard HN automobile analogy.

The car makers eternally release little light weight cars that are fattened up with cruft until they're as heavy and expensive and complicated as the dinosaurs they were originally meant to replace. At which time car makers birth a new little stripped down lightweight simple compact car line. That design pattern is self similar and fractal in that even car engines and transmissions and car radios undergo a similar pattern of revolution to make something new, then evolution to slowly and methodically make it the opposite of the original goal, repeat forever. This design pattern also applies to computer architecture.

To fight the problem of hardware evolution making life pretty hard on programmers, source code compatible OS and libraries were invented that could run the same software on vaguely similar hardware, on mainframes in the late 60s at IBM and on PCs in the 70s CPM era, later extended into the "home computer" series era in the 80s, then into the msdos era. This became unwieldy and too complicated for the end users so it was replaced.

The same people implemented the idea of OS packages, again more or less in the 60s on IBM mainframes or the 80s on early unix boxes. The idea is to compile emacs to be integrated very deeply into the OS and cooperate with every other piece of software. This is contemporary. However especially in NON-FOSS it doesn't work and doesn't scale and is very expensive if not impossible to implement, being the only closed thing on an open system is a nightmare for everyone and everything involved. The stereotype in the 90s was only one service installed on one MS windows server, even if that meant it took 20 MS servers to do the job of one unix server. Anyway, expensive, complicated, hard for end users.

Again the same people implemented the idea of OS virtualization. Again, IBM mainframes in the 70s with VM, and early PC hardware experiments with TSRs and multiprocessing in the 80s to give "two computers at once". This is also contemporary, enormously more advanced today, of course. It turns out that running 50 OS kernels on a single piece of hardware is kinda wasteful although possible and cooperation gets complicated and unwieldy so time to replace again.

Again the same people implemented process jails / chroot on the BSDs and eventually after some decades linux finally caught up resulting in docker. So now your packages don't cooperate or interoperate at all with each other or the OS, which solves all the problems where the previous technology didn't work, and creates massive new problems that never existed mostly where the old technologies worked great. There are of course completely separate new problems. It turns out that a system designed to eliminate interoperability between packages interoperability a huge PITA and there are other problems that make use unwieldy and complicated, hard for end users.

Again the same people implemented (this section to be written after 2016). Maybe IOT. Maybe collapse of hardware prices faster than business demand means 20 rasp-pi cluster is cheaper and easier to maintain than a single beefy desktop running 20 virtual images or 20 docker containers. Maybe FPGA on the desktop means people will just synth up whatever matches this hours workload. Maybe cloud will finally work and no one will maintain servers anymore, it'll all be magic, or at least push the magic to someone else who now has the same old problems. Maybe SaaS means we'll all be customers and most productive software will run on internet scale clusters not individual machines, individual machines will be dumb webbrowser terminals. Who knows!

Re: WTF is a container?

#167
post #161
post #154

Earlier quoted context omitted.

What advantages do file system namespaces have over separating by directories and users?

A big one is managing software which you didn't write: if you have two things which expect to be able to write to /etc/mydaemon.conf etc. you either need to burn a VM for each one, fork the startup scripts or take the Debian-style approach of maintaining patches which make everything configurable, or manage something like maintaining chroots directory hierarchies. (repeat for network namespacing: it's really nice not…

> This is especially true when your goal is supporting development teams: with something like Docker, normal users don't need root just to start a daemon on a privileged port or write to a couple of files. If you work in a large or security-conscious environment, that's a fairly big draw.

On the contrary, any user that can run arbitrary containers (such as rootplease[0], for example) has root-level privileges on the host system.

[0] https://hub.docker.com/r/chrisfosterelli/rootplease/

Re: WTF is a container?

#168

Earlier quoted context omitted.

You entirely missed the point. AWS is not relevant. All the issues are coming from docker.

I think you missed his point. He was speaking generally about the costs of working on new tech stacks that other people just accept.

My reply is off-topic, but I cannot resist.

> I think you missed his point. He was speaking generally [..]

shawnee_ --> hackeress.com

> What is a hackeress?

> A hackeress is a female hacker.

Bad form to assume all people are males in this domain (or even the majority for that matter, regardless of the actual statistics).

Use the form "they" when referring to someone whose gender (or gender identity) is unknown to you. Or check their profiles ;)

Re: WTF is a container?

#169

Earlier quoted context omitted.

Seriously? If something crashes continuously in production then the solution is "just pass the --restart=always flag. I really wonder if you guys are really using docker in prod. I would never use something like that to manage important transactions.

Isn't this the much-lauded and respected Erlang approach to failures?

I never used Erlang, so I have no idea if it follows the same approach(although I find it quite strange). But for sure I can't afford to deploy anything like that in prod. You lose one transaction in the middle and several millions go lost. I'd rather lose an hand than try to explain my clients that it is fine, docker just restarted by itself as expected..

Re: WTF is a container?

#170
post #99

Earlier quoted context omitted.

What really surprises me about Google is why they don't open source some of these great core technologies (MapReduce, Containers etc.) instead of publishing theory as academic papers. On the one hand, it may be a great way of promoting the creating of these tools from the ground up, inspired by the theory alone. On the other hand, Google's invaluable experience with using these technologies probably means their versi…

Kubernetes: http://kubernetes.io/ Google Container Engine: https://cloud.google.com/container-engine/ Open-source MapReduce implementation: https://gigaom.com/2015/02/18/google-open-sources-a-mapreduc... https://github.com/google/mr4c

Dataflow [aka Flume]:

https://github.com/GoogleCloudPlatform/DataflowJavaSDK

http://research.google.com/pubs/pub35650.html

Post reply on HN