Plain and simple: containers violate the KISS principal. While you are developing reams of domain knowledge working with this turd of a technology, others are making progress with non-self-created problems that matter in the real world. This is another case of the tech world developing pointless tech that can be ignored by those solving concrete real world problems.
WTF is a container?
171–180 of 262 posts
Re: WTF is a container?
#172Earlier quoted context omitted.
I think you missed his point. He was speaking generally about the costs of working on new tech stacks that other people just accept.
My reply is off-topic, but I cannot resist. > I think you missed his point. He was speaking generally [..] shawnee_ --> hackeress.com > What is a hackeress? > A hackeress is a female hacker. Bad form to assume all people are males in this domain (or even the majority for that matter, regardless of the actual statistics). Use the form "they" when referring to someone whose gender (or gender identity) is unknown to you…
I think the assumption arose not from the demographic of people on Hacker News, but from the username of that poster. "Shawn" is a fairly common name, where one in every 2000 people will be named it. [1]
Meanwhile, "Shawnee" is a really rare name[2], one you may not be aware of if you didn't grow up in the US (or in particular parts thereof). (Apparently only 4000 of them are alive today!)
Just as an aside, using "they" by default can be very confusing, especially when plurals are involved. I use it sometimes, but prefer to use the passive voice instead ("the parent poster", etc.) I definitely do not have time to check every person's profile when I comment on HN.
1: http://www.wolframalpha.com/input/?i=shawn
2: http://www.wolframalpha.com/input/?i=shawnee&rawformassumpti...
Re: WTF is a container?
#173Earlier quoted context omitted.
Docker is just overhyped deal with it. There are some nice ideas, but nothing that we couldn't or haven't seen before. FreeBSD Jails and Solaris Zones exist for more than ten years. Where they addressed many things that Docker didn't.
Can you download a BSD Jail image from an application's website, and have it 'just work'?
it's called curlbashism.
Re: WTF is a container?
#174Earlier quoted context omitted.
Same here with docker. The ideas are nice as an application, but it's just a pain in the ass. LXC on the other hand is a breeze.
Does LXC provide a way to automatically create new working instances (like a Dockerfile / docker-compose.yml)? I'm not quite grokking LXC in my first 10 minutes of reading...
man lxc.conf ... this is your dockerfile equivalent.
Re: WTF is a container?
#175It's amazing how slow the development community en masse has been in "discovering" containers. I remember I worked for web hosting company that offered containers as a web hosting solution back in 1999, I then ran my own little host offering FreeBSD jails and then Linux containers (based on the excellent Linux-VServer project) in 2003, and I do remember how when I tried to explain to (pretty technical) people how thi…
I think the same, i've been deploying containers or things that look like today's containers for the past 12 years, i even did a tool that manages containers with lxc that really look like docker, but 3 years before.
Re: WTF is a container?
#176Earlier quoted context omitted.
My reply is off-topic, but I cannot resist. > I think you missed his point. He was speaking generally [..] shawnee_ --> hackeress.com > What is a hackeress? > A hackeress is a female hacker. Bad form to assume all people are males in this domain (or even the majority for that matter, regardless of the actual statistics). Use the form "they" when referring to someone whose gender (or gender identity) is unknown to you…
I think the assumption arose not from the demographic of people on Hacker News, but from the username of that poster. "Shawn" is a fairly common name, where one in every 2000 people will be named it. [1] Meanwhile, "Shawnee" is a really rare name[2], one you may not be aware of if you didn't grow up in the US (or in particular parts thereof). (Apparently only 4000 of them are alive today!) Just as an aside, using "th…
Thanks for pointing out where the name confusion may have come from.
> I definitely do not have time to check every person's profile when I comment on HN.
At least then we should not make explicit such gender assumptions, regardless.
I have never heard the name "Shawnee" and generally do not assume usernames on web forums are indicative of real-life anything (e.g. you are 'striking', but apparently that is not your name).
I agree 'they' is an awkward construction in English, but for many people the alternative using passive voice is a little more complex to use (cf. non-native English speakers).
Re: WTF is a container?
#177Earlier quoted context omitted.
A big one is managing software which you didn't write: if you have two things which expect to be able to write to /etc/mydaemon.conf etc. you either need to burn a VM for each one, fork the startup scripts or take the Debian-style approach of maintaining patches which make everything configurable, or manage something like maintaining chroots directory hierarchies. (repeat for network namespacing: it's really nice not…
> This is especially true when your goal is supporting development teams: with something like Docker, normal users don't need root just to start a daemon on a privileged port or write to a couple of files. If you work in a large or security-conscious environment, that's a fairly big draw. On the contrary, any user that can run arbitrary containers (such as rootplease[0], for example) has root-level privileges on the…
What I was thinking about wasn't protecting against outright malice but rather mistakes and errors: If you give developers sudo access and you don't have an extremely diligent team with strong system administration experience, you're going to run into problems where people made incompletely documented changes or cause problems while working which aren't caught early enough – ever see someone break out sudo or chmod 777 as their first debugging step or even write that into the install process because it was too much work to do it right? Docker is an enormous win here both because it sharply reduces the number of times someone needs privilege escalation and because it ensures that the end result of their work can be reliably audited and repeatedly deployed.
It's true that Docker doesn't protect against compromised or malicious users with privileged access. That's a very hard problem in general which can only partially be addressed at this level — especially since many of the most damaging attacks don't need it (“The bad news: they exfiltrated our customer database. Good news: they didn't get root on the EC2 instance”). I think most of the answers for this problem are going to continue to rely on existing practices like code review, auditing, getting finely-grained SELinux / seccomp rules into the development mainstream, etc.
Re: WTF is a container?
#178I agree that containers (both for shipping and servers) are a great idea. And because I'm tired of always configuring servers, I decided to give it a try some time ago. I wrapped my IRC client (weechat + glowing-bear) in a Docker container. Oh, not a container though, because I also needed https, which meant I needed either a mechanism to build and update letsencrypt certs in the weird format that weechat expects, or…
As others say Docker is probably over-hyped technology. However, I do see it as positive, because its hype, regardless if good or not, has created the traction for Go and OCaml on the data center, thus eventually leading to less C code for such use cases. So hype or not, maybe we do get some security improvements on the overall stack.
I'm missing the initial assumption. What is the connection between Docker and traction for Go and OCaml? People are using the latter in order to simply avoid containers?
Re: WTF is a container?
#179I remember going to AWS Reinvent last year and having some beers with a bunch of people who did devops. We started talking about tools, and they were utterly flabbergasted, that we had not embraced docker. They went on an on about how simple docker made HA, and handling fail overs/maintenance. More or less made it seem like it was the greatest thing since sliced bread. Me and a few coworkers decided to try and docker…
My impression is that it really shines when you need to scale and you can easily spin up and kill large amounts of nodes/compute without any impact to your service–when you're at the point where you're thinking about the health of the service rather than individual nodes. The whole pets vs. cattle ideal seems to be discussed most in configuration management contexts (because it's widely applicable to most architectures) but it translates into big benefits when operating infrastructure for something like a scaleable SOA.
So to give them the benefit of the doubt, they may have made some assumptions about your scale/workload/architecture. Perhaps for them containers occasionally crashing is just a small blip that will be automatically corrected so while they need to be aware of it to monitor for trends they're not generally concerned with them.
Re: WTF is a container?
#180I remember going to AWS Reinvent last year and having some beers with a bunch of people who did devops. We started talking about tools, and they were utterly flabbergasted, that we had not embraced docker. They went on an on about how simple docker made HA, and handling fail overs/maintenance. More or less made it seem like it was the greatest thing since sliced bread. Me and a few coworkers decided to try and docker…
flabbergasted? Wow this is a new word for me, I have never heard of it. When i first read it in my mind I thought it was a Spanish Football player that used to play for Arsenal, Then Barcelona, and now Chelsea. LoL Is this word even used anywhere else beyond US? Never heard it used in the UK.
I was born and raised in the midwest part of the U.S. and I've been using "flabbergasted" for all my adult life (20+ years). Of course, I've always had a propensity for peculiar or anachronous verbiage.