Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WTF is a container?

techcrunch.com

Post reply on HN
Print view View original

231–240 of 262 posts

Re: WTF is a container?

#231

Post by majewsky »

nawtacawp wrote: post #134
majewsky wrote: post #57

Earlier quoted context omitted.

Alpine containers are nice if you're just looking at size. But they break down once you `docker exec` into them to try to debug something: $ docker exec -ti mycontainer /bin/bash stat /bin/bash: no such file or directory $ docker exec -ti mycontainer /bin/sh / # curl https://localhost:5000/ /bin/sh: curl: not found / # strace $command /bin/sh: strace: not found

Thats not really broken. It is just a minimal image. If you want more pacakages then install them via the Dockerfile before you fire up the image. I like starting with a bare container. For example I might take an alpine image, install openvpn and use it to serve an always on vpn connection to other containers. The VPN container doesnt need a shell or anything else really. The only thing I want to see when I attach t…

Well yeah, "break down" was probably too much of a term. I did not mean to diss Alpine; I just meant to point out that the downsides of minimal images should be carefully considered.

Re: WTF is a container?

#232

Post by majewsky »

Kubuxu wrote: post #61
majewsky wrote: post #54

Earlier quoted context omitted.

Can you clarify what "full-blown standalone Linux" means? It sounds like running a separate kernel, but since we're talking containers rather than VMs, this can't be it.

It is shared kernel, separate userspace. It uses: X-namespaces (network, pid, user, ...) and cgroups to separate those userspaces from each other. I have community server running debian in which there are 10+ LXC containers running in which people are given normal root access, one container per user.

So it's the same as with Docker.

Re: WTF is a container?

#233

Post by acdha »

xorcist wrote: post #217
acdha wrote: post #177

Earlier quoted context omitted.

What I was thinking about wasn't protecting against outright malice but rather mistakes and errors: If you give developers sudo access and you don't have an extremely diligent team with strong system administration experience, you're going to run into problems where people made incompletely documented changes or cause problems while working which aren't caught early enough – ever see someone break out sudo or chmod 7…

> If you give developers sudo access Why would you, though? A developer would at the very most require the application's privileges, not the super user's. And that's only really necessary when doing live troubleshooting.

You have to if your developers are installing packages, working on deployment, running anything which runs on a privileged port, use tools like systemtap, etc. In some cases that can be avoided with configuration but then you're asking for bugs due to discrepancies between the environments.

You can reduce the number of things which hit that friction in a number of ways: having easily repeatable builds so a developer can test on their own VM; using a cloud service so test VMs are disposable and never shared; setting up a platform / microservices approach so a wider range of things either don't need to be touched or can be deployed without privileged or direct access, etc.

Containers (really namespaces) one way to hit that last goal: as a classic example, if you have a web app running on port 80 everyone who deploys will need to periodically restart Apache/nginx/Varnish/etc. and that may include elevated access to debug processes running as a different user. This is by far the simplest problem in this class and there are various ways (proxies, site users, firewall NAT rules, moving config into .htacccess or its equivalent, etc.) to reduce the number of times you have to care about it but but it still requires work to maintain and adapt code (especially with third-party apps).

Some people quite reasonably prefer to solve this entire class of problems by tossing everything into a container so it can run as if it's the only thing on the box.

Re: WTF is a container?

#234

Post by austinjp »

greedo wrote: post #224
austinjp wrote: post #119

Earlier quoted context omitted.

From my perspective, where I'm planning a hosting service with multiple customers, containers promise to allow me to slice machines into dedicated chunks. VMs could do this too, but they'd consume far more disk-space, which would mean my hosting costs would be comparatively higher. Containers promise to allow me to limit the resources each of my customers can consume without killing the entire box. For example, I can…

All of your requirements can be satisfied with properly configured VMs.

Including total disk space consumed on the host? I can't see how. Containers are by definition far lighter.

Re: WTF is a container?

#235

Post by tracker1 »

bartread wrote: post #136
Azeralthefallen wrote: post #101

I remember going to AWS Reinvent last year and having some beers with a bunch of people who did devops. We started talking about tools, and they were utterly flabbergasted, that we had not embraced docker. They went on an on about how simple docker made HA, and handling fail overs/maintenance. More or less made it seem like it was the greatest thing since sliced bread. Me and a few coworkers decided to try and docker…

It's exactly these kinds of issues that add to my impression that containerisation, and Docker in particular, is more of a religion than a solution. I don't hate it per se, but I'm just a bit fed up of people telling me I should be using it without being able to articulate what problem it's going to solve for me. At the moment it feels like just one more thing to learn, and one more moving part, that isn't strictly n…

For me, with appropriate base containers, the real benefit is load time... booting a full VM has a lot of overhead, and takes quite a while. Loading a dockerized app is much faster. If you're extending this for your testing environment, that can be a huge win over a larger team.

Being able to load more containers than VMs onto a server is another piece...

Beyond that, it's not too much different than running VMs was earlier on, it took orchestration and tooling to get working and there were growing pains... much of that abstracted well before becoming popular.

In the end, containers are just another step towards wherever we are going... I think it's pretty nice, but the tooling is just now starting to catch up.

Re: WTF is a container?

#236

Post by stephenr »

lowbloodsugar wrote: post #214
stephenr wrote: post #15

Earlier quoted context omitted.

If your app is a compiled go binary (so, it runs anywhere) why do you need a container? The whole point of containerisation is to group installed dependencies (as opposed to installable dependencies like with a regular deb or rpm package) and configuration into a 'black box'. If your binary is already a single-file distribution, why lump it in with the crapfest that is docker?

If "you" here is one person and "your app" is one app, then yes, why do you need a container. If "you" is 200 developers, and "your app" is 75 different applications written in Java, Java plus native libs, .NET, python, the other python, R, scala, NodeJS, and various C libraries, then docker containers, and more importantly images, are about as ideal as it gets. We're running Mesos so we don't have to use docker to g…

Both the post I replied to and my post explicitly talk about a go app, nothing else.

Re: WTF is a container?

#237

Post by paulddraper »

Koshkin wrote: post #216
paulddraper wrote: post #129

Earlier quoted context omitted.

> Try to get an application - statically compiled or not - to run across different Linux distributions, and you will see why this matters. Done. A statically compiled application has no other dependencies.

I think this is too strong a statement. To have "no other dependencies" you would have to statically link in (1) the operating system (including device drivers) and (2) the hardware model, to be absolutely sure. Only virtual machines (possibly including Java VM) can give you such guarantee.

And do you believe this set of issues doesn't apply to Docker?

Re: WTF is a container?

#238

Post by fanf2 »

pjmlp wrote: post #146
sidlls wrote: post #142

Earlier quoted context omitted.

There are legitimate reasons to not want to use C, but I find around here it's mainly reflexive hate and language zealotry. It's popular to hate on C (and C++) because the languages are so ubiquitous and long-used that a large body of terrible, unsecure, and poorly written code exists using them. Other languages haven't had the same success as these two yet, so haven't had their warts exposed enough to be dumped in t…

It was already clear in the late 70's and early 90's that C wasn't a reliable option to write safe systems. Dennis M. Ritchie himself on the history of the language[0] "To encourage people to pay more attention to the official language rules, to detect legal but suspicious constructions, and to help find interface mismatches undetectable with simple mechanisms for separate compilation, Steve Johnson adapted his pcc c…

Lint is built in to modern C compilers.

Re: WTF is a container?

#239

Post by vidarh »

paulddraper wrote: post #129
vidarh wrote: post #69

Earlier quoted context omitted.

> How is a container different from just installing all the dependencies along with an application? Once the image is built, you can get another installation that is guaranteed to be identical. You can do that with VM images too, but you can not reasonably do that if you try to install multiple applications side by side in a single VM without further isolation - there are too many ways they can interact. > Isolation…

> Try to get an application - statically compiled or not - to run across different Linux distributions, and you will see why this matters. Done. A statically compiled application has no other dependencies.

Does it never do DNS lookups? Open files? Do you not want to tie into process management? Logging? Do you really have no dependencies on a functioning locale? Network settings? Are you sure it won't try to exec anything?

An application with no other dependencies is exceedingly rare. Small tools, sure. Sometimes. But even then I see people making silly assumptions all the time, which makes using a container as a suitable straightjacket very useful.

E.g. I run all kinds of tools "with no other dependencies" all the time, that turns out to have all kinds of dependencies when you actually try to put it in the smallest container possible.

Re: WTF is a container?

#240

Post by jjnoakes »

zeveb wrote: post #205
jjnoakes wrote: post #145

Earlier quoted context omitted.

How is "your own network, your own view of the file system, your own view of the process table, your own view of the user IDs, ..." the same as "processes"?

Plan 9 is knocking on the door and would like to have a word …

The context of this discussion would like to have a word too...
Post reply on HN