Live data from Hacker News

WTF is a container?

techcrunch.com

241–250 of 262 posts

Re: WTF is a container?

#241

Earlier quoted context omitted.

How is "your own network, your own view of the file system, your own view of the process table, your own view of the user IDs, ..." the same as "processes"?

On modern Linux distros every process is running in a cgroup and namespace by default. So these days the main difference between a "container" and a regular process is that regular processes are all jumbled together in the same root namespace, and containers are in separate namespaces.

Which Linux distributions do this? I'd like to read how "most" instances of fork and exec end up with unique networks and file system namespaces.

Re: WTF is a container?

#242

I remember going to AWS Reinvent last year and having some beers with a bunch of people who did devops. We started talking about tools, and they were utterly flabbergasted, that we had not embraced docker. They went on an on about how simple docker made HA, and handling fail overs/maintenance. More or less made it seem like it was the greatest thing since sliced bread. Me and a few coworkers decided to try and docker…

I feel that sometimes I'm pro containers, and sometimes I'm very much against them. Docker does make deployments and upgrades very easy once you have the initial infrastructure set up, and you can deploy applications directly from upstream as "units" so that each deployment is exactly what you want; deploying containers helps prevent hosts from differentiating too much. If you have the infrastructure in place to rebu…

More like systemd has been reimplementing docker functionality...

Re: WTF is a container?

#243

Earlier quoted context omitted.

It's exactly these kinds of issues that add to my impression that containerisation, and Docker in particular, is more of a religion than a solution. I don't hate it per se, but I'm just a bit fed up of people telling me I should be using it without being able to articulate what problem it's going to solve for me. At the moment it feels like just one more thing to learn, and one more moving part, that isn't strictly n…

For me, with appropriate base containers, the real benefit is load time... booting a full VM has a lot of overhead, and takes quite a while. Loading a dockerized app is much faster. If you're extending this for your testing environment, that can be a huge win over a larger team. Being able to load more containers than VMs onto a server is another piece... Beyond that, it's not too much different than running VMs was…

I think that's a legitimate argument but deployments to VMs that are already up and running can also be fast, and for me they are, so it's not overwhelming. My feeling is that one day I'll reach a level of complexity/deployment time where the benefits of containerisation become clear, but I'm not there yet, nor anywhere near it.

Re: WTF is a container?

#244
post #77

lol. read two paragraphs => click author's name to verify he's got no actual tech background. life is boring.

The author has been writing for TechCrunch for a considerable amount of time.

I have been singing in the shower for a considerable amount of time. Still no singing expertise.

In both cases it is immediatly audible/visible in the output.

Re: WTF is a container?

#245

I remember going to AWS Reinvent last year and having some beers with a bunch of people who did devops. We started talking about tools, and they were utterly flabbergasted, that we had not embraced docker. They went on an on about how simple docker made HA, and handling fail overs/maintenance. More or less made it seem like it was the greatest thing since sliced bread. Me and a few coworkers decided to try and docker…

It's exactly these kinds of issues that add to my impression that containerisation, and Docker in particular, is more of a religion than a solution. I don't hate it per se, but I'm just a bit fed up of people telling me I should be using it without being able to articulate what problem it's going to solve for me. At the moment it feels like just one more thing to learn, and one more moving part, that isn't strictly n…

I wouldn't use it for everything, but whenever I encounter a problem where applications crash or behave weirdly - the problem is with the app, not the container technology. It's not because the problem only manifests itself in a container that the problem is suddenly "docker".

And as with every technology, you have to understand it's strength and weaknesses. I use Docker internally and in production with very few issues other than it advancing way too fast at the moment, but am always amazed how many people dive in head-first into a Docker adventure without understanding what it is and how it actually works and it's limitations.

This is from the perspective of a relatively small development company with applications where scaling is a non-issue. Our problem is that we have a ton of active projects. To give you an idea, our internal CI now still has over 500 active build jobs after a recent cleanup.

This CI is the first thing where Docker shines, it was an absolute god-send. I got rid of tons of frankenstein build slaves with unpredictable configurations, and replaced them with one huge VM running docker, with build images per project. This made this massive mess suddenly perfectly manageable, documented and version controlled. Need to build something in a build configuration from 1 year ago? Not something I want to do every day, but not completely impossible either, since I still have the exact same docker image in our internal registry.

Other than that, upgrading internal tools became a lot easier. Everything used internally (redmine, jenkins, ...) is containerized, which means it can easily be tested, migrated, cloned, ... It enforces data separation, which means it's clearer and easier to backup/restore and test these things. It means that now whenever a new version is released I can easily test this with our real data to see if there would be any problems in our configuration, and if not, quickly deploy a new version.

Re: WTF is a container?

#246
post #205

Earlier quoted context omitted.

Plan 9 is knocking on the door and would like to have a word …

The context of this discussion would like to have a word too...

I think that Plan 9's filesystem-based namespacing (and lack of a superuser) actually have a lot to offer for container-like solutions. Any Plan 9 user can set up namespacing of the network and of resources and spawn a process within that restricted namespace.

The whole process is much simpler, I think, than that of creating a Linux container (that's the whole reason Docker exists: to simplify & abstract something which isn't really inherently complex, but is accidentally complex).

Plan 9 certainly wasn't perfect, but it had some really high-quality ideas we still haven't assimilated in mainstream platforms.

Re: WTF is a container?

#247
post #246

Earlier quoted context omitted.

The context of this discussion would like to have a word too...

I think that Plan 9's filesystem-based namespacing (and lack of a superuser) actually have a lot to offer for container-like solutions. Any Plan 9 user can set up namespacing of the network and of resources and spawn a process within that restricted namespace. The whole process is much simpler, I think, than that of creating a Linux container (that's the whole reason Docker exists: to simplify & abstract something wh…

I'm not disputing any of this. But it really has nothing to do with the context of this thread...

Re: WTF is a container?

#248

Earlier quoted context omitted.

On modern Linux distros every process is running in a cgroup and namespace by default. So these days the main difference between a "container" and a regular process is that regular processes are all jumbled together in the same root namespace, and containers are in separate namespaces.

Which Linux distributions do this? I'd like to read how "most" instances of fork and exec end up with unique networks and file system namespaces.

I didn't say unique, I said "jumbled together".

Now as far as which distros put processes in a namespace and cgroup by default, I know at least CentOS 7 and Ubuntu 15 do this. And those two distros on their own would qualify for "most".

To check if your distro does it, one way of checking is just doing a `cat /proc/1/cgroup`. This will show you what cgroups process 1 is in. By default you will be in the "root" cgroup.

To check your namespaces, `ls -l /proc/1/ns/`. You'll see the process is in some randomly generated namespace ID per item.

I'm sure you could recompile your kernel to disable this behavior, but the default reality of modern Linux is that everything is already running in a "container".

Now the question is whether or not people want to take advantage of that reality, and separate out processes in isolation, or keep running everything on a system in such a way that any single process can impact the whole system.

Re: WTF is a container?

#249

Earlier quoted context omitted.

For me, with appropriate base containers, the real benefit is load time... booting a full VM has a lot of overhead, and takes quite a while. Loading a dockerized app is much faster. If you're extending this for your testing environment, that can be a huge win over a larger team. Being able to load more containers than VMs onto a server is another piece... Beyond that, it's not too much different than running VMs was…

I think that's a legitimate argument but deployments to VMs that are already up and running can also be fast, and for me they are, so it's not overwhelming. My feeling is that one day I'll reach a level of complexity/deployment time where the benefits of containerisation become clear, but I'm not there yet, nor anywhere near it.

That's a discipline issue though... shared nothing start from zero... The "docker" method doesn't upgrade an app already running in a container, it creates a new one.

Re: WTF is a container?

#250
post #239

Earlier quoted context omitted.

> Try to get an application - statically compiled or not - to run across different Linux distributions, and you will see why this matters. Done. A statically compiled application has no other dependencies.

Does it never do DNS lookups? Open files? Do you not want to tie into process management? Logging? Do you really have no dependencies on a functioning locale? Network settings? Are you sure it won't try to exec anything? An application with no other dependencies is exceedingly rare. Small tools, sure. Sometimes. But even then I see people making silly assumptions all the time, which makes using a container as a suita…

[deleted]
Post reply on HN