Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dissatisfied with Docker

robert.ocallahan.org

Post reply on HN
Print view View original

161–170 of 229 posts

Re: Dissatisfied with Docker

#161

Post by VonGallifrey »

TheWizardofOdds wrote: post #149
utopian3 wrote: post #136

Earlier quoted context omitted.

> In the end (if I understood correctly), it is supposed to be the go-to tool for serverless architecture. You misunderstood. No one calls Docker a “serverless” architecture.

And i didn't either, I called it a tool for serverless architecture. In fact some tools for serverless architecture like AWS Fargate require you to use Docker.

I know that AWS Fargate has the tagline of "Run containers without managing servers or clusters", but that is not what "serverless architecture" means. Fargate is a container service.

Serverless would be, for example, AWS Lambda, Azure Functions or Google Cloud Functions.

Re: Dissatisfied with Docker

#162

Post by otabdeveloper4 »

notyourday wrote: post #90
ses1984 wrote: post #42

There are two kinds of software: software no one uses, and software people complain about.

There's also software that was created to solve a specific problem that got misappropriated to do something else There used to be an ISP called pilot.net. It was a crappy ISP but to solve its ISP billing problem it wrote a billing system for telcos. There was a company that tried competing with AWS selling hosting based on hyperthreads of CPUs. It wrote its own provisioning system because it did not want to pay for V…

> There's also software that was created to solve a specific problem that got misappropriated to do something else

Docker is a classic case. Docker must be the craziest, most over-engineered solution for packaging developer artifacts in the Universe.

Re: Dissatisfied with Docker

#163

Post by peterwwillis »

Containers Without Docker: https://dzone.com/articles/containers-with-out-docker

Dockerless: https://mkdev.me/en/posts/dockerless-part-1-which-tools-to-r... https://dzone.com/articles/dockerless-part-1-which-tools-to-...

What's funny is, Docker is only actually useful because of how many features it has, all its supported platforms, all its bloat. You won't ever be totally satisfied with any alternative because it takes so long to make something like Docker, and someone will always need that one extra feature.

Re: Dissatisfied with Docker

#164

Post by onefuncman »

VonGallifrey wrote: post #161
TheWizardofOdds wrote: post #149

Earlier quoted context omitted.

And i didn't either, I called it a tool for serverless architecture. In fact some tools for serverless architecture like AWS Fargate require you to use Docker.

I know that AWS Fargate has the tagline of "Run containers without managing servers or clusters", but that is not what "serverless architecture" means. Fargate is a container service. Serverless would be, for example, AWS Lambda, Azure Functions or Google Cloud Functions.

Fargate is serverless because the compute is abstracted away completely. A lambda runtime is just a specialized container and they've added similar customizability to it lately with Layers/Runtime configuration.

Re: Dissatisfied with Docker

#165

Post by Nullabillity »

Smithalicious wrote: post #160
xorcist wrote: post #151

Earlier quoted context omitted.

The most basic problem with Docker is the use of a daemon that is not init. Access control is at best problematic. Upgrading the daemon without losing state is tricky. Requiring daemon access to build images is insane. Building this functionality into something like systemd would be more robust but it's way harder to sell as a product.

Yeah Docker should get with the times and be assimilated into systemd like everything else

Seems to be on its way! systemd-nspawn (the container subsystem) seems to have support for OCI images since march.[0]

[0]: https://github.com/systemd/systemd/pull/9762/files

Re: Dissatisfied with Docker

#166

Post by MrBuddyCasino »

jeff_vader wrote: post #155
neckardt wrote: post #56

I'm surprised nobody is mentioning LXC[1]. I'm by no means a containers expert, but they claim to be more secure since they default to running as non-root. Unlike docker, I had no trouble installing LXC with apt, while with docker I often got an outdated version. I'm now using LXC for all of my basic container applications (self hosting a wiki and a few other sites). [1]: https://linuxcontainers.org/

One reason it's not very popular (from my experience): Docker Desktop for macs, which makes Docker experience on mac os feel somewhat close to native. Meanwhile, to use LXC you'd have to work inside VM (Virtualbox or similar). Last 3 companies I worked for (in London) were almost 100% mac os (which is a little sad).

If you use "kind" to create a K8S cluster on MAC, using LXC is totally transparent. You can just load regular Docker images via "kind load docker-image". It even takes less RAM than minikube, because the running Docker VM is re-used.

Re: Dissatisfied with Docker

#167

Post by tuananh »

james_s_tayler wrote: post #138
cs02rm0 wrote: post #135

Earlier quoted context omitted.

JBoss, Websphere? I know that pain, hadn't even occurred to me that anyone would think containers had a slow startup time. Especially as they've often replaced VMs for me.

WebLogic.

this name brings back lots of painful memory back in the day.

Re: Dissatisfied with Docker

#168

Post by mschuster91 »

> In fact, a global system daemon should not be needed.

You will need a daemon running as root to bind to ports below 1024.

In addition, in many cases you want a bind-mount onto your filesystem that also supports arbitrary UID/GID on files, which means you will need a root daemon. The problem is of course that anyone having access to the docker daemon can simply say "bind host / to container /mnt" and then can hijack /etc/sudoers for a privilege escalation on the host.

It's mutually exclusive to have usable containers and a system that is secure against privilege escalation by the users at least and (in case of docker-in-docker implemented by bind-mounting the Docker socket in the container) by anyone accessing the container and achieving RCE there.

Re: Dissatisfied with Docker

#169

Post by bionsystem »

angry_octet wrote: post #130
chucky_z wrote: post #2

I am currently on this train. Having used rkt in the past, I went to revisit it recently only to find this: https://www.cncf.io/blog/2019/08/16/cncf-archives-the-rkt-pr... I am so extremely disappointed in the CNCF as rkt (at the time, at least) seemed to be more "production ready" than Docker. Are there any real alternatives? Is the answer "find something else that uses containerd in a more friendly way?" Is the ans…

Wasn't that because RedHat bought CoreOS, and RH is all k8s? And then no one was pushing rkt along with commercial support, so it died? Agree the rkt was cool. I just don't know if RH is becoming more like MSFT or more like Oracle.

More like IBM it seems :)

Re: Dissatisfied with Docker

#170

Post by rotten »

I'd like it to be more like git. Yes Docker has "push" and "pull", but I want branches, and automatic attach when I do a checkout, and rollback when I screw it up.

As a developer I'd like to be able to check out a docker image, work _in_ it, and merge it to master when I'm done. When my code is deployed, I'll know _exactly_ what is running.

Managing secrets and environments (so the container knows when it is in production instead of running on a developer's laptop) is important to get this to work well.

It feels like it is half way there already. I'm looking forward to when it is as straightforward as git for a developer to use. I'm not too worried about start up time - the biggest drawback to slow startup time is when you are running very sensitive autoscaling that is tearing down and spinning up new nodes very quickly. If you have that problem you may want to rethink your node size, hysteresis, and scaling thresholds.

Post reply on HN