Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Containers vs. Zones vs. Jails vs. VMs (2017)

blog.jessfraz.com

Post reply on HN
Print view View original

111–120 of 134 posts

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#111

Post by BiteCode_dev »

outworlder wrote: post #4

> A “container” is just a term people use to describe a combination of Linux namespaces and cgroups. Linux namespaces and cgroups ARE first class objects. NOT containers. Amen. Somewhat tangential note: most developers I have met do not understand what a 'container' is. There's an aura of magic and mystique around them. And a heavy emphasis on Docker. A sizable fraction will be concerned about 'container overhead' (a…

With the new dev ops crave, we expect people to understand backend dev, and front end dev and design and sysadmin and networking and project management and infra and product ownership. Not to mention be proficient with tools related to those things.

The result is not people getting experts at all those things, but getting capable of producing something with all those things.

Obviously, to do so, people must take shortcut, and container ~= docker ~= "like VMs, but lighter" is good enough as a simplification for producing something.

Now there is something to be said about the value, quality, durability and ethics of what is produced.

But that's a choice companies make.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#112

Post by navaati »

takeda wrote: post #77
lazyant wrote: post #69

Earlier quoted context omitted.

Funny, I looked into papers or articles about performance issues with containerized RDBS _binaries_ and didn't find anything relevant. Of course you want the data mounted outside the container so it's not ephemeral. I ran some casual tests using and found out there is a performance hit in using db binaries inside a Docker container due to Docker networking (different for different types of networking).

I would be more concerned about writes going through additional fs layers and about abrupt termination of a container. You generally are trusting a database to keep your data safe, so those things will contribute to data loss. Remember the freakout about PostgreSQL not handling sync() correctly on Linux due to ambiguity in the man page? Having a networked filesystem + additional abstractions (like layers) etc only re…

Except you never do that (having your DB directory be in the container rootfs). Nobody does, because then (beside the performance/reliability impact you mention) if the container goes (docker rm) the data goes. You're always gonna use a Volume for this kind of cases, be it K8s volume or Docker volume, and these, as neighbour message mentions, are just bind mounts (or actual mounts in certain cases), so no layers, no overlay, nothing of the sort.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#113

Post by pbecotte »

dirtydroog wrote: post #109

For my workload I've struggled to see the advantage containers would give me. Maybe someone here can convince me, rather than the current justification of 'docker all the things'. We have servers, they handle a lot of traffic. It's the only thing running on the machines and takes over all the resources of the machine. It will need all the RAM, and all 16 vCPUs are at ~90%. It's running on GCP. To rollout we have a je…

If you already have all of that working, why would you change? Containers are valuable for a couple things-

1. Packaging and distribution- it's very easy to set up a known good filesystem using docker images and reuse that. There are other solutions- dpkg plus ansible would be an example.

2. Standardized control- all apps using 'docker run' vs a mix of systemd and shell scripts can simplify things.

3. Let's you tie into higher level orchestration layers like k8s where you can view your app instances as a single thing. There are other solutions here as well.

4. Can use the same image on dev machines as prod instead of needing two parallel setup schemes.

If you already are happy with your infra, certainly don't change it. I think once you know containers they are a convenient solution to those problems, but if stuff is setup they already missed their shot.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#114

Post by dielectrikboog »

gonzo41 wrote: post #94
dielectrikboog wrote: post #62

Earlier quoted context omitted.

For the better? I’m not asking out of preference, I’m asking out of actual conclusion: is trading the operational overhead of running LDAP for a usually homegrown, usually wobbly automated scripting soufflé that turns Make into a distributed system objectively better? Has nobody stopped to ask, is DevOps and CI/CD the best framework we can achieve? Did nobody think to ask before they told your agency it was the ‘righ…

Imagine a Graph, the x-axis is time or adoption of a set of technologies. Right now the hump in the bell curve is CI/CD and devops. It's safe to be in a large group. If something better comes along then it'll start happening and in 15 years I expect the whole of government to adopt it when you are bemoaning the pitfalls of any new approach.

I know what a hype curve is, and I made two substantive points to differentiate this situation from a hype curve. I’m not “bemoaning the pitfalls,” I’ll repeat that I’m concerned this approach, which is gaining traction and getting solidified and entrenched, will spook the decisionmakers on being willing to accept your 15-year solution when it comes along.

If you’re going to be as patronizing as you are, please at least read what I’ve written and respond to it.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#115

Post by dielectrikboog »

kqr wrote: post #95
dielectrikboog wrote: post #14

Earlier quoted context omitted.

SRE was born of putting software engineers to work building operational software and automation tailored to an organization and application. In contrast, no matter what anyone says, DevOps was objectively born of replacing the operations discipline and career track with a poorly-understood tool economy and ongoing opex to a cloud provider. As you say, typical JavaScript engineers can’t be bothered to understand netwo…

I agree with your overall point, but I also think there's a bit of conflation going on with the term "DevOps". It means different things to different people. What I think is as close as we get to a canonical meaning is the meaning in which it is used by The State of DevOps reports, based on very good science and research by Nicole Forsgren et al. They characterise "DevOps" as a transition into faster deployments, sho…

As you say: DevOps means a million things to a million people. That’s why I ignored the person who tried to explain to me that I had the origin of DevOps wrong. Nobody alive or dead is qualified to make such a pronouncement, because nobody knows. It is an amorphous blob that usually manifests as a weapon for developers to beat the operations disciplines out of their company, which is why I speak about it as I do. Given the overwhelming evidence that the interpretation I’m going after is the popular one, arguing over the definition of the term is pointless.

You’re conflating my argument with cloud ranting and assuming DevOps methodology is the only method to acquire more feedback from production by stating your last paragraph like that. I’m saying there are potentially others, but we are entrenching on this way of doing things, and people picked this particular way of doing things and started talking organizations outside “SV” into it. That conversation gets harder a second, third, and fourth time. The prevalence of COBOL reqs should warn you of this, and what DevOps will look like in about a hundred years.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#116

Post by dielectrikboog »

elbear wrote: post #73
dielectrikboog wrote: post #14

Earlier quoted context omitted.

SRE was born of putting software engineers to work building operational software and automation tailored to an organization and application. In contrast, no matter what anyone says, DevOps was objectively born of replacing the operations discipline and career track with a poorly-understood tool economy and ongoing opex to a cloud provider. As you say, typical JavaScript engineers can’t be bothered to understand netwo…

Hello! I am a developer who wants to understand networks. Can you point me to some reading resources? For now, I've just been looking at the wikipedia pages for the different protocols. But I think it would help me to work with concrete scenarios in which you use knowledge of networks to better understand things. I would appreciate it if you pointed me to anything you think worthwhile.

Take certifications. Not to get them, but because preparing for them will structure the learning better than anyone can in response to that question.

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#117

Post by [deleted] »

zodiac wrote: post #99
dielectrikboog wrote: post #62

Earlier quoted context omitted.

For the better? I’m not asking out of preference, I’m asking out of actual conclusion: is trading the operational overhead of running LDAP for a usually homegrown, usually wobbly automated scripting soufflé that turns Make into a distributed system objectively better? Has nobody stopped to ask, is DevOps and CI/CD the best framework we can achieve? Did nobody think to ask before they told your agency it was the ‘righ…

I dont disagree with many of your points, but are you advocating "logging into a production system and editing the config file in nano"? Can't tell if you are...

[deleted]

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#118

Post by codeape »

I do not understand docker on windows.

If I understand correctly, when I run a docker image on Linux then the dockerized processes's syscalls are all executed by the host kernel (since - again if I understand correctly - the dockerized process executes more or less like a normal process, just in isolated process and filesystem namespace).

Is this correct?

But how does docker on windows work?

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#119

Post by codeape »

codeape wrote: post #118

I do not understand docker on windows. If I understand correctly, when I run a docker image on Linux then the dockerized processes's syscalls are all executed by the host kernel (since - again if I understand correctly - the dockerized process executes more or less like a normal process, just in isolated process and filesystem namespace). Is this correct? But how does docker on windows work?

Found this: https://stackoverflow.com/questions/41550727/how-does-docker...

And:

https://dockercon.docker.com/watch/U7Bxp66uKmemZssjCTyXkm

Re: Containers vs. Zones vs. Jails vs. VMs (2017)

#120

Post by kqr »

the8472 wrote: post #98
CBLT wrote: post #29

Earlier quoted context omitted.

> To this day, I've heard CGroups being mentioned only once. See https://www.kernel.org/doc/Documentation/cgroup-v2.txt > "cgroup" stands for "control group" and is never capitalized. The singular form is used to designate the whole feature and also as a qualifier as in "cgroup controllers". When explicitly referring to multiple individual control groups, the plural form "cgroups" is used. To this day, I've heard cgr…

> To put forth a more substantive argument, everybody has a layer of abstraction they do not peek under. I hope you meant have not peeked under, so far . Any obscure problem will you down the rabbit hole. If you just stop looking then how can you solve problems?

By working around them, which is sometimes the smart decision. Hard to know ahead of time when that is the case, though...
Post reply on HN