Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Run More Stuff in Docker

jonathan.bergknoff.com

Post reply on HN
Print view View original

181–190 of 293 posts

Re: Run More Stuff in Docker

#181

Post by watermelon0 »

eptcyka wrote: post #176
antoinealb wrote: post #26

Earlier quoted context omitted.

Serious question: Why do you believe that to be insane? The Dockerfile for a simple application such as black must be very short (probably 3-4 lines), the alias is probably quite short and the container overhead time is minimal for native docker (the story might be different for things like docker mac). On the other hand, you get some benefits from installing black through docker rather than through the system packag…

This requires you to give your normal user the ability to execute stuff via docker. This means that given the ability to execute code as the user, an attacker can trivially gain root access.

There are many ways of running containers as a normal user:

https://docs.docker.com/engine/security/rootless/

https://github.com/containers/podman#rootless

Re: Run More Stuff in Docker

#182

Post by freebuju »

Were it not for docker, I probably would have never learned about Linux. I'll share why. I was excited to find docker. It was neat and could be setup to update your applications without manual interaction. So I had it run my media server apps on a seedbox I had rented. Fast forward years later got a form factor pc that came with the free version of Windows. Try as a might, I couldn't get docker to work on it. Required the Pro version or something like that. I remember thinking, well that sure is stupid! That was the beautiful beginning of my affair with Linux as an OS for my desktop/server needs.

Re: Run More Stuff in Docker

#183

Post by nemetroid »

antoinealb wrote: post #26
qmmmur wrote: post #23

Earlier quoted context omitted.

That just seems insane to be running black inside a container. Why dont you just configure your environment properly?

Serious question: Why do you believe that to be insane? The Dockerfile for a simple application such as black must be very short (probably 3-4 lines), the alias is probably quite short and the container overhead time is minimal for native docker (the story might be different for things like docker mac). On the other hand, you get some benefits from installing black through docker rather than through the system packag…

> On the other hand, you get some benefits from installing black through docker rather than through the system package manager: is is completely isolated from the host and the only way to break black is to update it, changing anything in the host will not break your black install.

Why would a system package, packaged by experienced maintainers, randomly break?

Re: Run More Stuff in Docker

#184

Post by keyle »

pjmlp wrote: post #178
XorNot wrote: post #170

Earlier quoted context omitted.

I guess that makes me fossilizing, because this is the direction I think we should really be heading. When I stare at docker long enough I wind up at "why couldn't this be a static binary" or "this would be easier to secure if it was it's own VM".

Many people are basically misusing Docker to work around Python and Ruby dependency problems.

^ this is a very good point. Someone else's mess, let me put it all together, in a nice pot plant.

Re: Run More Stuff in Docker

#185

Post by keyle »

pjmlp wrote: post #158
pram wrote: post #110

Earlier quoted context omitted.

Now talk about deploying something NOT using Kubernetes. The double whammy. Now you're looking like an insane 100 year old graybeard fossil.

Fossil here, happily using VMs.

At this rate we should make a fossil of deployments moto, where we claim there is nothing wrong with makefiles and bash scripts :)

like http://programming-motherfucker.com but against triple-buffered-virtualization.

Re: Run More Stuff in Docker

#186

Post by jillesvangurp »

hendry wrote: post #30

Just some counter arguments to @jbergknoff's well put together page! Docker is the best medium for distributing - A static file is far easier to share / distribute. Cross-platform - You need an arguably complex and unstable Linux interface to run Docker images, cgroups et al Sandboxed - security claims about Docker have always been controversial. Simple Unix/BSD constructs like chroot/jails are far simpler and they a…

What's the alternative to docker? And by that, I mean a solution that a team can reasonably use across Linux, Windows, and Mac. The simple reality is that, there is Docker and absolutely nothing else that comes close to working everywhere. Yes, it's not perfect but everything else is far less perfect. Static binaries are far too limited; most software requires lots of files spread all around the file system.

I did a project last year at a company that had dockerized their build, CI, and CD infrastructure. They had dozens of git projects with make files that triggered actions using docker. It was great. No need to install anything complicated; just works everywhere with just a minimum of scripts installed from a single internal repository. They did some nice hacks to work around some of the things mentioned in the article. Including using virtual box on macs to work around the filesystem limitations. This really becomes a show stopper for large complicated builds that are very io intensive.

Re: Run More Stuff in Docker

#187

Post by tedk-42 »

ogre_codes wrote: post #131

> Running a program in a container is a lot like running it normally, but the user doesn’t need to jump through hoops to configure the system, build and install. Docker is itself a complex build tool which requires a bunch of install steps. If you are going to ship software to end users there is almost always a better way to bundle and ship than send someone a Docker container . Docker is not a distribution tool, if…

Sorry but you're wrong. A vast majority of software ships after it has been built as a stand alone application as well as a Docker container so that it can be run in container environments.

A lot of CI systems natively support Docker because of the variety of tools and images you have available to run you CI steps in.

Docker is an excellent distribution tool because it only requires Docker.

You can send someone some python code and ask them to run it, only to find they're missing a bunch of C libs required to build and run the code which is a pain to help them figure out how to solve.

Docker solves many of these problems but has a drawback of being more 'bloated' than other distribution mechanisms. It doesn't make it a bad one though.

Re: Run More Stuff in Docker

#188

Post by cmckn »

systemvoltage wrote: post #42

Let's not. I don't want to install Chrome which is already 73 MB, now bloated up with a whole lotta bullshit that's 500 MB+ image. Imagine downloading every application as a docker container. WTF. Docker is for distribution of applications when deploying them to servers. As a developer, it's amazing at that and have brought peace and joy in devops. Let's leave it there, shall we?

Totally agree that Docker is made for deploying to servers. But the disk space critique doesn’t hit for me. Even very nice SSD’s are cheap enough that 500 MB is negligible. My internet connection also makes downloading a large docker image no bigger of a deal than downloading Chrome, YMMV.

I think the necessity of a VM when using Docker on Mac and Windows is the primary reason that running your “normal” apps in a container isn’t the right move.

Re: Run More Stuff in Docker

#189

Post by jillesvangurp »

cortesoft wrote: post #25
harryruhr wrote: post #20

Docker for every application? If you create and maintain the Docker image or Dockerfile for every applucation yourself, you must have plenty of time. If you rely on public images from Docker Hub, you must have plenty of trust in the creators of those images.

Hmmm... what alternative does not either take time or trust?

Yep, the reality is that we all rely on hundreds of millions of lines of code of software (mostly OSS) that make up our OS, tool chains, libraries, etc. every day. Basically, it's not feasible to even review a meaningful fraction of a percent of that in a lifetime; assuming you even have the skill level to do such a review. In other words, mostly you are blindly trusting other people to have signed off on something and that those people who you don't know personally did a good job of that.

Re: Run More Stuff in Docker

#190

Post by e12e »

eptcyka wrote: post #174
e12e wrote: post #151

Earlier quoted context omitted.

> Docker is intimately tied to Linux. Linux and windows: https://hub.docker.com/_/microsoft-windows

Have you used a windows only container? I've not seen one in the wild, but I might be terribly biased.

No, not yet. But we might go that way in the future for windows software on azure, much along the lines of:

https://docs.microsoft.com/en-us/dotnet/architecture/moderni...

Post reply on HN