Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Run More Stuff in Docker

jonathan.bergknoff.com

Post reply on HN
Print view View original

191–200 of 293 posts

Re: Run More Stuff in Docker

#191

Post by cobbzilla »

d3nj4l wrote: post #179
indemnity wrote: post #150

Earlier quoted context omitted.

Why even run nginx? My personal website is served out of a private S3 bucket, with CloudFront sitting in front of it. As a former sysadmin, the less actual admin I need to do the better.

You could have other, self-hosted services there. That's my setup: I have self hosted trilium and used to self host matrix. The personal nginx served website was just a cherry on top of the cake.

> I have self hosted trilium and used to self host matrix.

Wait, you’re self hosting multiple apps on one system, and not using K8?!? Your apps can’t autoscale or do blue/green upgrades or any of the cool stuff you are now mandated to do by the cargo cult. How do you sleep at night??

/s

Re: Run More Stuff in Docker

#192

Post by RedShift1 »

cmckn wrote: post #188
systemvoltage wrote: post #42

Let's not. I don't want to install Chrome which is already 73 MB, now bloated up with a whole lotta bullshit that's 500 MB+ image. Imagine downloading every application as a docker container. WTF. Docker is for distribution of applications when deploying them to servers. As a developer, it's amazing at that and have brought peace and joy in devops. Let's leave it there, shall we?

Totally agree that Docker is made for deploying to servers. But the disk space critique doesn’t hit for me. Even very nice SSD’s are cheap enough that 500 MB is negligible. My internet connection also makes downloading a large docker image no bigger of a deal than downloading Chrome, YMMV. I think the necessity of a VM when using Docker on Mac and Windows is the primary reason that running your “normal” apps in a con…

The problem isn't 500 MB disk footprint, it's all the RAM memory going to waste when loading in redundant libraries. Chrome already is a memory hog on its own, imagine all applications suddenly bringing in their versions of their libraries.

Re: Run More Stuff in Docker

#193

Post by raesene9 »

eptcyka wrote: post #174
e12e wrote: post #151

Earlier quoted context omitted.

> Docker is intimately tied to Linux. Linux and windows: https://hub.docker.com/_/microsoft-windows

Have you used a windows only container? I've not seen one in the wild, but I might be terribly biased.

Yep, I've also seen several corporates deploying Windows containers to production. As more "traditional" windows focused companies move to containerization/cloud, there's an increasing use of Windows containers, either as part of a Lift & Shift effort to migrate workloads, or because their developers are more comfortable with Windows and so they target that platform.

Re: Run More Stuff in Docker

#194

Post by pferde »

tomrod wrote: post #104
peteretep wrote: post #69

Earlier quoted context omitted.

I can get an Alpine Linux container running Perl with a chunk of CPAN on it to 60MB by just stripping the build tools once I've installed everything I want. Is Python really a GB bigger, or are people not taking the most basic of steps?

Basic steps. Welcome to the long September of Docker. Whereas most folks who use it regularly know basic maintenance patterns, new users (myself included) must wade through inscrutable documentation or (worse) poorly written blogfarm posts in order to bootstrap up to a level of proficiency that passes interview smell tests.

Do you have any documentation (or blogs) on a higher level that you would recommend? I too have been using Docker for a while, and recently also for certain programs on my desktop (mainly firefox, github cli, azure cli, aws cli, terraform).

I like to think I am somewhat proficient in using Docker correctly by now, but I am still discovering new tidbits of practical knowledge, tips and good practices every few weeks. And I always want more. :)

Re: Run More Stuff in Docker

#195

Post by foepys »

knowhy wrote: post #147
systemvoltage wrote: post #42

Let's not. I don't want to install Chrome which is already 73 MB, now bloated up with a whole lotta bullshit that's 500 MB+ image. Imagine downloading every application as a docker container. WTF. Docker is for distribution of applications when deploying them to servers. As a developer, it's amazing at that and have brought peace and joy in devops. Let's leave it there, shall we?

Docker has a layer file system. Meaning if you do it right, that Chrome container will share the same 500 MB base image layer with the Gimp container, or whatever, making it less bloated than it appears when looking only at the footprint of the first image. I'm not stating that I believe it is a good idea to run desktop apps in Docker containers. It is not a good idea. But it is also not true that if someone would do…

We all know that his doesn't work in practice. Somebody will "urgently" need another dependency and build a new base image with this dependency inside. Or a security patch comes out and half of the developers update while the rest doesn't. Do this 4 or 5 times and you'll have the exact same fragmentation.

Re: Run More Stuff in Docker

#196

Post by hda111 »

edbob wrote: post #124
cratermoon wrote: post #121

Earlier quoted context omitted.

For all the other reasons the author notes: the main one being that the application running in the docker image has no access to the host system other than what the user explicitly gives it. It's a very minimal sandbox and often all the application needs. You can't really reproduce that with any popular desktop operating system. Even if you could the interesting thing about docker is that starts with a default deny e…

I'm not an expert in this area, but I've seen plenty of accounts of how Docker can be very insecure. Perhaps it's possible to configure Docker so that it is very secure, but even Google has had people break out of their containers, so these claims about container security should probably come with a disclaimer: "Docker is very secure as long as you are one of the top 0.1% in the field and never mess up". VMs seem to…

Podman and LXD have far more secure defaults. It's a terrifying to see that Docker is still around. jail(8) from FreeBSD seems to be the best (from security standpoint), it's also the first container system.

Re: Run More Stuff in Docker

#197

Post by michaelt »

knowhy wrote: post #147
systemvoltage wrote: post #42

Let's not. I don't want to install Chrome which is already 73 MB, now bloated up with a whole lotta bullshit that's 500 MB+ image. Imagine downloading every application as a docker container. WTF. Docker is for distribution of applications when deploying them to servers. As a developer, it's amazing at that and have brought peace and joy in devops. Let's leave it there, shall we?

Docker has a layer file system. Meaning if you do it right, that Chrome container will share the same 500 MB base image layer with the Gimp container, or whatever, making it less bloated than it appears when looking only at the footprint of the first image. I'm not stating that I believe it is a good idea to run desktop apps in Docker containers. It is not a good idea. But it is also not true that if someone would do…

> that Chrome container will share the same 500 MB base image layer with the Gimp container, or whatever

Only if they’ve all chosen the same base image.

And if application developers could all agree on a fixed base image with fixed versions of dependencies, that’d be a Linux distro and we wouldn’t need docker to begin with :)

Re: Run More Stuff in Docker

#199

Post by t-writescode »

ogre_codes wrote: post #131

> Running a program in a container is a lot like running it normally, but the user doesn’t need to jump through hoops to configure the system, build and install. Docker is itself a complex build tool which requires a bunch of install steps. If you are going to ship software to end users there is almost always a better way to bundle and ship than send someone a Docker container . Docker is not a distribution tool, if…

> In no case is "Making it into a Docker Image" a simpler/ better distribution mechanic.

For my home server setup, I have docker containers for:

  * PiHole
  * NextCloud
  * Home Assistant
If I had to install each of those manually, I probably wouldn't have installed them. This is especially true of NextCloud, which almost certainly would have required me to learn how to run nginx on my own, install php or whatever application it uses as the middleware, etc.

Instead, I configured my DNS and ran a Docker command and was off to the races.

Server-level Open Source Software's installation process is often so complicated and has so many dependencies if it's not something you can get from your repository's package manager, at least in my experience, that docker is almost always the easiest option.

What beats a single command and maybe reading a config on what ports to forward or how to set up your config. And then you get a docker-compose if you want to be creative, yourself.

Unless you're already very skilled at dev-ops, docker is easier.

Re: Run More Stuff in Docker

#200

Post by tomxor »

RedShift1 wrote: post #192
cmckn wrote: post #188

Earlier quoted context omitted.

Totally agree that Docker is made for deploying to servers. But the disk space critique doesn’t hit for me. Even very nice SSD’s are cheap enough that 500 MB is negligible. My internet connection also makes downloading a large docker image no bigger of a deal than downloading Chrome, YMMV. I think the necessity of a VM when using Docker on Mac and Windows is the primary reason that running your “normal” apps in a con…

The problem isn't 500 MB disk footprint, it's all the RAM memory going to waste when loading in redundant libraries. Chrome already is a memory hog on its own, imagine all applications suddenly bringing in their versions of their libraries.

Also the network requirements to install and update such large containers is a problem, a lot of people don't appreciate how slow the internet is in most of the world compared to those with access to any kind of fiber end point.. this extends to similar concepts like snap packages.
Post reply on HN