Live data from Hacker News

LXC vs. Docker

earthly.dev

51–60 of 147 posts

Re: LXC vs. Docker

#51

Apples to oranges. LXC can be directly compared with a small, and quite insignificant, part of Docker: container runtime. Docker became popular not because it can run containers, many tools before Docker could do that (LXC included). Docker became popular because it allows one to build, publish and then consume containers.

> Docker became popular because it allows one to build, publish and then consume containers. True, but Docker is an awful choice for those things (builds are performed "inside out" and aren't reproducible, publishing produces unauditable binary-blobs, consumption bypasses cryptographic security by fetching "latest" tags, etc.)

> builds are performed "inside out"

Docker supports multi-stage builds. They are quite powerful and allow you go beyond the "inside out" model (which still works fine for many use cases).

> ...and aren't reproducible

You can have reproducible builds with Docker. But Docker does not require your build to be reproducible. This allowed it to be widely adopted, because it meets users where they are. You can switch your imperfect build to Docker now, and gradually improve it over time.

This is a pragmatic approach which in the long run improves the state of the art more than a purist approach.

Re: LXC vs. Docker

#52
post #46

Earlier quoted context omitted.

> Docker became popular because it allows one to build, publish and then consume containers. True, but Docker is an awful choice for those things (builds are performed "inside out" and aren't reproducible, publishing produces unauditable binary-blobs, consumption bypasses cryptographic security by fetching "latest" tags, etc.)

Can you expand on how builds aren't reproducible? I though Dockerfile ensured that builds are indeed reproducible?

Running the same script every time doesn't necessarily guarantee the same result.

Lots of docker build scripts have the equivalent of

  date > file.txt
or

  curl https://www.random.org/integers/?num=1&min=1&max=1000&col=1&base=10&format=plain&rnd=new > file.txt
Buried deep somewhere in the code.

But yeah I don't see any reason why you couldn't theoretically make a reproducible build with Docker.

Re: LXC vs. Docker

#53

Apples to oranges. LXC can be directly compared with a small, and quite insignificant, part of Docker: container runtime. Docker became popular not because it can run containers, many tools before Docker could do that (LXC included). Docker became popular because it allows one to build, publish and then consume containers.

More like Apples to Apple Core, but sure.

Re: LXC vs. Docker

#54
post #52
post #46

Earlier quoted context omitted.

Can you expand on how builds aren't reproducible? I though Dockerfile ensured that builds are indeed reproducible?

Running the same script every time doesn't necessarily guarantee the same result. Lots of docker build scripts have the equivalent of date > file.txt or curl https://www.random.org/integers/?num=1&min=1&max=1000&col=1&base=10&format=plain&rnd=new > file.txt Buried deep somewhere in the code. But yeah I don't see any reason why you couldn't theoretically make a reproducible build with Docker.

Docker images actually contain the timestamp each layer was built at, so are basically de-facto non-reproducible.

Buildah from Red Hat has an argument to set this programmatically instead of using the current date, but AFAIK there's no way to do that with plain old docker build.

Re: LXC vs. Docker

#55
post #42

LXD (Canonical's daemon/API front end to lxc containers) is great -- as long as you aren't using the god awful snap package they insist on. The snap is probably fine for single dev machines, but it has zero place in anything production. This is because canonical insists on auto-updating and refreshing the snap at random intervals, even when you pin to a specific version channel. Three times I had to manually recover…

I got so annoyed with snapd that I finally patched the auto-update functionality to provide control via environment variable. It's ridiculous that this is what I have to personally go through in order to maintain control of when updates are applied on my own systems. If enough people were to ever decide to get together and properly fork snapd and maintain the patched version I'd totally dedicate time to helping out.…

We blocked the annoying snapd autoupdate behavior by setting a http proxy to a nonexistent server. Whenever we had a maintenance window we would unset the proxy, allow the update, then set the set the nonexistent proxy server again.

Very annoying.

Re: LXC vs. Docker

#56
post #42

LXD (Canonical's daemon/API front end to lxc containers) is great -- as long as you aren't using the god awful snap package they insist on. The snap is probably fine for single dev machines, but it has zero place in anything production. This is because canonical insists on auto-updating and refreshing the snap at random intervals, even when you pin to a specific version channel. Three times I had to manually recover…

Yeah, it's truly terrible. I've had downtime from this as well.

Re: LXC vs. Docker

#57
post #42

LXD (Canonical's daemon/API front end to lxc containers) is great -- as long as you aren't using the god awful snap package they insist on. The snap is probably fine for single dev machines, but it has zero place in anything production. This is because canonical insists on auto-updating and refreshing the snap at random intervals, even when you pin to a specific version channel. Three times I had to manually recover…

Just curious--how do you use LXD in production? It always struck me as something very neat/useful for dev machines, but I had trouble imagining how it would improve production workloads.

Re: LXC vs. Docker

#58
post #42

LXD (Canonical's daemon/API front end to lxc containers) is great -- as long as you aren't using the god awful snap package they insist on. The snap is probably fine for single dev machines, but it has zero place in anything production. This is because canonical insists on auto-updating and refreshing the snap at random intervals, even when you pin to a specific version channel. Three times I had to manually recover…

Makes you wonder whether Canonical has any idea about operating servers. Auto-updating packages is the last thing you want. Doing that for a container engine, without building in some jitter to avoid the scenario you described is absolutely insane.

Who even uses snap in production? If I squint my eyes I can see the use for desktops, but why insist on it for server technologies as well?

Re: LXC vs. Docker

#59
post #42

LXD (Canonical's daemon/API front end to lxc containers) is great -- as long as you aren't using the god awful snap package they insist on. The snap is probably fine for single dev machines, but it has zero place in anything production. This is because canonical insists on auto-updating and refreshing the snap at random intervals, even when you pin to a specific version channel. Three times I had to manually recover…

Not even kidding, a huge part of what made me move to Arch was that it's one of the few distros that packages LXD. Apparently it's a pain, but I'm forever grateful!

Re: LXC vs. Docker

#60
post #37

The perfect pair Containerfile vs Dockerfile - Infra as code podman vs docker - https://podman.io podman desktop companion (author here) vs docker desktop ui - https://iongion.github.io/podman-desktop-companion podman-compose vs docker-compose = there should be no vs here, docker-compose itself can use podman socket for connection OOB as APIs are compatible, but an alternative worth exploring nevertheless. Things are…

Is networking any better with Podman on Docker Compose files? Last time I tried, most docker-compose files didn't actually work because they created networks that Podman doesn't have privileges to setup unless run as root

Afaik, the kernel network APIs are pretty complicated so it's fairly difficult to expose to unprivileged users safely

Post reply on HN