I don't know if there is a comparable technology for Windows. If you really want to appreciate the difference I think that you have to invest some time building and running docker containers and thinking if you really could do the same by switching DLLs. Don't forget the deployment story.
Ask HN: Docker vs simple DLLs?
41–50 of 65 posts
Re: Ask HN: Docker vs simple DLLs?
#42A container image can be seen the same way a machine image can be used: you ship an image of a solution instead of some files and instructions and 'hope for the best'.
If you imagine your application and it's required environment as a complete machine as a starting point, and then running/scaling that by simply having the only requirement on any host be "it must be able to run this image". That's a much smaller and more standard interface than individual files.
If you were to just make a 'smaller' version of that you'd end up with chroot/jails and if you want to use cgroups on linux for isolation you'd end up with containers (i.e. Docker containers). It's not the only method or the best method, but it's the easiest and most widely supported method.
Going even 'smaller' you could simply build static binaries with everything included and tell the OS that when it gets started it should do so with no permissions to access anything else on the host.
Smaller beyond that is unikernels where your application is the OS and runs bare on a host (be it bare metal or virtual).
The downside of the last two is that all the 'extra' files like assets and temporary data needs to be embedded inside that single file. The downside of chroot and jail are that there is no cross-host packaging method and it usually just works on one specific OS or host.
Virtual machine images and container images have the same benefits but the virtual machine has the drawback that it is much bigger, much slower to start up (generally) and has a much larger attack surface and maintenance overhead.
What containers aren't is:
- A package manager
- Application Server Containers
- Configuration management (well it shouldn't)
- A replacement for a single-purpose VM
Technically containers also require you to be stateless and read-only. This nearly universally leads to better applications, better operations and better security. That gets us to the cattle vs. pets part of containers: the idea is that you ship containers, not whatever happens to be "inside" those containers. As long as a container is "good", any host that can run containers should be able to perform exactly the same to the point where running it on your laptop, on a mainframe and on a standard bare metal server does exactly the same thing. If you then wipe the server, install a different OS that can run containers and start the container again, it still does exactly what it should do.Re: Ask HN: Docker vs simple DLLs?
#43 * The Dockerfile describes my development environment,
* I can replicate this environment just by setting up Docker and copying a few files,
* I can run my development/run-time environment on *fast* AMD Ryzen 9 hardware that causes a real CentOS 7 kernel to panic at boot.
For me, in practical terms, I can do a build in 6 minutes versus 25, when compared with my work laptop (2019 Razer Blade 15)Re: Ask HN: Docker vs simple DLLs?
#44Earlier quoted context omitted.
>And then our Java team forgot to tell the sysadmins that they upgraded the JVM version. That's just a sing for bad communication/practices/documentation and processes, and why don't the dev's test the application on the dev/test-environment? BTW: Why can the JAVA-team even install something on the dev/test/prod-env? That's completely against the rules.
You can think of docker files and other manifests as a highly structured and more direct-to-machine form of communication. Instead of a developer informing other developers to ensure that the dev machines and servers are upgraded to the right version of the JVM via a confluence page or slack message, that developer has left machine-readable instructions in a consistent format in a readily accessible place. This is a…
No it's not because the dev who made the database-container forgot to inform you that you need the new jdbc.jar etc...it's the same just with one more layer.
Re: Ask HN: Docker vs simple DLLs?
#45Earlier quoted context omitted.
>And then our Java team forgot to tell the sysadmins that they upgraded the JVM version. That's just a sing for bad communication/practices/documentation and processes, and why don't the dev's test the application on the dev/test-environment? BTW: Why can the JAVA-team even install something on the dev/test/prod-env? That's completely against the rules.
> why don't the dev's test the application on the dev/test-environment? They did, it failed, then the JVM was upgraded for dev/test (but not yet for prod as that was still running the prev-JVM version of the code).
See first error, dev/test has to be a exact mirror of production, otherwise it makes no sense. And if not even the admins from dev/test/production can communicate with each other...you really have deep rooted problem.
Re: Ask HN: Docker vs simple DLLs?
#46Earlier quoted context omitted.
>And then our Java team forgot to tell the sysadmins that they upgraded the JVM version. That's just a sing for bad communication/practices/documentation and processes, and why don't the dev's test the application on the dev/test-environment? BTW: Why can the JAVA-team even install something on the dev/test/prod-env? That's completely against the rules.
Yes. However, with more and more teams, and more and more languages, this communication, and especially planning and executing these upgrades and changes while providing rollbacks for all languages becomes harder and harder. It's very possible to do this, but it takes a lot of effort. Containerization largely eliminates this need for communication. There are new problems - security of running containers, image sizes,…
Re: Ask HN: Docker vs simple DLLs?
#47Earlier quoted context omitted.
> The thing with docker is that you just get a complete package with everything delivered directly by the developer and it's very hard to mess up. The downside is: you are also, at the same time, excluding yourself from standard patch management. Whereas in ye olde times for a situation like Heartbleed or log4shell the 24/7 on-call sysop team would run a simple "apt-get upgrade openssl" and restart all affected daemo…
Not really; if you have a few servers vs. a few containers the patch is the same with the difference that the server one is probably "live" patching on a running system and the docker one is patching it in the docker file and re-deploying which makes it an atomic change. It also really makes a difference if you are combining some tasks and ownership in a DevOps concept where it's not just developers handing off some…
DevOps has always been more about companies attempting to "save" money by shoe-horning together roles that require completely different skill sets.
Re: Ask HN: Docker vs simple DLLs?
#48Docker helps with two problems DLLs dont: 1) what if I want to run your app on my Linux server and I dont have dotnet set up. I dont want to deal with installing and maintaining dontnet. And I dont trust your setup script 2) You want run a database and message as part of your application, and they aren't dotnet.
> And I dont trust your setup script Worth pointing out that if you don't trust their setup script, then you probably shouldn't trust their Docker container either.
Re: Ask HN: Docker vs simple DLLs?
#49Simply, it's like: `mount disk.img dir && chroot dir`
Or in Windows.. mounting a disk image to X: drive, then starting an application with SystemDrive=X:, SystemRoot=X:\Windows, etc. (pretend that works)
Re: Ask HN: Docker vs simple DLLs?
#50Becuase your solution is specific to your specific software. Then you have lads who use python who can use virtualenv, and then the ruby ones who use rbenv and then you have the CPP developers which are usually fine but on Tuesday Joe messed up the linker settings and all of a sudden we're not statically linked, thanks Joe. And then our Java team forgot to tell the sysadmins that they upgraded the JVM version. The th…
> The thing with docker is that you just get a complete package with everything delivered directly by the developer and it's very hard to mess up. The downside is: you are also, at the same time, excluding yourself from standard patch management. Whereas in ye olde times for a situation like Heartbleed or log4shell the 24/7 on-call sysop team would run a simple "apt-get upgrade openssl" and restart all affected daemo…