Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Should I run plain Docker Compose in production in 2026?

distr.sh

Post reply on HN
Print view View original

71–80 of 312 posts

Re: Should I run plain Docker Compose in production in 2026?

#71

Post by sneak »

merpkz wrote: post #57

How do you guys, who run Docker in production deal with managing nftables firewall on hosts running containers? By design docker daemon creates and manages a set of firewall rules to forward traffic between containers and ingress traffic into containers as well as masquarades the outgoing container traffic. That is all well until admin needs to alter hosts firewall to allow and deny other traffic unrelated to docker…

On my docker hosts there is no other traffic unrelated to docker. Everything goes in containers.

Re: Should I run plain Docker Compose in production in 2026?

#72

Post by pmig »

merpkz wrote: post #57

How do you guys, who run Docker in production deal with managing nftables firewall on hosts running containers? By design docker daemon creates and manages a set of firewall rules to forward traffic between containers and ingress traffic into containers as well as masquarades the outgoing container traffic. That is all well until admin needs to alter hosts firewall to allow and deny other traffic unrelated to docker…

[dead]

Re: Should I run plain Docker Compose in production in 2026?

#73

Post by nijave »

JodieBenitez wrote: post #33
poly2it wrote: post #17

Earlier quoted context omitted.

Is your point that we shouldn't motivate our technological choices? I wouldn't use Docker Compose in production.

I wouldn't use Docker in production.

I assume you mean Docker _daemon_

Docker also commonly refers to Docker _images_ or Docker-esque container setups

Re: Should I run plain Docker Compose in production in 2026?

#74

Post by nijave »

sneak wrote: post #71
merpkz wrote: post #57

How do you guys, who run Docker in production deal with managing nftables firewall on hosts running containers? By design docker daemon creates and manages a set of firewall rules to forward traffic between containers and ingress traffic into containers as well as masquarades the outgoing container traffic. That is all well until admin needs to alter hosts firewall to allow and deny other traffic unrelated to docker…

On my docker hosts there is no other traffic unrelated to docker. Everything goes in containers.

To expand, you can use privileged containers, host network, capabilities, etc if the software really needs it. In that case, Docker basically becomes an init system/service manager but you get a singular daemon managing everything

Re: Should I run plain Docker Compose in production in 2026?

#75

Post by kjuulh »

I am using docker-compose everywhere. I really enjoy using it. I have a single thing that is annoying for normal production deployments, and that is that it isn't super easy to have a rolling deployment, I just need two replicas for zero downtime deployment, and I don't really want docker swarm. I think it is the networking which breaks at that point, and you have to have a more involved setup, and at that point I'd just use kubernetes, as I know how that works.

Could i survive with 10 seconds of downtime, probably, but I'd really like if I could avoid it.

Re: Should I run plain Docker Compose in production in 2026?

#76

Post by nijave »

__jonas wrote: post #32

I like running docker compose for my simple needs because it consolidates pretty much all the config in one declarative file, and docker manages 'everything'. By now I know how to handle the handful of caveats listed in this article. Beyond what's listed there, I'd also give a mention to the way port publishing works (the fact that it ignores firewalls), as that's something that still trips people up if they don't kn…

Sounds like they're referring to a dedicated tenancy multi-tenant model

Re: Should I run plain Docker Compose in production in 2026?

#78

Post by nijave »

TheCapeGreek wrote: post #58

Somewhat adjacent in how I look at using Docker at all in prod, here's what I always wonder: Is using Docker/Compose "just" as the layer for installing & managing runtime environment and services correct? Especially for languages like PHP? I.e. am I holding it wrong if I run my "build" processes (npm, composer, etc) on the server at deploy time same as I would without containers? In that sense Docker Composer becomes…

I would say it's bad practice because you end up having to copy all the build dependencies (source code) to the host and you're potentially putting a bunch of extra load on the host during the build process.

Also adds moving parts to your deploy which increases risk/introduces more failure modes.

Couple things that come to mind

- disk space exhaustion during build

- I/o exhaustion esp with package managers that have lots of small files (npm)

However, on the small/hobby end I don't think it's a huge concern.

Re: Should I run plain Docker Compose in production in 2026?

#80

Post by nijave »

jpalomaki wrote: post #29

Kubernetes sounds like overkill, but I've been running microk8s for few standalone servers. This feels a pretty good match when working with agents. Codex can manage the cluster also over ssh, schedule new pods, check statuses, logs etc.

K3s is also pretty nice for a minimal setup

Haven't used it in a while but this thing is also interesting--it supports a bunch of different ways to spin up k8s https://github.com/tilt-dev/ctlptl

Post reply on HN