Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you use Docker in production?

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 157 posts

Re: Ask HN: How do you use Docker in production?

#141

Post by chroem- »

zaptheimpaler wrote: post #140
chroem- wrote: post #139

Earlier quoted context omitted.

>Docker is an open-source project that automates the deployment of applications inside software containers, by providing an additional layer of abstraction and automation of operating system–level virtualization on Linux.

Docker is based on LinuX Containers (LXC), which are much more lightweight than a full OS VM. Containers are basically namespaces for processes, networks so I would expect way lower overhead than a full fledged VM. More details here - http://stackoverflow.com/a/16048358/803923 http://blog.dotcloud.com/under-the-hood-linux-kernels-on-dot... It is a virtualization layer, but not nearly as heavyweight (and perhaps not a…

But for the case of deploying Java applications, it seems particularly redundant. The JVM already has a very extensive security manager framework, and since it's Java it's already write once run everywhere. You can even easily bundle your entire project into a single executable .jar for deployment.

As a Java developer, I can't fathom why someone would want to add a redundant layer of cruft on top of their project. Docker may be the latest trendy thing, but it seems like many of its users aren't entirely sure why they need it.

Edit: I should clarify that I have nothing against hypervisors or other virtualization and sandboxing schemes. However, a lot of people seem to be running Docker, under an outside hypervisor, in order to run their also virtualized language runtime. That strikes me as a bit pointless.

Re: Ask HN: How do you use Docker in production?

#142

Post by HorizonXP »

acous wrote: post #130
HorizonXP wrote: post #113

Docker, CoreOS, fleet, and etcd have completely changed how I build projects. It's made me much more productive. I'm working on Strata, which is a building management & commissioning system for property owners of high-rise smart buildings. It's currently deployed in a single building in downtown Toronto, and it's pulling in data from thousands of devices, and presenting it in real-time via an API and a dashboard. So…

Does Strata have a website?

It does not, currently. Consequences of being a one-person show is that things like that are left on the todo list. Soon though!

Re: Ask HN: How do you use Docker in production?

#143

Post by HorizonXP »

jorlow wrote: post #124
HorizonXP wrote: post #113

Docker, CoreOS, fleet, and etcd have completely changed how I build projects. It's made me much more productive. I'm working on Strata, which is a building management & commissioning system for property owners of high-rise smart buildings. It's currently deployed in a single building in downtown Toronto, and it's pulling in data from thousands of devices, and presenting it in real-time via an API and a dashboard. So…

> They advertise themselves into etcd, and any dependencies are pulled from etcd. That means that the Django app gets the addresses for the PostgreSQL and Redis servers from etcd, and connects that way. If these values change, each container restarts itself as needed. Could you explain a bit more how that works?

Take Postgres for example. I use the official Docker image, and run it via a fleet .service file, having it store its data in a Docker data-only container, also launched from a fleet unit file. Finally, there's a third unit file that runs a slightly customized version of the docker-register image from CoreOS's polvi. This Dockerized app polls the Docker socket every 10s or so to get the IP and port information for the Docker container it's monitoring, in this case Postgres. It PUTs this value into etcd.

Afterwards, when my Django containers start, they pull their configuration from etcd using python-etcd. It will get the IPs and ports for the services, including Postgres, from etcd, and configure itself using that. Finally, it will keep these values in a dictionary. If these values ever differ from what's currently in etcd, then my Django app will send a signal to cause uwsgi to gracefully restart the Django app, so that it can reload itself with the new configuration.

For other Dockerized apps like nginx, I use kelseyhightower's confd-watch to monitor the etcd keys I'm interested in. confd-watch is great because it will use golang's text/template package to allow me to generate configuration files, like nginx.conf, with the values from etcd. So as these values get updated, so will nginx as confd-watch will force a graceful reload.

Hope that helps.

Re: Ask HN: How do you use Docker in production?

#144

Post by HorizonXP »

ownagefool wrote: post #117
HorizonXP wrote: post #113

Docker, CoreOS, fleet, and etcd have completely changed how I build projects. It's made me much more productive. I'm working on Strata, which is a building management & commissioning system for property owners of high-rise smart buildings. It's currently deployed in a single building in downtown Toronto, and it's pulling in data from thousands of devices, and presenting it in real-time via an API and a dashboard. So…

Sounds like it works for you, but you should probably think about redundancy in your hardware there.

I've said it many times, but I inherited the hardware. My current plan is to virtualize a couple of other servers, and then create a VMWare cluster using the extra machines to allow a sort of "auto-failover" setup.

Re: Ask HN: How do you use Docker in production?

#145

Post by zwischenzug »

zenlikethat wrote: post #118
zwischenzug wrote: post #100

Earlier quoted context omitted.

Only true if you don't go to the network: http://zwischenzugs.wordpress.com/2014/07/16/phoenix-deploym...

Very good call out. For most use cases this actually turns out to be OK, but to reduce the surface area of this being a potential issue you could: - Vendor dependencies (works to replace stuff like `go get` but probably not for apt packages etc.) - Create a base image which handles the stuff you need to reach out to the network for (`apt-get install openjdk-6-jre` etc.) and is infrequently updated. Then the Dockerfil…

"- Create a base image which handles the stuff you need to reach out to the network for (`apt-get install openjdk-6-jre` etc.) and is infrequently updated. Then the Dockerfile for the final application is `FROM me/myjava` and just does a few things that don't use the network like `ADD . /code`.

- Use `docker commit` instead of Dockerfiles for those steps (pretty gross IMO)

- Use CM in your docker build to install a very specific version of a package if you need (I'm not 100% sure this exists but it seems probable). This isn't perfect but tightens things up if you're worried about upstream breaking apt packages etc."

These are some of the goals of ShutIt.

We had complex development needs due to technical debt, and dockerfiles simply didn't cut it, and I got frustrated with the indirection of chef/puppet/ansible. I also needed the several hundred devs in my company to get productive quickly, so transferring all the little bash scripts and storing it in docker was the path of least resistance.

It's out of date and heavily edited, but I talk about this here:

http://www.youtube.com/ianmiell

and here:

http://ianmiell.github.io/shutit/

and on my blog:

http://zwischenzugs.wordpress.com/

Re: Ask HN: How do you use Docker in production?

#146

Post by k_bx »

rev_bird wrote: post #77
k_bx wrote: post #76

We use docker for: - running graphite (can't say it was less pain launching it, since Dockerfile was outdated a bit, and I also had to additionally figure out persistency issues, but overall I'm happy it's all virtualized and not living on server itself) - building our haskell projects for specific feature (your run a container per feature, this way you omit pain switching between features when you need to build one)…

So you're using containers in only staging? I can see why it would be appealing, but have you run into complications with staging being structured so differently from production?

I had no problems with staging being different than production (which is kind of multi-machine multi-environment rather than "everything in one docker"), because it all uses same fabric scripts and supervisor configs for deploy and maintainance.

Re: Ask HN: How do you use Docker in production?

#147

Post by positivejam »

grownseed wrote: post #122
positivejam wrote: post #120

Earlier quoted context omitted.

> - Build agents for TeamCity, this was one of the first scenarios and it's been amazingly helpful so far. Can you expand on what you've done with them and how it's been helpful?

The image basically contains (on top of the TeamCity agent itself of course) all the required dependencies. These dependencies are built in exactly the same way (and in the same context) as the ones used for running the code itself (i.e. after building/testing). This basically ensures that the code consistently runs in the same conditions. Using Docker for this also means I can roll out the agents rather painlessly a…

Very cool, thanks!

Re: Ask HN: How do you use Docker in production?

#148

Post by diltonm »

chroem- wrote: post #141
zaptheimpaler wrote: post #140

Earlier quoted context omitted.

Docker is based on LinuX Containers (LXC), which are much more lightweight than a full OS VM. Containers are basically namespaces for processes, networks so I would expect way lower overhead than a full fledged VM. More details here - http://stackoverflow.com/a/16048358/803923 http://blog.dotcloud.com/under-the-hood-linux-kernels-on-dot... It is a virtualization layer, but not nearly as heavyweight (and perhaps not a…

But for the case of deploying Java applications, it seems particularly redundant. The JVM already has a very extensive security manager framework, and since it's Java it's already write once run everywhere. You can even easily bundle your entire project into a single executable .jar for deployment. As a Java developer, I can't fathom why someone would want to add a redundant layer of cruft on top of their project. Do…

It's the daemonizing part that complicates things. Running java -jar MyApp.jar is easy, running it under the control of a system init script, dealing with how to ensure it's restartable as other daemons, logging, log rotation, where Java is really located on the system are all variables that affect any daemonized application; not just Java apps but ones written in any language, Ruby, Python, C or C++.

Docker seems like a good way to "contain" the problem domain challenges I outlined, hoping anyway.

Re: Ask HN: How do you use Docker in production?

#149

Post by CSDude »

mappu wrote: post #133
CSDude wrote: post #121

I use it to grade homeworks, no more open TCP sockets, message queues, open files, some naughties trying to delete my home.

Docker is not safe for untrusted code. If the client can get local root privileges (e.g. CVE-2014-4699, CVE-2014-4014, CVE-2014-0196, unix-privesc-check, many more) they can then escape the docker container. But it's definitely better than running as your own user!

Yes, I am aware, they are run in non root users.

Re: Ask HN: How do you use Docker in production?

#150

Post by djur »

chroem- wrote: post #139
djur wrote: post #136

Earlier quoted context omitted.

Docker is not a virtualization layer.

>Docker is an open-source project that automates the deployment of applications inside software containers, by providing an additional layer of abstraction and automation of operating system–level virtualization on Linux.

You learn something new every day. I've only ever heard the term used to refer to machine-level virtualization. Thanks for the information.
Post reply on HN