Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Container Filesystem Works: Building a Docker-Like Container from Scratch

labs.iximiuz.com

Post reply on HN
Print view View original

11–20 of 34 posts

Re: How Container Filesystem Works: Building a Docker-Like Container from Scratch

#11

Post by mikepurvis »

akdev1l wrote: post #7
vbezhenar wrote: post #5

Earlier quoted context omitted.

Docker is a genius idea which looks obvious in retrospect, but someone need to invent it. Docker is more than just chroot. You also need: overlay file system; OCI registry and community behind it, to create thousands of useful images. And, of course, the whole idea of creating images layer by layer and using immutable images to spawn mutable containers. I don't actually think that you need network or process isolatio…

network isolation is very important too, that’s what lets people run 4 containers all listening on port 80 process isolation is less prominent

Process isolation is more about load management/balancing, which is more of a production concern than a development one.

Re: How Container Filesystem Works: Building a Docker-Like Container from Scratch

#12

Post by mikepurvis »

Yeroc wrote: post #6
interroboink wrote: post #4

Earlier quoted context omitted.

FreeBSD has had jails since version 4 (~year 2000), fwiw. Much of the technology was there, but Docker was able to achieve a critical mass, with streamlined workflows. Perhaps as much a social phenomenon as a technical one?

I think the real genius of Docker was the image packaging. The pieces were there but delivery and scripting it all wasn't easy.

Indeed. Even to this day, debootstrap feels a bit arcane and unapproachable, particularly relative to `docker pull ubuntu`.

Re: How Container Filesystem Works: Building a Docker-Like Container from Scratch

#13

Post by magicalhippo »

interroboink wrote: post #4
zoobab wrote: post #2

We had chroot since 1979, nobody managed to build a docker like wrapper for chroot which do not require netns?

FreeBSD has had jails since version 4 (~year 2000), fwiw. Much of the technology was there, but Docker was able to achieve a critical mass, with streamlined workflows. Perhaps as much a social phenomenon as a technical one?

I used FreeBSD on my firewall in the early 2000s, and on my NAS from around 2007 till last year.

The big pain with jails for me was the tooling. There was a number of non-trivial steps needed to get a jail that could host a networked service, with a lot that could go wrong along the way.

Sure a proper sysadmin would learn and internalize these steps, but as someone who just used it now and again it was a pain.

Way down the line things like iocage came along, but it was fragile and not reliable when I tried it, leading to jails in weird states and such.

So I gave up and moved to Linux so I could use Docker.

Super easy to spin up a new service, and fairly self-documenting as you just configure everything in a script or compose file so much less to remember.

Initially in a VM on Bhyve, now on bare metal.

It feels a bit sad though, as jails had some nice capabilities due to the extra isolation.

Re: How Container Filesystem Works: Building a Docker-Like Container from Scratch

#14

Post by oftenwrong »

interroboink wrote: post #4
zoobab wrote: post #2

We had chroot since 1979, nobody managed to build a docker like wrapper for chroot which do not require netns?

FreeBSD has had jails since version 4 (~year 2000), fwiw. Much of the technology was there, but Docker was able to achieve a critical mass, with streamlined workflows. Perhaps as much a social phenomenon as a technical one?

Don't discount the technical innovation required to integrate existing technologies in a novel and useful way. Docker was an "off the shelf" experience unlike any other solution at the time. You could `docker run ...` and have the entire container environment delivered incrementally on demand with almost no setup required. It did have a social factor in that it was easy for people to publish their own images and share them. Docker Hub was provided as a completely free distribution service. The way they made distribution effortless was no doubt a major factor in why it took off.

https://www.youtube.com/watch?v=wW9CAH9nSLs

Re: How Container Filesystem Works: Building a Docker-Like Container from Scratch

#15

Post by miladyincontrol »

ronsor wrote: post #3
zoobab wrote: post #2

We had chroot since 1979, nobody managed to build a docker like wrapper for chroot which do not require netns?

Chroot has significantly less isolation than Linux namespaces as used by Docker.

This, better yet just use systemd-nspawn. Benefits of proper containers, configuration similar to any ol systemd service, super easy to use, simple to automate builds with mkosi.

The one thing people really seem to miss on them is like, contrary to popular belief you dont need a whole OS container there, minimal distroless containers work just fine with systemd-nspawn similar to as they would on docker.

Re: How Container Filesystem Works: Building a Docker-Like Container from Scratch

#16

Post by vbezhenar »

akdev1l wrote: post #7
vbezhenar wrote: post #5

Earlier quoted context omitted.

Docker is a genius idea which looks obvious in retrospect, but someone need to invent it. Docker is more than just chroot. You also need: overlay file system; OCI registry and community behind it, to create thousands of useful images. And, of course, the whole idea of creating images layer by layer and using immutable images to spawn mutable containers. I don't actually think that you need network or process isolatio…

network isolation is very important too, that’s what lets people run 4 containers all listening on port 80 process isolation is less prominent

You can bind your application to 127.0.0.2 for one container and to 127.0.0.3 for another container. Both can listen on port 80 and both can communicate with each other. And you can run another container, binding to 1.2.3.4:80 and using it as reverse-router. You can use iptables/nftables to prevent undesired connections and manually (or with some scripting) crafted /etc/hosts for named hosts to point to those loopback addresses. Or just DNS server. It's all doable.

The only thing that you need is the ability to configure a target application to choose address to bind to. But any sane application have that configuration knob.

Of course things are much easier with network namespaces, but you can go pretty far with host network (and I'd say it might be easier to understand and manage).

Re: How Container Filesystem Works: Building a Docker-Like Container from Scratch

#17

Post by jayd16 »

interroboink wrote: post #4
zoobab wrote: post #2

We had chroot since 1979, nobody managed to build a docker like wrapper for chroot which do not require netns?

FreeBSD has had jails since version 4 (~year 2000), fwiw. Much of the technology was there, but Docker was able to achieve a critical mass, with streamlined workflows. Perhaps as much a social phenomenon as a technical one?

There was clear incremental progress. Some of it can be seen in how mobile app isolation shook out as well.

Re: How Container Filesystem Works: Building a Docker-Like Container from Scratch

#18

Post by lyu07282 »

vbezhenar wrote: post #5
zoobab wrote: post #2

We had chroot since 1979, nobody managed to build a docker like wrapper for chroot which do not require netns?

Docker is a genius idea which looks obvious in retrospect, but someone need to invent it. Docker is more than just chroot. You also need: overlay file system; OCI registry and community behind it, to create thousands of useful images. And, of course, the whole idea of creating images layer by layer and using immutable images to spawn mutable containers. I don't actually think that you need network or process isolatio…

What I always wondered is why qcow2 + qemu never gave rise to a similar system, they support snapshots/backing-files so it should be possible to implement a system similar to docker? Instead what we got is just this terrible libvirt.
Post reply on HN