Live data from Hacker News

Why Docker Is Not Yet Succeeding Widely in Production

sirupsen.com

121–130 of 290 posts

Re: Why Docker Is Not Yet Succeeding Widely in Production

#121
post #112

Earlier quoted context omitted.

There's a few projects out now that do most of this for you; there's a lot of rapid innovation in higher-level docker tools. eg https://github.com/remind101/empire (built ontop of EC2/ECS) You get a 12 factor compatible PaaS out of it, pretty easy.

The funny part is that Docker was supposed to be higher level.

it is? its one more step up the chain towards the ultimate goal: being able to run M isolated instances of N different apps automatically distributed across Y physical hosts (and being able to deploy app A without caring about any of this) We're almost there.

Re: Why Docker Is Not Yet Succeeding Widely in Production

#123
I agree with many of the points expressed, and as someone who has used docker in production I have run into many of these issues myself. At the same time, I value composability and I don't want docker to have a single monolithic approach to everything. Garbage collecting old images, fine, even though its not that hard to deal with the issue. Logging and distribution of secrets don't feel like docker-level concerns to me. There are good solutions for both.

Re: Why Docker Is Not Yet Succeeding Widely in Production

#124
post #120
post #11

TL;DR It's too damn complicated if you're not Google/Twitter/Netflix. Most people would be fine just deploying OS packages and keeping their stacks as simple as possible.

That's what you got from the article? I got the opposite. It works fine until you start to have large, complex images where build time becomes a factor and the fundamental design of Docker starts to get in the way (e.g. how it manages diffing of images, the lack of caching, and the inability to build different parts of the image in parallel). These shouldn't be as big of a deal at smaller scale. That's not to say you…

A number of issues discussed in the article would be factors regardless of the scale: --logging, secrets, edgy kernel features, security

Also, see https://titanous.com/posts/docker-insecurity

Re: Why Docker Is Not Yet Succeeding Widely in Production

#126
>Developing the public mental model of containers is integral to Docker’s success and they’re rightly terrified of damaging it.

I guess you can all call me a moron or close to it, to this day, I don't know what a container is good for.

I'm reading this now: https://www.docker.com/whatisdocker

Is this server level, user level, both? Something else? I saw a Hacker Con video and someone was basically containerizing all their apps so that the underlying OS basically did nothing but run the hardware and containers.

Does this mean, one day, instead of monitoring my installs on Mac OS X to see what files were put where so when something breaks I can find those files? I could simply install to a container, my OS would not be touched, and I could delete the container and be back to a stable state?

Can you even get OS X to run on a container? Would it be a good idea or even feasible to install PhotoShop in a container, or not even possible, as that app tosses stuff all over my OS.

Or, is this more like a different way to do things, but it is still AWS and their AMI's or Digital Ocean or any of the others.

I feel I am completely falling behind and have no idea why I would need one of these. Hell, if I made an iOS app, I have no idea if there are Apple servers you pay them to use for stuff, or if you deploy your own servers, or you use something like AWS, and how does that scale on demand, do you have to build that into your s=infrastructure, or is there a "auto scale as demand dictates" checkbox?

Is AWS, Docker, all the rest, in the end, is this just like in the old days where I would have 42U of rack space, put in a DNS server, put in a few http servers, use this as round robin image load balancers, DB servers, backup DB servers, replication DB servers. And when I needed to grow for heavy demand for a day, that was an issue. I fail to see how you can scale based on demand when a database is involved.

Databases scare me, one thing never talked about... We have git for code, what about databases. How does a dev team work that out? If you need a new field, drop some data, alter a table, add an index, etc. How do you get what you have on your local machine in test out to live? How is every little database change tracked and rolled back if need be. How do the DBA guys communicate with the coders to make sure a name change to a table gets updated in the code. Is there git for postgres and others?

All this made sense to me 5 yeas ago when the cloud was called the internet and email, ftp, http, etc were all part of the "cloud" or as I call it "the internet". But now, things are confusing, wrapped up in terms like "cloud" that make no sense to me. I have been, as we all have been, using "the cloud" for over a decade, the first time I logged into a slip account and got on some gopher server or similar, that was cloud to me and I believe it still is. POP email is cloud, the internet is cloud. It is now just convoluted to the developer so end users understand something that really only developers need to understand. Am I making the same mistake with containers, and they are nothing special and have been around for ages like the cloud and it is just a buzzword now? Apple has sandboxing and something called containers in their OS, is this similar in principle?

Auto makers don't burden their end users with engine shop talk, nor dumb it down for them into simple terms, but we seem to with tech. This should be it's own post but I just kinda got on a roll, sorry.

Re: Why Docker Is Not Yet Succeeding Widely in Production

#127
post #64

Earlier quoted context omitted.

[deleted]

Can we please stop sounding the trumpet of "progress"? Containers have been around for nearly a couple of decades (possibly more if you extend the definition), since IBM i had LPARs. There's nothing fast-moving or technologically novel about, especially, Linux containers.

Yeah, but the layered images and copy on write nature of Docker has not and IMHO, that is what is novel about this new wave of containers.

Re: Why Docker Is Not Yet Succeeding Widely in Production

#128

Earlier quoted context omitted.

Docker will likely be more prevalent in a few years with startups who have built their infrastructure form the ground up. The opposite seems likely ... Docker will fade and become deprecated as building infrastructure from the ground up locally to feed into the cloud becomes cheaper and cheaper still. AWS is not always so cost-effective when you truly dig in and crunch the numbers. My guess as to why Docker won't suc…

DevOps/infra guy here rolling out Docker startup-wide at the moment. You and minimaxir are both correct. With regards to docker/lxc/container security, you're right. Some of the biggest players haven't solved the lxc/docker/container security issues yet; its a really hard problem to solve. Breaking out of container will always be easier than breaking out of deeper levels of virtualization (Xen/KVM).

> Breaking out of container will always be easier than breaking out of deeper levels of virtualization (Xen/KVM).

I agree it's not easy to get right, but it doesn't seem necessary that containers will always be leaky. Solaris/Illumos Zones are an OS-level virtualization approach that's pretty airtight, for example.

Re: Why Docker Is Not Yet Succeeding Widely in Production

#129
post #122

I think the author missed orchestration. docker-swarm/docker-machine is still not production ready and kubernetes is too damn complicated to setup outside GCE

Can you share your experiences with Kubernetes setup?

It's pretty complicated with GCE itself. for GCE, I followed this http://kubernetes.io/v1.0/docs/getting-started-guides/gce.ht... guide.

I eventually wanted to set it up in Rackspace where my company cloud lives. I used corekube(https://github.com/metral/corekube) heat templates to set it up but the way to add more minions to the cluster wasn't simple. On top of that there's this complicated networking I have to setup on rackspace, because k8s runs in its own flannel subnet which is actually overlayed on top of an isolated rackspace private subnet. To access the API externally I had to do some NAT manipulation to interface that private subnet to the rackspace public IP just to get the guestbook example working. Dunno how I'd have managed that with a more complex setup of multiple services.

Re: Why Docker Is Not Yet Succeeding Widely in Production

#130

Maybe because Docker isn't really needed ? I mean if your app needs the entire fucking OS to provide isolation from other apps, then you are clearly doing it wrong.

Don't underestimate the amount of people doing things wrong.

Docker could be much more successful in the Windows world, the ability to package very precise versions of databases, libraries, weird obsolete application into one image that can be deployed easily would be extremely helpful in many companies. It would be the wrong solution, but an easy work-around for broken upgrade paths.

Post reply on HN