Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LXC vs. Docker

earthly.dev

Post reply on HN
Print view View original

131–140 of 147 posts

Re: LXC vs. Docker

#131

Post by LilBytes »

buybackoff wrote: post #16

LXC via Proxmox is great for stateful deployments on baremetal servers. It's very easy to backup entire containers with the state (SQLite, Postgres dir) to e.g. NAS (and with TrueNAS then to S3/B2). Best used with ZFS raid, with quotas and lazy space allocation backups are small or capped. Nothing stops one from running Docker inside LXC. For development I usually just make a dedicated priviledged LXC container with…

You've basically described my homelab set up here.

Proxmox, a few LXC, each with their own containerisation running.

Re: LXC vs. Docker

#132

Post by LilBytes »

razerbeans wrote: post #75
petre wrote: post #44

Earlier quoted context omitted.

It's an annoying that you can only make snapshots on a stopped container. With VMs it works in a running VM.

Weird, I just tested on my proxmox instance and I was able to create a snapshot of a running container (PVE 7.1-10)

Yeah, I haven't got these issues either.

Re: LXC vs. Docker

#133

Post by m463 »

richardwhiuk wrote: post #67
m463 wrote: post #66

Earlier quoted context omitted.

I would say docker's killer feature is the Dockerfile. It makes it understandable, reproducible and available to a broad range of people. At least they mentioned it in their apple:oranges comparison. there's also the global namespace thing. "FROM ubuntu:18.04" is pretty powerful. I run a proxmox server with LXC but if I could use a dockerfile or equivalent, my containers would be much much more organized. I wouldn't…

Understandable? Yes. Reproducible? No. Most Dockerfiles are incredibly unreproducible.

I think it's more reproducible like a recipe.

Yes, baking doesn't work the same at sea level vs say denver colorado @ 1 mile, but pretty much you can share your recipe with friends and save them lots of time.

Re: LXC vs. Docker

#134

Post by leephillips »

sickygnar wrote: post #31

I never hear systemd-nspawn mentioned in these discussions. It ships and integrates with systemd and has a decent interface with machinectl. Does anyone use it?

That’s what I use whenever I need a container. So simple and flexible.

Re: LXC vs. Docker

#135

Post by fuzzy2 »

heresie-dabord wrote: post #72
fuzzy2 wrote: post #28

I’ve been using LXC as a lightweight “virtualization” platform for over 5 years now, with great success. It allows me to take existing installations of entire operating systems and put them in containers. Awesome stuff. On my home server, I have a VNC terminal server LXC container that is separate from the host system. Combined with ipvlan I can flexibly assign my dedicated server’s IP addresses to containers as requ…

> . It allows me to take existing installations of entire operating systems and put them in containers Friend, do you have documentation for this process? Please share your knowledge. ^_^

Nothing too spectacular, I’m afraid. I had to consolidate some physical machines, all running Gentoo Linux. For each, I simply created a Gentoo LXC container and then replaced the rootfs (in /var/lib/lxc/NAME/rootfs) with the one from the physical server.

The significant changes from the physical systems were:

* rc_provide="net" in rc.conf because base networking is controlled externally

* rc_sys="lxc" may or may not be necessary

* Disable various net setup services

On the host OS (Debian) I have interfaces like this:

    auto ipvl-main
    iface ipvl-main inet manual
       pre-up ip link add link eth0 name ipvl-main type ipvlan mode l2
       post-down ip link delete ipvl-main
In the container config, they are referenced this way:

    lxc.net.2.type = phys
    lxc.net.2.link = ipvl-main
    lxc.net.2.ipv4.address = 1.2.3.4/29
    lxc.net.2.ipv4.gateway = 1.2.3.1
    lxc.net.2.ipv6.address = abcd::2/128
    lxc.net.2.ipv6.gateway = fe80::1
    lxc.net.2.flags = up
Later on, I removed the dedicated IP address and set up a reverse proxy instead.

Oh yeah, all containers are of course privileged containers. With unprivileged containers, various things may not work as expected.

Re: LXC vs. Docker

#137

Post by zelphirkalt »

stickyricky wrote: post #94
zelphirkalt wrote: post #87

Earlier quoted context omitted.

Neither SSH not VSCode offer any kind of isolation out of the box.

I mean running docker on the remote machine and just sshing into it. I assume changing the docker host on OSX just means a command is being sent over the network. Just wondering why prioritize "local" development if its all remote anyway.

Setting up SSH inside a container and being able to SSH into the container wasn't so trivial to do, last time I read about it. If I recall correctly, there were also some host system security implications. What do you mean by 'prioritize "local" development'?

Re: LXC vs. Docker

#138

Post by markkrj »

dijit wrote: post #22
botdan wrote: post #14

Earlier quoted context omitted.

Do you have any more information about how you're doing this? Whenever I've tried to use Docker as a remote development environment the process felt very foreign and convoluted.

I know what you mean, It depends a little bit on your topology. If you have a secure network then it’s perfectly fine to expose the docker port on the network in plaintext without authentication. Otherwise you can use Port forwarding over SSH. To set up networked docker you can follow this: https://docs.docker.com/engine/security/protect-access/ I’m on the phone so can’t give a detailed guide.

Or you can use a docker as a ssh host using context, or just $DOCKER_HOST=ssh://myremote... See https://stackoverflow.com/questions/44056501/how-can-i-remot...

Re: LXC vs. Docker

#139

Post by stickyricky »

zelphirkalt wrote: post #137
stickyricky wrote: post #94

Earlier quoted context omitted.

I mean running docker on the remote machine and just sshing into it. I assume changing the docker host on OSX just means a command is being sent over the network. Just wondering why prioritize "local" development if its all remote anyway.

Setting up SSH inside a container and being able to SSH into the container wasn't so trivial to do, last time I read about it. If I recall correctly, there were also some host system security implications. What do you mean by 'prioritize "local" development'?

"Machine A" SSHes into "Machine B". "Machine B" is running Docker. You run docker commands on "Machine B". The output of the command is returned to "Machine A". I.e. a normal ssh session. At no point do you ssh into a container.

Re: LXC vs. Docker

#140

Post by CSDude »

zibzab wrote: post #106
CSDude wrote: post #84

Earlier quoted context omitted.

I had a huge argument in 2015 with a guy that wanted to move our every custom .deb package (100+) to Snap, because they had talked with Canonical and it would be the future, Docker would be obsolete. Main argument was to make distribution easier to worker/headless/server machines. Not that Docker is a direct replacement, but Snap is an abomination. They are mostly out of date, most of them requires system privilleges…

pro tip: you can use lxc/lxd to run VMs under the same infrastructure. I belive it is something as easy as lxc launch -vm ubuntu/20.04 myvm

Wow, cannot wait to try it! Thanks for the tip.
Post reply on HN