Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Considered Harmful (2016)

catern.com

Post reply on HN
Print view View original

151–160 of 188 posts

Re: Docker Considered Harmful (2016)

#151

Post by mmt »

ben509 wrote: post #119
codedokode wrote: post #109

I think that Docker became popular because of very limited functionality of distributions' package managers that doesn't match developers' expectations. Traditionally in Linux there is no concept of "system" and "applications". There is only one large "system" and you can add parts to it. In old times, you downloaded C source code, make'd and installed it. Now you use a package manager to extend your system with new…

> ... because of very limited functionality of distributions' package managers that doesn't match developers' expectations. In particular, package managers don't match the expectations of build systems, because package managers are written by and for ops guys. A sysadmin working on system serving a production load rarely wants to reboot the system, let alone blow it all away and rebuild from scratch. Moreover, the sy…

> A sysadmin working on system serving a production load rarely wants to reboot the system, let alone blow it all away and rebuild from scratch.

Uh, actually, that's exactly what I want. It's just Ops managers [1] who can't seem to wrap their heads around the notion.

I've only once had the luxury to actually get to do that, and it took 5 minutes from IPMI reset to fully running system (scalable up to 100 boxes at a time from a single kickstart server). That was over 10 years ago, too.

> package managers are written by and for ops guys.

I just don't believe that, at least the "by" part. Linux is created by developers, my experience with the two major packaging systems is that the vast majority of the tooling for packaging has to do with the building, not administrative.

> A build system has to account for the fact that devs are tinkering with the code, experimenting, etc. and need to periodically wipe it all away and run it with a clean slate.

Ok.. so how do the Linux distro package build systems fail to account for that?

How does a packaging system have anything to do with the behavior of choosing to start with a clean or dirty slate?

[1] OK, and maybe some, maybe even most sysadmins, but please don't tar us all with the same brush.

Re: Docker Considered Harmful (2016)

#152

Post by sabujp »

the nice thing about docker is that it's been standardized across multiple platforms, we even have windows native containers now. There's also buildkit which one can use to create a cached/incremental build system

Re: Docker Considered Harmful (2016)

#153

Post by rpcope1 »

shaklee3 wrote: post #145
philwelch wrote: post #104

Earlier quoted context omitted.

> One feature driving Docker adoption that I think a lot of people miss is that it's got fairly workable (if warty in one case and obnoxious in the other) implementations for OS X and Windows. That removes a lot of friction for developers who work in companies where IT won't support Linux on employee workstations. Vagrant does this, too. Sure, it runs a VM, but so does Docker.

What does this mean? Docker does not run a VM. It runs cgroups, namespaces, etc.

Inside of Linux, yes Docker does utilize cgroups, namespaces and some other stuff for isolation. However, the GP is almost certainly talking about "Docker for Windows" and "Docker for OS X", which do not run directly on the host OS, and need to be run inside of Linux VMs (like Vagrant).

Re: Docker Considered Harmful (2016)

#154

Post by lsc »

As far as I can tell, Docker is a lot like amazon AWS in that the primary reason to use it in corp (I'm talking about corp IT; as opposed to production/customer facing stuff) is that due to the hype, it somehow got past security, and you are allowed (by corp security types) to do things in it that would require filling out forms in triplicate to do on cheaper or more secure infrastructure.

I've worked places where they wouldn't let us run virtual machines of any type... except docker. Custom docker images were just fine. In the aughts, I worked places where spinning up a virtual machine on our internal infrastructure required manager approval and a day and a half of someone manually jiggering the thing. (I've been that someone doing the jiggering, too) - and I could totally understand that when aws opened for business, people practically fled to that platform.

What's interesting about AWS is that most places still don't have AWS level provisioning of virtual machines, even though there exist tools like ganeti that work and are pretty easy to use (though difficult to tie into accounting)

Re: Docker Considered Harmful (2016)

#155

Post by jcelerier »

geggam wrote: post #90
true_tuna wrote: post #85

Earlier quoted context omitted.

I’d love for this to be true. Have you had anyone come in and do an audit? I find crazy stuff when I show up at No Ops shops and poke around.

Last year we had a $NAME come for an audit. Well known company and they did not know how to audit inside containers. Still not sure how a corporation who runs RHEL contractually is able to use alpine and ubuntu based containers but it happens. I dont work there anymore and I am glad because when the containers finally do get an audit and the customer is told for X years they havent been in compliance.... well..

> Still not sure how a corporation who runs RHEL contractually is able to use alpine and ubuntu based containers but it happens.

... why would it be a problem ?

Re: Docker Considered Harmful (2016)

#156

Post by jcelerier »

spraak wrote: post #139
lalos wrote: post #103

Earlier quoted context omitted.

Reminded me of this HN comment regarding Dropbox right when it launched: https://news.ycombinator.com/item?id=9224

Thanks that was a good laugh (I know, hindsight etc. etc.)

I mean... even today I'd take rsync over dropbox every day. Dropbox certainly fills a need for some people... but not for everyone.

Re: Docker Considered Harmful (2016)

#157

Post by ezoe »

ravenstine wrote: post #55
bunderbunder wrote: post #47

Earlier quoted context omitted.

> Every "Docker Considered Harmful" post I've read basically boils down to "Why would you use Docker if you can use the 10 technologies it wraps around and manage them yourself instead?" Why would I want to do that if I don't have to? Or if you can't? One feature driving Docker adoption that I think a lot of people miss is that it's got fairly workable (if warty in one case and obnoxious in the other) implementations…

> Sure, your ops team can put together a bunch of stuff manually. And then you can create a bunch of extra stuff that makes it easier for development to handle all of that inside virtual machines, and get the network bridging between those apps and the host machine working properly, and all that fun stuff. I think this is one of the biggest reasons people use Docker, although they tend to forget to mention it since i…

Seriously. Just to circumbent the silly restriction of system you don't have root on? GNU Hurd was right all along.

Re: Docker Considered Harmful (2016)

#158

Post by jek0 »

mmt wrote: post #143
jek0 wrote: post #58

Docker wins because it's easy to use and becomes a de-facto standard. The author misses that completely. I get it, you can do "manually" the same things as docker when you're a good system administrator. You'll come up with your own unique solution to most problems addressed by docker. Regardless of the fact that it'll probably be specific to a single linux distribution, you probably won't have anyone interested in i…

> Docker wins because it's easy to use. > The author misses that completely. That's inconsistent with what the article says right in the introductory paragraph: > Docker is genuinely more complex and harder to use than the alternatives. > I'm recommending them because they are simpler to learn and use. You may disagree with their relative ease, but it's disingenuous to say that the author misses that. > You'll come u…

> "Unique" is a pretty extraordinary claim, considering the author is advocating using pre-existing tools and facilities. [...] just because he didn't use them in the Docker way, doesn't make that way unique.

Yes you can make use of the same standard tools as Docker to achieve the same features. There are a multitude of ways you can integrate those (and multiple ways to combine your different options). Docker offers one way, the author describes another way.

The author's way is more unique.

> Docker is genuinely more complex and harder to use than the alternatives.

To make this point, the authors says: "Just read man 7 namespaces. It's well written and makes it easy to grok the concept".

I did, it's super low-level. The audience for this man-page seems to be OS developer, not web developers (or other upper stack level developers).

Any non-system admin can understand the docker documentation, be able to build, distribute and launch container images in less than an hour... Learning to use btrfs or aufs, chroot, ifconfig, init scripts, ..., is easier? Most people never heard of IPC subsystems, UTS, ... and don't need to.

Re: Docker Considered Harmful (2016)

#159

Post by mmt »

jek0 wrote: post #158
mmt wrote: post #143

Earlier quoted context omitted.

> Docker wins because it's easy to use. > The author misses that completely. That's inconsistent with what the article says right in the introductory paragraph: > Docker is genuinely more complex and harder to use than the alternatives. > I'm recommending them because they are simpler to learn and use. You may disagree with their relative ease, but it's disingenuous to say that the author misses that. > You'll come u…

> "Unique" is a pretty extraordinary claim, considering the author is advocating using pre-existing tools and facilities. [...] just because he didn't use them in the Docker way, doesn't make that way unique. Yes you can make use of the same standard tools as Docker to achieve the same features. There are a multitude of ways you can integrate those (and multiple ways to combine your different options). Docker offers…

> The author's way is more unique.

The author's way is merely different. "Unique" is a superlative. The author's method(s) means more choices. There's an argument to be made that enforcing a single choice is inherently simpler (to which there are counter-arguments), but you didn't make it.

> Learning to use btrfs or aufs, chroot, ifconfig, init scripts, ..., is easier?

Yes, that is exactly what the author is asserting. Again, this seems disingenuous of you. It's clear that you disagree, but mere disagreement, with only this kind of rhetorical language, lacking any substantial backing, would be a shallow dismissal.

Re: Docker Considered Harmful (2016)

#160

Post by VeejayRampay »

I'm still waiting for a good Docker tutorial with an actual project using actual bricks that people use in real life (like nginx, an Express app, maybe some memcache, redis, LBs, etc). All the tutorials you find revolve around mundane things like getting your environment ready and never on the actual issues that people face when using the tech.
Post reply on HN