Docker Considered Harmful (2016)

I've tried and failed a couple times to make Debian packages. The system is so old and crufty, writing a dockerfile is an order of magnitude simpler and there are lots of useful examples and tutorials that were written more recently than 20 years ago.

I think Docker is very useful for beginning developers and for spinning up and trying out services quickly. The barrier for getting started with web development used to be so much higher, even for people on Mac OSX. To setup a rails development environment with a modern JS frontend, you'd have to setup xcode, mysql, redis, a node build pipeline, homebrew, and futz with system ruby vs rails-specific ruby. You'd have to setup all the above, without knowing what each part did, and barely being comfortable with bash vs terminal. Don't even get me started on how difficult it was for someone with a windows machine to get started with modern development.

Now novices can just install docker and type "docker-compose up". Even vagrant didn't make things that easy.

A few years ago, I wanted to try out Pentaho's BI platform. I spent hours configuring the JDK, Tomcat, installing all of Pentaho's dependencies, and struggling with configuration errors and outdated documentation.

Today, If I wanted to give Pentaho a spin, I could also just pull the docker image.

I see your point about most other use-cases for docker, but be careful when you make a blanket statement like "Docker considered harmful". It could be discouraging to those that docker has helped getting started with development and who do find it convenient for certain tasks.

This article could use some work so I thought I'd chime in with my complaints about Docker...

* Patching security vulnerabilities in container images (aka "the next Heartbleed problem") and auditing for the same.

* docker-compose is installed via a curl to github. Say what? It's like Docker revels in ignoring the system's package manager. Docker does not and should not replace apt-get but people pretend it does.

* Too much config delegated to container entrypoint script.

* Firewall rules get wiped out too easily. More a pet peeve of mine but it'd be nice to solve this without "service docker restart".

* "--rm" should probably have been the default and the migration to something better needs to start now.

In the grand scheme of things, nothing too negative to outweigh the benefits although security vulnerabilities give me some pause.

This one?

https://news.ycombinator.com/item?id=9224

"Why would I ever want to use this easy-to-use technology when I could get exactly the same effect by combining 6 different standard tools with some custom software that I've written using my decades of Linux administration experience?"