Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dissatisfied with Docker

robert.ocallahan.org

Post reply on HN
Print view View original

211–220 of 229 posts

Re: Dissatisfied with Docker

#211

Post by e12e »

judge2020 wrote: post #68
neckardt wrote: post #56

I'm surprised nobody is mentioning LXC[1]. I'm by no means a containers expert, but they claim to be more secure since they default to running as non-root. Unlike docker, I had no trouble installing LXC with apt, while with docker I often got an outdated version. I'm now using LXC for all of my basic container applications (self hosting a wiki and a few other sites). [1]: https://linuxcontainers.org/

Docker isn't up to date on the official Ubuntu (and debian too?) repos for some odd reason. A better way is either snap (snapcraft) or adding docker's own apt repository.

Docker (the daemon and tooling) is generally upstream-supplied (ie: docker provides apt repos etc).

Not uncommon for rapidly moving upstream. I wouldn't recommend running distro-supplied docker in general (and neither do docker).

Curated apt repos is nicer than snaps, IMNHO.

Re: Dissatisfied with Docker

#212

Post by e12e »

KaiserPro wrote: post #137

A few things that I would add to that list: o No primitives to deal with secrets. o Terrible disk handling (aufs was just horrid, overlay2 I think misses the point. device mapper is just, silly) o poor speed when downloading and uncompressing images. Of all of them, the most serious is the lack of secrets handling. Basically you have to use environment variables. Yes, you can use docker compose and stuff appears, but…

I don't think you're wrong - but you might want to look at docker swarm over compose (even on single nodes) and:

https://docs.docker.com/engine/swarm/secrets/

(as well as the sibling "config")

Re: Dissatisfied with Docker

#213

Post by ygjb »

paulddraper wrote: post #203
fhgsfkcc wrote: post #202

Earlier quoted context omitted.

secrets don't belong in env vars, because many languages and/or frameworks will happily dump all your env vars to users in the event of misconfiguration or some errors.

I have literally never seen that happen. (Outside a core dump, which has a lot more than env var.) You have any examples in mind?

It happens all the time, especially in security and quality assurance testing. It's less common in modern versions of tools and frameworks, but I routinely encounter these kinds of dumps when I am doing security testing work on anything enterprisey.

Re: Dissatisfied with Docker

#214

Post by e12e »

ehotinger wrote: post #113
est wrote: post #19

All I want is a process that can be frozen and copied to multiple servers. start/stop is merely a state change.

That's quite an oversimplification of the problem, copying stack/heap/etc. Anyways, check out CRIU as a starting point.

(and note that lxd/lxc allows migration based on it. Not sure about copying - I suspect you run into similar issues as fork - who owns the open file handles and other resources?)

Re: Dissatisfied with Docker

#215

Post by fiatjaf »

judge2020 wrote: post #68
neckardt wrote: post #56

I'm surprised nobody is mentioning LXC[1]. I'm by no means a containers expert, but they claim to be more secure since they default to running as non-root. Unlike docker, I had no trouble installing LXC with apt, while with docker I often got an outdated version. I'm now using LXC for all of my basic container applications (self hosting a wiki and a few other sites). [1]: https://linuxcontainers.org/

Docker isn't up to date on the official Ubuntu (and debian too?) repos for some odd reason. A better way is either snap (snapcraft) or adding docker's own apt repository.

snap never works.

Re: Dissatisfied with Docker

#217

Post by soraminazuki »

est wrote: post #19

All I want is a process that can be frozen and copied to multiple servers. start/stop is merely a state change.

You’d be much better off using a VM if you want snapshots. Process snapshots requires that you can:

1. extract all kernel state related to the target process

2. replicate the state on another machine

Both of these are extremely complicated problems.

The first problem is difficult because it’s nearly impossible to isolate all relevant state in the kernel. Process state is closely intertwined with the entire kernel state, making it all too easy to produce an incomplete snapshot that can break the system in all sorts of ways. Worse, things would get more complicated if multiple processes are involved.

The second problem is just as hard if you consider external dependencies or different kernel versions. It might simply be impossible to recreate the process even if you did succeed in creating the perfect snapshot.

Process snapshots are simply not worth the trouble.

Re: Dissatisfied with Docker

#218

Post by FreeHugs »

rlpb wrote: post #184
FreeHugs wrote: post #140

Earlier quoted context omitted.

How do you create an image for LXC? With docker, they have the docker.io service with all types of distros you can chose from.

The project provides prebuilt images for all the common distros: https://us.images.linuxcontainers.org/ Use them in one command. For example: lxc launch images:debian/sid/amd64 Ubuntu, which I believe is the most popular image base in Docker, ships official cloud images, and you can also use these in one command: lxc launch ubuntu:bionic

That sounds dangerous:

    All images available on this server are
    generated using community supported, upstream
    LXC image templates
And:

    Note that the images found on this image server are
    unofficial images. Whenever possible, you should try
    to use official images from your Linux distribution
    of choice

Re: Dissatisfied with Docker

#219

Post by rlpb »

FreeHugs wrote: post #218
rlpb wrote: post #184

Earlier quoted context omitted.

The project provides prebuilt images for all the common distros: https://us.images.linuxcontainers.org/ Use them in one command. For example: lxc launch images:debian/sid/amd64 Ubuntu, which I believe is the most popular image base in Docker, ships official cloud images, and you can also use these in one command: lxc launch ubuntu:bionic

That sounds dangerous: All images available on this server are generated using community supported, upstream LXC image templates And: Note that the images found on this image server are unofficial images. Whenever possible, you should try to use official images from your Linux distribution of choice

That's no different from Docker's community images, is it? And as I pointed out, Ubuntu ships official images, which was demonstrated in my second command.

Re: Dissatisfied with Docker

#220

Post by FreeHugs »

rlpb wrote: post #219
FreeHugs wrote: post #218

Earlier quoted context omitted.

That sounds dangerous: All images available on this server are generated using community supported, upstream LXC image templates And: Note that the images found on this image server are unofficial images. Whenever possible, you should try to use official images from your Linux distribution of choice

That's no different from Docker's community images, is it? And as I pointed out, Ubuntu ships official images, which was demonstrated in my second command.

Don't know about Ubuntu because I use Debian.

docker.io calls their Debian images "official" and says they are maintained by two Debian developers.

Post reply on HN