Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why doesn’t anyone weep for Docker?

techrepublic.com

Post reply on HN
Print view View original

241–248 of 248 posts

Re: Why doesn’t anyone weep for Docker?

#241

Post by GordonS »

Fnoord wrote: post #88
ngrilly wrote: post #68

Earlier quoted context omitted.

Yes, it's a real issue. Kubernetes burns too much RAM and CPU even with no workload.

Docker on macOS also suffers from that issue though.

It will use more on MacOS and Windows than on Linux, as it needs to use a sidecar Linux "Moby" VM to run containers. In practice on Windows, this hasn't been an issue for me (64GB RAM in my dev laptop).

This will actually finally change soon'ish with Windows at least, I think as part of WSL2. Not sure if anything is going to change on MacOS.

Re: Why doesn’t anyone weep for Docker?

#242

Post by GordonS »

_jwjg wrote: post #111
movedx wrote: post #105

Earlier quoted context omitted.

At last, someone who gets it. Absolutely nailed it. Great answer. I never log into my HN account anymore, but for this response I just had to say: yes. Well said. When you boil the Cloud, DevOps, CloudOps, SecOps, *Ops, CI, CD, Containers, VMs, and all the other technologies we've devised over the past ten years, you always end up at the basic building blocks. You eventually come to the conclusion that all we're real…

I am a developer, who also dealt with ops in a small business context. I agree with Ansible striking a good balance between prior experience and the future of automating server configuration. I did a write-up on how I used it on my blog: [link redacted] The workflow worked really well, provisioning Vagrant servers in staging and Digital Ocean droplets in production.

Thanks, I appreciated this blog post - I've struggled to get started with Ansible before, and this was just what I needed!

Re: Why doesn’t anyone weep for Docker?

#243

Post by GordonS »

A little OT, but is there anything remotely competitive with k8s these days? By "competitive", I mean: good feature set, thriving community, active development.

I still use Docker Swarm for small scale stuff, and am pretty happy with it - it's simple, easy to use and doesn't eat resources. But it very much feels like Docker have given up on it.

I'm particularly interested to know if there is anything simpler than k8s that's competitive?

Re: Why doesn’t anyone weep for Docker?

#244

Post by alias_neo »

zwarag wrote: post #139
alias_neo wrote: post #114

My experience agrees with this. I'm a huge fan of Docker, I've actively taken part since the early days, attending meetups and using it actively day to day. Unfortunately, when I brought several issues to GitHub, or +1'd other people's issues that were affecting the usability within our company, the attitude was very much "f* you and your problems" because Docker want things to be one way and that's how it'll be. The…

> ..., I no longer go to Docker to solve problems that could be solved in Docker (secrets anyone? without the "hacks"), and just look towards the other tools solving the problems. Are you talking about k8s or do you mean something like bitnamis sealed secrets?

Hashicorp's Vault and a bunch of your own code, and/or some of their other tools, e.g. Consul.

Re: Why doesn’t anyone weep for Docker?

#245

Post by alias_neo »

pacala wrote: post #128
alias_neo wrote: post #114

My experience agrees with this. I'm a huge fan of Docker, I've actively taken part since the early days, attending meetups and using it actively day to day. Unfortunately, when I brought several issues to GitHub, or +1'd other people's issues that were affecting the usability within our company, the attitude was very much "f* you and your problems" because Docker want things to be one way and that's how it'll be. The…

I wonder how much of that attitude was caused by an overstretched team with no effective scaling mechanism in place. No, "open source" does not automatically mean "scalable team". Part of Kubernetes success is its ability to scale up the community, empowering multiple entities to meaningfully contribute.

I don't have an answer to the why, but I can say that in the 5+ years I've been using it daily, the issues I've faced have been reciprocated by others others, and GitHub reflects this.

Some of the issues are solved by the likes of K8s, but many of us don't want or need K8s for our use cases. Other issues are resolved by other told, and yet still others are only resolved with effort (you still can't expose/bind a port range, e.g. 10000 UDP ports in Docker without killing your server).

Re: Why doesn’t anyone weep for Docker?

#246

Post by vageli »

wokwokwok wrote: post #161
vageli wrote: post #134

Earlier quoted context omitted.

Curious about where you see ansible fit in while using Terraform, could you expand on that? Everywhere I have thought I would need ansible to scratch an itch it has turned out that terraform has that functionality in some way (through null_resource, runners).

personal experience only, but like Dockerfiles, terraform is only good for provisioning until its not. Once your VM or container hits a complexity point above trivial, ansible is very much a useful tool for provisioning container states, and specifically for patching container images to, eg. include security updates. ...beyond that, as in, the intended use case of dynamically updating multiple live machines in parall…

I guess that's the disconnect for me. Why would I want to update individual containers when I can just push out a new image and have automation rotate my services? Individually applying security patches at the container level also means there's probably SSH access as well, something I am quick to remove in environments in which I encounter it.

For host based security patches (if I'm in an environment where the servers aren't managed), adding an item to the crontab in user data usually handles that, and again any fleet-wide changes would usually be propagated by updating the user data, pushing out the change and having automation rotate the fleet.

Re: Why doesn’t anyone weep for Docker?

#247

Post by vageli »

movedx wrote: post #223
vageli wrote: post #134

Earlier quoted context omitted.

Curious about where you see ansible fit in while using Terraform, could you expand on that? Everywhere I have thought I would need ansible to scratch an itch it has turned out that terraform has that functionality in some way (through null_resource, runners).

Terraform is for managing infrastructure. Ansible is for managing configuration. You can argue they're the same thing, but I disagree. I believe in one tool to do one job really well. Terraform is excellent at provisioning and managing infrastructure due in part to its DAG and HCL. On the other hand Ansible has been tuned over the years for managing configuration and the state of anything and everything from the OS u…

I guess what I'm questioning is the place of configuration management tools in a world of increasingly managed services where the server is not patched by you. In those cases, it makes no sense to me to patch individual containers through automation versus updating the image and pushing out the artifact to the service so all containers everywhere are updated and there's no checking for variance in state since all are running the same (updated) image.

Re: Why doesn’t anyone weep for Docker?

#248

Post by peterwwillis »

dsr_ wrote: post #225
peterwwillis wrote: post #219

Earlier quoted context omitted.

I wasn't sure how much your ideas deviated from mine, which I why I said "clarifications"; but you're slightly incorrect. DevOps isn't two philosophical ideas. It's lots of things, and all those things are the methodology. There are many books, podcasts, blogs, conferences, etc that go over all of the things DevOps is. It actually has little to do with tools or software, even though that's basically what it was creat…

Right, it's not a clarification: one of us is objectively wrong.

I think I understand how my comments came off now; sorry for that, and thanks for the clarification.
Post reply on HN