Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Systemd vs. Docker

lwn.net

Post reply on HN
Print view View original

31–40 of 97 posts

Re: Systemd vs. Docker

#31

Post by kordless »

bryanlarsen wrote: post #6
pmoriarty wrote: post #2

CoreOS's Rocket is built around systemd? That alone disqualifies it for me right there.

Why the systemd hate? Because it's a big monolithic project that takes over your system? You do realize that Docker is much more monolithic and opinionated than systemd, right?

When you ask questions, especially leading ones, it causes a good deal of confusion around the topic at hand. The reasons behind this are complex, but they have something to do with our tendency to double bind each other.

Someone has the right to say why something is "disqualified" for them, even if it is devoid of context. What is awesome here is that the leading expert for this topic is replying directly to the negative (empty) opinion and actually presents a (rich) alternate opinion.

How does you asking unanswerable questions contribute to resolving the conversation to something we can all learn from?

Re: Systemd vs. Docker

#32

Post by laumars »

xaduha wrote: post #25
laumars wrote: post #21

Earlier quoted context omitted.

You do realise that "different" platforms can still be popular enough to have a lot of the same ecosystems. Hell, Docker itself used to be the "alternative"; not even that long ago in fact. FreeBSD might only have a fraction of the community that Linux does, but that's still a pretty large number of developers and sysadmins in real world terms. Disclosure: I run both FreeBSD and Linux systems.

And your point is? A suggestion to switch to BSD and jails for an average user of Docker is laughable.

Well if someone is competent enough to create a Docker image then it's not a great stretch to assume many of them would also be competent enough to create a jail. And FreeBSD is just as easy to use as Linux (actually, I generally find it easier to administrate than Linux since things are more rigorously laid out. But a lot of that is also down to my own personal preference).

At the end of the day, both Jails and Docker are well documented. So even the people only interested in blindly copying and pasting commands should be able do the basics.

The real problem FreeBSD and jails face isn't with support nor accessibility but rather dumb prejudice. Much like why many Windows users think Linux is difficult. If you spend your whole time shouting that your way of doing things is the best then you're never going to give anything else a fair chance.

Re: Systemd vs. Docker

#33

Post by vidarh »

pas wrote: post #16
thwarted wrote: post #13

Poettering says that PID 1 has special requirements. One of these is killing "zombie" processes that have been abandoned by their calling session. This is a real problem for Docker since the application runs as PID 1 and does not handle the zombie processes. For example, containers running the Oracle database can end up with thousands of zombie processes. Why does Poettering keep claiming this when he's the one who s…

I guess he's saying, that you can't just take any random binary and run it in a Docker container, because if that binary spawns a lot of children but does not wait for them, then you'll have a lot of zombies. Docker could run a minimal pid1 in each container to address this. Though if this had been a big issue I guess this would have been already fixed. Naturally, a proof of concept of the problem would be great. (Le…

It has been a reasonably big issue. E.g. I kept seeing zombies with Consul for a while until we realised that every single Consul Docker container on Dockerhub just had Consul run as pid 1 in the container (this is a while ago, no idea if that's still the case), without realising that Consul health checks then could end up as zombies if you weren't very careful about how you wrote them (e.g. typical example: Spawning curl from a shell script, with a timeout on the health check that was shorter than any timeouts on the curl requests).

It's usually fairly simple to fix (e.g. for Consul above, I raised it with the Consul guys and they said they'd look at adding waiting on children to it as a precaution - it's just a couple of lines -, but people building containers could also introduce a minimal init, or you can write your health checks to guard against it), but it happens all over the place, and people are often unaware and so not on the lookout for it and it may not be immediately obvious.

The reason I raised it as an issue for Consul, for example, even though it wasn't really their fault, but an issue with the containers, is that people need to be aware of the problem when packaging the containers, need to be aware that a given application may spawn children, and that they may not wait for them. Even a lot of people aware of the zombie issue end up packaging software that they didn't realise where spawning child processes that could end up as zombies (in this case, it took running it in a container without a proper pid 1, using health checks which not everyone will do, and writing the health checks in a particular way in order to notice the effects).

Thankfully there are a number of tiny little inits. E.g. there's suckless sinit [1], Tini[2] , and here's a tiny little proof of concept Go init [3] I wrote (though frankly, suckless or Tini compiled with musl will give you a much smaller binary) as what little you actually need to do is very trivial.

[1] http://git.suckless.org/sinit

[2] https://github.com/krallin/tini

[3] https://gist.github.com/vidarh/91a110792c86d6c3bb41

Re: Systemd vs. Docker

#34

Post by baldfat »

michaelmrose wrote: post #15
baldfat wrote: post #3

Earlier quoted context omitted.

> That alone disqualifies it for me right there For philosophy reasons? Can people just not accept that systemd is the main solution that the community has accepted and move along?

The concept of the community is an abstraction and in this case a bad one. There is no community. There are a million different individuals and within that thousands of communities each composed of some subset of those individuals. There is no reason each subset or each individual even shouldn't have their own opinion and based their actions upon it.

> There is no community

The very foundation of Open Source / Free Software Movement is 100% community. The very foundation of Closed Source is "There is no community." Community isn't an abstraction but is what has built Linux.

To quote RMS (Who I disagree most of the time but highly respect)

>Tens of millions of people around the world now use free software; the public schools of some regions of India and Spain now teach all students to use the free GNU/Linux operating system. Most of these users, however, have never heard of the ethical reasons for which we developed this system and built the free software community, because nowadays this system and community are more often spoken of as “open source”, attributing them to a different philosophy in which these freedoms are hardly mentioned. http://www.gnu.org/philosophy/open-source-misses-the-point.e...

> There is no reason each subset or each individual even shouldn't have their own opinion and based their actions upon it

100% my point move to your choice and don't pee on systemd every time it is brought up. Your opinion is different then the majority in regards to systemd and you can use those options and not have to discount everyone else's choice.

Re: Systemd vs. Docker

#35

Post by vidarh »

agentgt wrote: post #19
rdtsc wrote: post #10

Earlier quoted context omitted.

I am a bit with Cantrill on unikernels they sound cool to play with, but I would hate to debug issues with them in production.

I'm curious what you mean by debug. If you mean monitor all of our apps send metrics, health checks, and logs over the wire I'm sure that is independent. What would docker allow you over the unikernel especially given the best practice push for docker images to only run one thing in a container? IMO with Unikernel Xen aka Hypervisors are the container holders instead of docker.

With a Docker container, I can exec into it and run strace, ltrace, gdb etc.. With a unikernel it all depends on what you have built into the unikernel. That might provide everything I need, or not. The issue is that we will need a lot of toolking to put unikernels on a sufficiently equal footing vs. being able to run decades worth of Linux tools directly in the containers.

Re: Systemd vs. Docker

#36

Post by bryanlarsen »

atemerev wrote: post #30
bryanlarsen wrote: post #26

Earlier quoted context omitted.

Can you explain your position to me? I can understand somebody who dislikes systemd and dislikes docker. I can understand somebody who likes both systemd and docker. But disliking systemd but liking docker? That I don't understand. Any effective criticism of systemd that I've heard generally can also be applied to docker. Like yours: "I wonder if systemd is actually a part of big plan of moving everyone to microservi…

Docker is just a toolkit for composing and networking layered OS images. It improves isolation of things and adheres to simple principles (immutable containers, restarting instead attempting to recover, etc.) It structures things better. Inter-container communication is deliberately simple (env variables and, recently, networking). Systemd spits on isolation, it embraces integration of everything. Supervision, loggin…

Your criticism of systemd still applies to docker. "Supervision, logging, communication, IO, configuration, state management — everything goes through docker"

If I use systemd I have to type 'systemd logs' to get at my logs, or I can use a plugin to move it somewhere else. If I use docker I have to type 'docker logs', or I can use a plugin to move it somewhere else. etc. etc.

P.S. Agree completely with your praise of Docker. I'm firmly in the 'love both systemd and docker and wish they got along' camp.

Re: Systemd vs. Docker

#37

Post by vidarh »

jimktrains2 wrote: post #5
baldfat wrote: post #3

Earlier quoted context omitted.

> That alone disqualifies it for me right there For philosophy reasons? Can people just not accept that systemd is the main solution that the community has accepted and move along?

Or they can move to one of the BSDs and use jails which are much more stable, secure, and tested than linux containers.

Rocket is not limited to Linux containers. It can also run in VMs. Incidentally there are also solutions to run Docker containers in VMs (Rocket itself should able to, but there are others as well, like hyper.sh)

Re: Systemd vs. Docker

#38

Post by vidarh »

atemerev wrote: post #30
bryanlarsen wrote: post #26

Earlier quoted context omitted.

Can you explain your position to me? I can understand somebody who dislikes systemd and dislikes docker. I can understand somebody who likes both systemd and docker. But disliking systemd but liking docker? That I don't understand. Any effective criticism of systemd that I've heard generally can also be applied to docker. Like yours: "I wonder if systemd is actually a part of big plan of moving everyone to microservi…

Docker is just a toolkit for composing and networking layered OS images. It improves isolation of things and adheres to simple principles (immutable containers, restarting instead attempting to recover, etc.) It structures things better. Inter-container communication is deliberately simple (env variables and, recently, networking). Systemd spits on isolation, it embraces integration of everything. Supervision, loggin…

Isolation and integration are not opposites. You can increase isolation (through e.g. judicious application of cgroups, which systemd encourages and makes use of) while also increasing integration (e.g. sharing APIs).

Docker is to me far more problematic when it comes to integration. It is trying to make everything go through itself, without providing a fraction of the scheduling and management capabilities that systemd does. Of of the motivations for Rocket is exactly that it allows for a far less monolithic experience than Docker - even when integrated with systemd.

Re: Systemd vs. Docker

#39

Post by [deleted] »

baldfat wrote: post #34
michaelmrose wrote: post #15

Earlier quoted context omitted.

The concept of the community is an abstraction and in this case a bad one. There is no community. There are a million different individuals and within that thousands of communities each composed of some subset of those individuals. There is no reason each subset or each individual even shouldn't have their own opinion and based their actions upon it.

> There is no community The very foundation of Open Source / Free Software Movement is 100% community. The very foundation of Closed Source is "There is no community." Community isn't an abstraction but is what has built Linux. To quote RMS (Who I disagree most of the time but highly respect) >Tens of millions of people around the world now use free software; the public schools of some regions of India and Spain now…

[deleted]

Re: Systemd vs. Docker

#40

Post by _0w8t »

vidarh wrote: post #33
pas wrote: post #16

Earlier quoted context omitted.

I guess he's saying, that you can't just take any random binary and run it in a Docker container, because if that binary spawns a lot of children but does not wait for them, then you'll have a lot of zombies. Docker could run a minimal pid1 in each container to address this. Though if this had been a big issue I guess this would have been already fixed. Naturally, a proof of concept of the problem would be great. (Le…

It has been a reasonably big issue. E.g. I kept seeing zombies with Consul for a while until we realised that every single Consul Docker container on Dockerhub just had Consul run as pid 1 in the container (this is a while ago, no idea if that's still the case), without realising that Consul health checks then could end up as zombies if you weren't very careful about how you wrote them (e.g. typical example: Spawning…

Also see https://github.com/Yelp/dumb-init that is 20K statically built executable perfect for resource constrained containers that have to deal with reaping of arbitrary children.
Post reply on HN