Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker 1.2.0, with restart policies

blog.docker.com

Post reply on HN
Print view View original

31–40 of 76 posts

Re: Docker 1.2.0, with restart policies

#31

Post by Alupis »

cpuguy83 wrote: post #24
Alupis wrote: post #23

Earlier quoted context omitted.

Well, simplifying here, but Docker is more-or-less a fancy wrapper for LXC. FreeBSD Jails do a lot more than just make applications portable -- they provide security and isolation between applications (like a super chroot). Jails can be used to safely provide application hosting for various clients while Docker should only be used for your applications (jails prevent clients from messing with the host system nor each…

I don't think you are understanding what docker is doing. Docker interfaces with the kernel to provide security and isolation via cgroups and namespaces. This is exactly what jails does, and is indeed on the list of things to be added. It's really a matter of someone taking the time to write the driver for it. Docker also provides an image format and infrastructure for helping to make applications portable.

> I don't think you are understanding what docker is doing.

Seems like you actually are not understanding what docker is doing. Docker (and LXC for the matter) aren't about security -- they are about portability of the application and environment. Everything else is tertiary.

> It's really a matter of someone taking the time to write the driver for it.

It's a bit more complicated than that -- the two are different beasts with different goals.

> Docker also provides an image format and infrastructure for helping to make applications portable.

This is the main goal of Docker -- making applications and their environment portable.

> Docker interfaces with the kernel to provide security and isolation via cgroups and namespaces

Neither Cgroups nor Namspaces provide security in the same sense as a virtual machine or virtualized app (jails). Cgroups are about resources allocated from the host, and namespaces are about process isolation... but neither prevent different containers from interacting with each other nor the host. This is the security aspect - which Docker (and LXC) were not designed to provide. The problem they solve does not require it.

Use the right tool for the right job. If you are going to host a bunch of applications for different people -- go with virtualization, either via a hypervisor or jail. If you are going to deploy applications in an enterprise environment and need it to be consistent always, across all distros and version -- go with LXC/docker.

Re: Docker 1.2.0, with restart policies

#32

Post by waffle_ss »

Alupis wrote: post #31
cpuguy83 wrote: post #24

Earlier quoted context omitted.

I don't think you are understanding what docker is doing. Docker interfaces with the kernel to provide security and isolation via cgroups and namespaces. This is exactly what jails does, and is indeed on the list of things to be added. It's really a matter of someone taking the time to write the driver for it. Docker also provides an image format and infrastructure for helping to make applications portable.

> I don't think you are understanding what docker is doing. Seems like you actually are not understanding what docker is doing. Docker (and LXC for the matter) aren't about security -- they are about portability of the application and environment. Everything else is tertiary. > It's really a matter of someone taking the time to write the driver for it. It's a bit more complicated than that -- the two are different be…

> Seems like you actually are not understanding what docker is doing

cpuguy83 is a Docker core maintainer: https://github.com/cpuguy83

He's answered plenty of my questions in #docker IRC.

Re: Docker 1.2.0, with restart policies

#33

Post by cpuguy83 »

Alupis wrote: post #31
cpuguy83 wrote: post #24

Earlier quoted context omitted.

I don't think you are understanding what docker is doing. Docker interfaces with the kernel to provide security and isolation via cgroups and namespaces. This is exactly what jails does, and is indeed on the list of things to be added. It's really a matter of someone taking the time to write the driver for it. Docker also provides an image format and infrastructure for helping to make applications portable.

> I don't think you are understanding what docker is doing. Seems like you actually are not understanding what docker is doing. Docker (and LXC for the matter) aren't about security -- they are about portability of the application and environment. Everything else is tertiary. > It's really a matter of someone taking the time to write the driver for it. It's a bit more complicated than that -- the two are different be…

The cgroups and namespaces do indeed provide a layer of security. We also drop certain capabilties, so for instance root inside the container can't (by default) manipulate iptables, mount things, change network settings, etc. To come later would also be user namespaces so root inside the container != root outside the container. There's also a significant amount of support within Docker for selinux/apparmor stuff.

Indeed, all these things come together to do exactly what jails does.

Jails do not provide the same security as a VM, just like what Docker does is not providing that same level of security. You are kidding yourself if you think jails does.

It's all layers... like ogres... or onions :)

Re: Docker 1.2.0, with restart policies

#34

Post by zaphar »

shykes wrote: post #3

Hi all, no World-changing features in this one, but we believe that over time, relentless incremental improvements can make a huge difference. This week we are freezing all feature merges and focusing on refactoring, code cleanup and generally repaying as much technical debt as possible. We are also considering a gradual slowdown of the release cadence (we currently cut a release every month), to give more time for Q…

I literally needed writable /etc/resolv.conf just this morning. You couldn't have timed the release any better.

Re: Docker 1.2.0, with restart policies

#35

Post by lsllc »

waffle_ss wrote: post #2

This is excellent news. The lack of a container restart policy was the main reason why I was spending a bunch of time learning CoreOS and fleet. Trying to get CoreOS installed on VPS providers is a huge pain[0], and fleet and etcd are technically not labelled as production-ready (only CoreOS used as a base OS is)[1], so I'm really glad I can go back to vanilla Docker. [0]: http://serverfault.com/a/620513/85897 [1]: h…

Try Vultr, they support CoreOS (and FreeBSD!).

https://coreos.com/docs/running-coreos/cloud-providers/vultr...

Re: Docker 1.2.0, with restart policies

#36

Post by cpuguy83 »

waffle_ss wrote: post #32
Alupis wrote: post #31

Earlier quoted context omitted.

> I don't think you are understanding what docker is doing. Seems like you actually are not understanding what docker is doing. Docker (and LXC for the matter) aren't about security -- they are about portability of the application and environment. Everything else is tertiary. > It's really a matter of someone taking the time to write the driver for it. It's a bit more complicated than that -- the two are different be…

> Seems like you actually are not understanding what docker is doing cpuguy83 is a Docker core maintainer: https://github.com/cpuguy83 He's answered plenty of my questions in #docker IRC.

I don't know about core maintainer, but I contribute where I can :)

Re: Docker 1.2.0, with restart policies

#37

Post by shykes »

charford wrote: post #11

Any update on when the OS X version will be available? I'm only seeing version 1.1.2 here: https://github.com/boot2docker/osx-installer/releases

The boot2docker devs are running their build right now. The QA for that part is harder to automate (mac, windows, virtualbox etc). I think starting with the next release we'll need to pull in b2d builds as a gateway to the main release process to avoid this problem.

Re: Docker 1.2.0, with restart policies

#38

Post by josteink »

cpuguy83 wrote: post #24
Alupis wrote: post #23

Earlier quoted context omitted.

Well, simplifying here, but Docker is more-or-less a fancy wrapper for LXC. FreeBSD Jails do a lot more than just make applications portable -- they provide security and isolation between applications (like a super chroot). Jails can be used to safely provide application hosting for various clients while Docker should only be used for your applications (jails prevent clients from messing with the host system nor each…

I don't think you are understanding what docker is doing. Docker interfaces with the kernel to provide security and isolation via cgroups and namespaces. This is exactly what jails does, and is indeed on the list of things to be added. It's really a matter of someone taking the time to write the driver for it. Docker also provides an image format and infrastructure for helping to make applications portable.

> I don't think you are understanding what docker is doing. Docker interfaces with the kernel to provide security and isolation via cgroups and namespaces.

If I were to nitpick I would say docker is doing none of those things. LXC is. Docker is just freeloading off LXC while providing almost no benefits.

I tried Docker, but quickly discovered it was a cumbersome interface on top of LXC, and if you wanted to get any real work done, you needed to manage LXC yourself anyway. So ... Why should I bother with Docker in the first place then?

Docker may be good enough for some people, but I feel LXC, which Docker is actually built on is getting no credit, when clearly they deserve 99% of it.

Re: Docker 1.2.0, with restart policies

#39

Post by tlrobinson »

shykes wrote: post #3

Hi all, no World-changing features in this one, but we believe that over time, relentless incremental improvements can make a huge difference. This week we are freezing all feature merges and focusing on refactoring, code cleanup and generally repaying as much technical debt as possible. We are also considering a gradual slowdown of the release cadence (we currently cut a release every month), to give more time for Q…

ravenkat: in case you see this, it looks like you've been hellbanned. Since your question was a reasonable one, I'll copy it here:

"Currently if we restart docker daemon, all the running containers also restart. Are there any plans to keep the running containers running even if we upgrade our docker daemon?"

Re: Docker 1.2.0, with restart policies

#40

Post by shykes »

tlrobinson wrote: post #39
shykes wrote: post #3

Hi all, no World-changing features in this one, but we believe that over time, relentless incremental improvements can make a huge difference. This week we are freezing all feature merges and focusing on refactoring, code cleanup and generally repaying as much technical debt as possible. We are also considering a gradual slowdown of the release cadence (we currently cut a release every month), to give more time for Q…

ravenkat: in case you see this, it looks like you've been hellbanned. Since your question was a reasonable one, I'll copy it here: "Currently if we restart docker daemon, all the running containers also restart. Are there any plans to keep the running containers running even if we upgrade our docker daemon?"

Definitely a reasonable question.

The answer is yes, there are plans to do exactly that :)

Post reply on HN