Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Systemd vs. Docker

lwn.net

Post reply on HN
Print view View original

41–50 of 97 posts

Re: Systemd vs. Docker

#41

Post by DannoHung »

atemerev wrote: post #22
pas wrote: post #16

Earlier quoted context omitted.

I guess he's saying, that you can't just take any random binary and run it in a Docker container, because if that binary spawns a lot of children but does not wait for them, then you'll have a lot of zombies. Docker could run a minimal pid1 in each container to address this. Though if this had been a big issue I guess this would have been already fixed. Naturally, a proof of concept of the problem would be great. (Le…

Supervisord is the officially blessed solution: https://docs.docker.com/engine/admin/using_supervisord/

That is literally not at all what that is suggesting.

Re: Systemd vs. Docker

#42

Post by baldfat »

jimktrains2 wrote: post #5
baldfat wrote: post #3

Earlier quoted context omitted.

> That alone disqualifies it for me right there For philosophy reasons? Can people just not accept that systemd is the main solution that the community has accepted and move along?

Or they can move to one of the BSDs and use jails which are much more stable, secure, and tested than linux containers.

Exactly that is your choice. I am concerned about the drama of systemd by people that don't like systemd always peeing on every and anything that mentions systemd.

It is in the old rpm vs deb, vim vs emacs, python vs perl dram of the past.

Re: Systemd vs. Docker

#43

Post by xaduha »

Wilya wrote: post #29
xaduha wrote: post #8

Earlier quoted context omitted.

Technology isn't that important here, it's what stems from it is. Adoption, infrastructure, tools, community. There's also a price for doing it differently. And believe you me, using BSD nowadays is the definition of doing things differently. What for? What I'm getting for losing my time and reinventing the tools that are already available and much more polished? Dockerfiles can be replicated. Docker Hub can be repli…

Have you used both jails and Docker? Saying docker is a much more polished option doesn't match my experience. Yes, it has more features, but with these features come more bugs. Some of them are minor annoyances. Some are of the "our infrastructure is fucked until we switch our storage driver" kind. Sometimes, stability is a gain.

I'm not comparing Docker and jails, I'm talking about things around. Stackoverflow.com coverage, blogs posts and guides, github repos, publicly available images, etc.

Re: Systemd vs. Docker

#44

Post by agentgt »

vidarh wrote: post #35
agentgt wrote: post #19

Earlier quoted context omitted.

I'm curious what you mean by debug. If you mean monitor all of our apps send metrics, health checks, and logs over the wire I'm sure that is independent. What would docker allow you over the unikernel especially given the best practice push for docker images to only run one thing in a container? IMO with Unikernel Xen aka Hypervisors are the container holders instead of docker.

With a Docker container, I can exec into it and run strace, ltrace, gdb etc.. With a unikernel it all depends on what you have built into the unikernel. That might provide everything I need, or not. The issue is that we will need a lot of toolking to put unikernels on a sufficiently equal footing vs. being able to run decades worth of Linux tools directly in the containers.

The issue I have with that is the tooling you mention while stable and mature is actively being replaced by cloud tools because you really can't just debug a single machine in production when you have a cluster.. not to mention it is production so debug symbols might not even be available.

I understand your point of the maturity w/ tooling but I see it as a serious failure if you have to log into a machine in production and run gdb or IMO any tool. Your app can and should provide healthchecks/monitoring so that you can see if there is a problem (this includes even a thread stack dump).

I'm probably just biased and jaded as I have had some serious technical debt lost to Docker. It just feels like a VM on top of a VM on top of a VM of continuous things to break/learn... I want baremetal :)

Re: Systemd vs. Docker

#45

Post by [deleted] »

_0w8t wrote: post #40
vidarh wrote: post #33

Earlier quoted context omitted.

It has been a reasonably big issue. E.g. I kept seeing zombies with Consul for a while until we realised that every single Consul Docker container on Dockerhub just had Consul run as pid 1 in the container (this is a while ago, no idea if that's still the case), without realising that Consul health checks then could end up as zombies if you weren't very careful about how you wrote them (e.g. typical example: Spawning…

Also see https://github.com/Yelp/dumb-init that is 20K statically built executable perfect for resource constrained containers that have to deal with reaping of arbitrary children.

[deleted]

Re: Systemd vs. Docker

#46

Post by rdtsc »

agentgt wrote: post #19
rdtsc wrote: post #10

Earlier quoted context omitted.

I am a bit with Cantrill on unikernels they sound cool to play with, but I would hate to debug issues with them in production.

I'm curious what you mean by debug. If you mean monitor all of our apps send metrics, health checks, and logs over the wire I'm sure that is independent. What would docker allow you over the unikernel especially given the best practice push for docker images to only run one thing in a container? IMO with Unikernel Xen aka Hypervisors are the container holders instead of docker.

But I am not using docker either ;-)

Re: Systemd vs. Docker

#47

Post by xaduha »

laumars wrote: post #32
xaduha wrote: post #25

Earlier quoted context omitted.

And your point is? A suggestion to switch to BSD and jails for an average user of Docker is laughable.

Well if someone is competent enough to create a Docker image then it's not a great stretch to assume many of them would also be competent enough to create a jail. And FreeBSD is just as easy to use as Linux (actually, I generally find it easier to administrate than Linux since things are more rigorously laid out. But a lot of that is also down to my own personal preference). At the end of the day, both Jails and Dock…

You're missing the point. Even if jails is the most elegant, easy and powerful technology in the world it's still on BSD. People are not going to switch to BSD just because of jails. Sure, then can use both, but why?

Docker and linux containers in general made things easier and more accessible for many. Switching from that to jails doesn't make sense.

Re: Systemd vs. Docker

#48

Post by rdtsc »

agentgt wrote: post #44
vidarh wrote: post #35

Earlier quoted context omitted.

With a Docker container, I can exec into it and run strace, ltrace, gdb etc.. With a unikernel it all depends on what you have built into the unikernel. That might provide everything I need, or not. The issue is that we will need a lot of toolking to put unikernels on a sufficiently equal footing vs. being able to run decades worth of Linux tools directly in the containers.

The issue I have with that is the tooling you mention while stable and mature is actively being replaced by cloud tools because you really can't just debug a single machine in production when you have a cluster.. not to mention it is production so debug symbols might not even be available. I understand your point of the maturity w/ tooling but I see it as a serious failure if you have to log into a machine in product…

> you really can't just debug a single machine in production when you have a cluster

Somehow I ended up debugging, tracing, monitoring and even hotpatching individual machines in the cluster. Yeah the easy problems will show up in the monitoring and logs. The harder ones won't.

Re: Systemd vs. Docker

#49

Post by laumars »

xaduha wrote: post #23
protomyth wrote: post #14

Earlier quoted context omitted.

That's basically the argument to use Windows and Windows-based technology and not Linux. Everything you can do on any of the UNIX boxes, you can do with Windows. It might be different, but it is still a more popular / supported platform. Since I'm not a Windows fan, I find value in doing it differently, and so have Linux fans. I think you will find FreeBSD and SmartOS users find the cost in time to bring a large enou…

> That's basically the argument to use Windows and Windows-based technology and not Linux. Not today it isn't. Years, maybe decades ago it could be. What Linux containers do is help to remove the barrier that various distributions introduced, it makes things more accessible and it's more lightweight than using virtualization. Centos, Alpine, Ubuntu, whatever. As long as it is in a container I can work with it. I can…

> But what jimktrains2 suggesting is complete opposite of that, it reduces options.

Personally I'd consider having familiarity with more than one platform would increase one's options.

But ultimately having other solutions on the market is a good thing. Not only because no one solution is the best at every metric (be it stability, security, speed, memory usage, nor any specific requirements), nor because different solutions can appeal to different personalities. But mostly because different solutions might solve a problem in a unique way that the competing solutions may not have considered - often in ways that can ported and thus benefit the competitors and wider community.

So I wouldn't be so quick to dismiss anything that's outside your field of expertise.

Re: Systemd vs. Docker

#50

Post by pas »

vidarh wrote: post #33
pas wrote: post #16

Earlier quoted context omitted.

I guess he's saying, that you can't just take any random binary and run it in a Docker container, because if that binary spawns a lot of children but does not wait for them, then you'll have a lot of zombies. Docker could run a minimal pid1 in each container to address this. Though if this had been a big issue I guess this would have been already fixed. Naturally, a proof of concept of the problem would be great. (Le…

It has been a reasonably big issue. E.g. I kept seeing zombies with Consul for a while until we realised that every single Consul Docker container on Dockerhub just had Consul run as pid 1 in the container (this is a while ago, no idea if that's still the case), without realising that Consul health checks then could end up as zombies if you weren't very careful about how you wrote them (e.g. typical example: Spawning…

Seeing how even the trivial pid1 "scripts" solve the problem, it's truly baffling why Docker doesn't have a --with-reaper flag.

Also thanks for the Consul example, makes it much-much easier to see the issue and argue for a general solution. (So not every random app/project/service/daemon has to implement pid1 functionality.)

Post reply on HN