Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Considered Harmful (2016)

catern.com

Post reply on HN
Print view View original

41–50 of 188 posts

Re: Docker Considered Harmful (2016)

#41

Post by NightlyDev »

Steltek wrote: post #25

This article could use some work so I thought I'd chime in with my complaints about Docker... * Patching security vulnerabilities in container images (aka "the next Heartbleed problem") and auditing for the same. * docker-compose is installed via a curl to github. Say what? It's like Docker revels in ignoring the system's package manager. Docker does not and should not replace apt-get but people pretend it does. * To…

About firewalls and docker... It's so fu##ing annoying that docker changes the default iptables setting for forwarding when installed. :@

Re: Docker Considered Harmful (2016)

#42

Post by wmf »

aespinoza wrote: post #28

What I got out of this post is a very good insight in how Docker works internally. And it does raise my interest in containers. I have been disconnected from the cloud for quite some time, but I have always been interested in sandboxes, mainly for security purposes. I have used chroot before, seccomp, apparmor and firejail. This is not related to Docker directly, but the author makes the bridge for Docker to be inter…

If you want to learn more about container security I recommend https://blog.jessfraz.com/ and https://github.com/projectatomic/bubblewrap

Re: Docker Considered Harmful (2016)

#44

Post by geggam »

merb wrote: post #38
geggam wrote: post #31

Earlier quoted context omitted.

Whereas my AWS autoscale group does it for me while I go get me a foo foo drink at $ESTABLISHMENT

sadly it's not cheap to built aws on bare metal.

And you think k8s is simple to run on bare metal ?

To care and maintain ?

Do you understand the kernel tuning and routing Google does to avoid the NAT hell you are going to run into when you manage k8s on your own ?

Re: Docker Considered Harmful (2016)

#45

Post by closed »

Steltek wrote: post #25

This article could use some work so I thought I'd chime in with my complaints about Docker... * Patching security vulnerabilities in container images (aka "the next Heartbleed problem") and auditing for the same. * docker-compose is installed via a curl to github. Say what? It's like Docker revels in ignoring the system's package manager. Docker does not and should not replace apt-get but people pretend it does. * To…

> docker-compose is installed via a curl to github.

pip install docker-compose

Re: Docker Considered Harmful (2016)

#46

Post by NightlyDev »

ghshephard wrote: post #24

Docker by itself probably doesn't make any sense to an engineer until they get a chance to see kubernetes in action. There is nothing more awesome than seeing, on the fly, your worker pool being scaled out by 100x by nothing more than kubectl --context k8s-uw1a-gcp -n customerx scale deploy someapp_worker --replicas 100 to make you appreciate what docker can do for you.

One could do the same thing with other stuff too. Everything from bare metal to other application containers, and everything in between.

I do think that docker is very overhyped, but it does also solve some problems in a good way, even though it also creates new problems.

Re: Docker Considered Harmful (2016)

#47

Post by bunderbunder »

andrewguenther wrote: post #12

Like any hyped up technology, Docker gets pitched as an "easy, works out of the box, secure by default solution" but it is almost anything but. But also like any technology, if you take the time to really understand what it is doing and what problems it can solve for you, it can be really awesome to work with. Every "Docker Considered Harmful" post I've read basically boils down to "Why would you use Docker if you ca…

> Every "Docker Considered Harmful" post I've read basically boils down to "Why would you use Docker if you can use the 10 technologies it wraps around and manage them yourself instead?" Why would I want to do that if I don't have to?

Or if you can't?

One feature driving Docker adoption that I think a lot of people miss is that it's got fairly workable (if warty in one case and obnoxious in the other) implementations for OS X and Windows. That removes a lot of friction for developers who work in companies where IT won't support Linux on employee workstations.

Sure, your ops team can put together a bunch of stuff manually. And then you can create a bunch of extra stuff that makes it easier for development to handle all of that inside virtual machines, and get the network bridging between those apps and the host machine working properly, and all that fun stuff. And by the time you've got it completed and working nicely, you'll be ready to launch your own Docker competitor onto the market.

Re: Docker Considered Harmful (2016)

#48

Post by aespinoza »

wmf wrote: post #42
aespinoza wrote: post #28

What I got out of this post is a very good insight in how Docker works internally. And it does raise my interest in containers. I have been disconnected from the cloud for quite some time, but I have always been interested in sandboxes, mainly for security purposes. I have used chroot before, seccomp, apparmor and firejail. This is not related to Docker directly, but the author makes the bridge for Docker to be inter…

If you want to learn more about container security I recommend https://blog.jessfraz.com/ and https://github.com/projectatomic/bubblewrap

Thank you very much for sharing. These links have been added to my bookmarks.

Re: Docker Considered Harmful (2016)

#49

Post by trowawee »

vajrapani666 wrote: post #23

I think Docker is very useful for beginning developers and for spinning up and trying out services quickly. The barrier for getting started with web development used to be so much higher, even for people on Mac OSX. To setup a rails development environment with a modern JS frontend, you'd have to setup xcode, mysql, redis, a node build pipeline, homebrew, and futz with system ruby vs rails-specific ruby. You'd have t…

Your first point alone would make Docker worth it for me if that was literally all it did. I've on-boarded junior devs on several projects over the last few years, and being able to give them pull access, send them the instructions for installing Docker and docker-compose and then having a working dev environment on their local device an hour after they open their computer for the first time is invaluable. The whole universe of tools that have grown up around Docker are also fantastic, but erasing the friction of starting up is a killer application on its own (also, making it so I never again have to hear "Well it works on my machine!" is also, on its own, worth pretty much any pain Docker brings).

And what I've seen is that at some point, at least a few of the junior devs get interested in what's going on under the hood and ta-da, we have our candidates for dev-ops work. Erasing the initial friction doesn't mean they erase their curiosity.

Re: Docker Considered Harmful (2016)

#50

Post by pknopf »

cremp wrote: post #11
bbrunner wrote: post #6

This feels a bit like "Why use Dropbox when rsync exists?" type of argument. Sure, you can do everything docker does with shell scripts, and you've been able to for decades, but many people didn't, because it was "complicated". There is often a huge amount of value in simplifying things, even if it means losing some of the power and the end result being objectively worse.

Docker has reached the point that it is complicated. A lot of people never did cgroups just because it is lower, starting to touch kernel stuff. Few people want to go there. Docker is one of those things that you can install and run; it takes a small amount of time to get running. As you said, value in simplifying things. That being said... Anyone who takes the stance that containers are better than X/Y/Z are just sh…

I use Docker daily, and I almost never find it complicated.

I use it for build servers and my companies infrastructure.

The alternative would be a nightmare to me.

Post reply on HN