Why doesn’t anyone weep for Docker? • Hacker News Board

Re: Why doesn’t anyone weep for Docker?

#41

Post by krzepah » Fri, Sep 06, 2019, 7:40 AM UTC

paule89 wrote: post #15

The problem i have with cubernetes is the following: I as a small developer and small server owner don't have the ressources to even get started. The first thing i see at cubernetes is a cluster. Why a cluster. Do i need to cluster my Raspberry pi's to get something out of it? Do i need to buy 3 servers just to run 5 containers? In docker its easy. Download Docker. Start container. Install container manager like plat…

Docker is more than enough for most of the setups TBH, prometheus and what will work just as well. I would never recommend K8 locally, if you can even avoid docker it's a win.

It's just a matter of preferences, where you want to invest your time to learn etc... Kubernetes being the fully fledged "state-of-the-art"

I would just recommend the work of Stefan Prodan who's repository and blog are full of open and well thought devops work, even if you are just interested in K8 or only Docker

Re: Why doesn’t anyone weep for Docker?

#42

Post by pjmlp » Fri, Sep 06, 2019, 7:42 AM UTC

FreeHugs wrote: post #30

Weep? Docker's downfall? What happened? As far as I can tell, everybody and his grandmother is using Docker. Why should we weep about it?

Nah, plain old VMs over here.

Re: Why doesn’t anyone weep for Docker?

#43

Post by raesene9 » Fri, Sep 06, 2019, 7:42 AM UTC

goatinaboat wrote: post #21

For a very long time there was a gaping security hole in Docker: anyone who could run a container could mount anything on the underlying host as root. This says to me that Docker (the company) don’t really consider any use cases beyond “fooling around on a personal laptop”. Meanwhile other container projects took seriously from day 1 that they would need to run in production. Docker (the company) certainly helped to…

A couple of things :-

You can still mount filesystems as root from a container, if you have Docker command rights. In Docker's security model access to run docker commands on a given host == root, that's a design choice AFAIK, not an oversight.

It's perfectly possible to mitigate that issue, by restricting who can run containers and also ensuring that all containers specify and use a non-root user account (or enable user namespaces at the Docker daemon level)

Also, many early stage technologies don't prioritise security . For example, for several early releases of Kubernetes all you needed was remote access to a single port (10250/TCP) and you could get root access to the underlying host without any authentication...

Re: Why doesn’t anyone weep for Docker?

#44

Post by raesene9 » Fri, Sep 06, 2019, 7:44 AM UTC

goatinaboat wrote: post #37

aflag wrote: post #26

Earlier quoted context omitted.

That's only a problem if you allow untrusted users operate the docker daemon.

That's only a problem if you allow untrusted users operate the docker daemon. Sure, if you trust every developer in your company with the root password anyway, why not? That might be true at Docker (the company), I don’t know. Certainly wasn’t true at one company I worked at with 30,000 devs... By the way, this problem does not exist with competing container tools like Podman/Buildah.

Why would you be allowing devs to directly deploy to production in a company with 30,000 developers?

Surely you'd have proper release management where Ops teams would review deployment artifacts before deploying them?

Re: Why doesn’t anyone weep for Docker?

#45

Post by flukus » Fri, Sep 06, 2019, 7:46 AM UTC

kjgkjhfkjf wrote: post #9

Google doesn't actually use Kubernetes much, so the "operation hardened internally" argument isn't valid.

This reminds me of Joel Spolsky's fire and motion piece (https://www.joelonsoftware.com/2002/01/06/fire-and-motion/). To paraphrase a little bit:

> Fire and Motion. You move towards the enemy while firing your weapon. The firing forces him to keep his head down so he can’t fire at you. ... The companies who stumble are the ones who spend too much time reading tea leaves to figure out the future direction of Google. People get worried about kubernetes and decide to rewrite their whole architecture for kubernetes because they think they have to. Google is shooting at you, and it’s just cover fire so that they can move forward and you can’t

Re: Why doesn’t anyone weep for Docker?

#46

Post by moksly » Fri, Sep 06, 2019, 7:47 AM UTC

paule89 wrote: post #15

The problem i have with cubernetes is the following: I as a small developer and small server owner don't have the ressources to even get started. The first thing i see at cubernetes is a cluster. Why a cluster. Do i need to cluster my Raspberry pi's to get something out of it? Do i need to buy 3 servers just to run 5 containers? In docker its easy. Download Docker. Start container. Install container manager like plat…

> as a small developer

Do you need kubernetes?

I know the hype cycle is mad for copying big tech, but if stackoverflow can operate on a couple of IIS instances I’d argue that you almost never need kubernetes.

Re: Why doesn’t anyone weep for Docker?

#47

Post by raesene9 » Fri, Sep 06, 2019, 7:49 AM UTC

orthoxerox wrote: post #14

The only thing Docker is now useful for is Docker Desktop. Unlike other desktop container software, it actually works on locked down machines in enterprise environments. K8s can run on any CRI-compatible runtime, and IBM/RedHat don't even want you to install Docker on RHEL8.

Whilst k8s can run on any CRI compliant runtime, I've never actually seen a prod. deployment use anything other than Docker.

Re: Why doesn’t anyone weep for Docker?

#48

Post by goatinaboat » Fri, Sep 06, 2019, 7:50 AM UTC

raesene9 wrote: post #44

goatinaboat wrote: post #37

Earlier quoted context omitted.

That's only a problem if you allow untrusted users operate the docker daemon. Sure, if you trust every developer in your company with the root password anyway, why not? That might be true at Docker (the company), I don’t know. Certainly wasn’t true at one company I worked at with 30,000 devs... By the way, this problem does not exist with competing container tools like Podman/Buildah.

Why would you be allowing devs to directly deploy to production in a company with 30,000 developers? Surely you'd have proper release management where Ops teams would review deployment artifacts before deploying them?

You wouldn’t but you wouldn’t give every dev root access to every dev box either... would you?

Re: Why doesn’t anyone weep for Docker?

#49

Post by hilem » Fri, Sep 06, 2019, 7:50 AM UTC

ahupp wrote: post #17

hilem wrote: post #13

Earlier quoted context omitted.

Kubernetes is based on Borg which Google uses extensively internally.

"inspired by" borg. It's not the same codebase.

I didn't say it was the same codebase. "Inspired" may be more accurate but the point still remains that the concepts in Kubernetes have a direct path to the concepts in Borg.

Re: Why doesn’t anyone weep for Docker?

#50

Post by raesene9 » Fri, Sep 06, 2019, 7:51 AM UTC

What's interesting, to me, about Docker as a company perhaps not doing well is how that'll impact Microsoft.

Microsoft have done a load of work on getting containers running well on Windows servers and that work relies on Docker EE as the container runtime engine (you get a free Docker EE license to run on Windows servers AFAIK)

If Docker get bought up (by someone other than Microsoft), then that would seem to possibly place Microsoft's container efforts at risk...