Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How is Docker.io different from a normal virtual machine?

stackoverflow.com

Post reply on HN
Print view View original

51–60 of 111 posts

Re: How is Docker.io different from a normal virtual machine?

#51

Post by rdl »

sarnowski wrote: post #48
rdl wrote: post #28

I really don't like giving up the isolation of modern hypervisors, particularly those with Intel virtualization extensions. Docker (and LXC) seems like a huge step backwards for security. I'm sure there are use cases, but I'd never multi-tenant with it.

> Docker (and LXC) seems like a huge step backwards for security. Sry but link says it all. No further comment from me: http://marc.info/?l=openbsd-misc&m=119318909016582&w=2

VT-d, VT-x. 2007 != 2013. The number of hypervisor exploits is far fewer than the number of local root exploits on various shitty OSes (including OpenBSD).

Re: How is Docker.io different from a normal virtual machine?

#52

Post by olefoo »

ams6110 wrote: post #21
rralian wrote: post #8

Holy cow, the unit test case is fantastic.

It is a good example, but I wonder how licensing would treat it. If I'm running hundreds of unit tests, each against a snapshot of my database, and my database is Oracle, they would likely view that as hundreds of instances which would each need a license.

Unless your application is tied to Oracle specific extensions you should think about using postgreSQL for your dev and testing environments. They both hew pretty closely to the sql standard; and there are versions ( EnterpriseDB ) that have an explicit Oracle compatibility layer that works.

And I bet it feels really good to look the Oracle salesperson in the eye and say, "We've been doing most of our dev work on Postgres lately."

Re: How is Docker.io different from a normal virtual machine?

#53

Post by justincormack »

FreeBSD-user wrote: post #46
bobf wrote: post #7

Docker doesn't add a whole lot over what basic Linux containers (lxc and vserver) have offered for years. Having said that, the main benefit to Docker is a change in viewpoint from "virtual machine" to "application". Docker aims to make applications portably deployable to any Docker-machine. Since Docker uses lxc (aka Linux containers), it helps to understand a little how containers are different from other virtualiz…

To be honest I've never worked out why Docker gets so much press. If you use the Ezjail utility to configure and manage FreeBSD jails you have been able to do most of the things Docker does for years (stacked fs using unionfs, templates/flavours, snapshots, export/import etc) and this seems like a much simpler and more stable solution. The networking stuff is also easy using pf.

Because almost no one around here uses FreeBSD it seems.

Re: How is Docker.io different from a normal virtual machine?

#54

Post by mtam »

bobf wrote: post #7

Docker doesn't add a whole lot over what basic Linux containers (lxc and vserver) have offered for years. Having said that, the main benefit to Docker is a change in viewpoint from "virtual machine" to "application". Docker aims to make applications portably deployable to any Docker-machine. Since Docker uses lxc (aka Linux containers), it helps to understand a little how containers are different from other virtualiz…

Yes, Docker builds on top Linux containers but they seem to be releasing some neat features that make containers easier to use, manage, and reuse. For example: The docker-cluster project, https://github.com/globocom/docker-cluster seems very interesting as it might allow you to abstract the host with a cluster/logical group. Having this abstraction is key if you are running docker on a non-virtualized (bare metal) host because it provides some level of fault-tolerance against hardware failures. Can you do that with Linux Containers?

Edit: I just realized that docker clusters is not being developed by the docker team

Re: How is Docker.io different from a normal virtual machine?

#55

Post by DH61AG »

FreeBSD-user wrote: post #46
bobf wrote: post #7

Docker doesn't add a whole lot over what basic Linux containers (lxc and vserver) have offered for years. Having said that, the main benefit to Docker is a change in viewpoint from "virtual machine" to "application". Docker aims to make applications portably deployable to any Docker-machine. Since Docker uses lxc (aka Linux containers), it helps to understand a little how containers are different from other virtualiz…

To be honest I've never worked out why Docker gets so much press. If you use the Ezjail utility to configure and manage FreeBSD jails you have been able to do most of the things Docker does for years (stacked fs using unionfs, templates/flavours, snapshots, export/import etc) and this seems like a much simpler and more stable solution. The networking stuff is also easy using pf.

Because Docker is platform agnostic and easy to use. There has always been similar solutions but none of them with such simple interface and setup.

Re: How is Docker.io different from a normal virtual machine?

#56

Post by sarnowski »

rdl wrote: post #51
sarnowski wrote: post #48

Earlier quoted context omitted.

> Docker (and LXC) seems like a huge step backwards for security. Sry but link says it all. No further comment from me: http://marc.info/?l=openbsd-misc&m=119318909016582&w=2

VT-d, VT-x. 2007 != 2013. The number of hypervisor exploits is far fewer than the number of local root exploits on various shitty OSes (including OpenBSD).

Do you have a link for this statistic? Since I don't know of a local root privilege escalation since several years in OpenBSD, this is a quite high mark.

Edit: this is not a os-or-vm problem. You will have local problems and now, in addition, rooting a server may give you access to even more servers that run on your hyp.

Re: How is Docker.io different from a normal virtual machine?

#57

Post by xnxn »

jaytaylor wrote: post #37
pestaa wrote: post #32

Earlier quoted context omitted.

Looks like ShipBuilder has overlap with Docker, if not a direct competitor. A disclaimer wouldn't have hurt in my opinion.

I don't follow. ShipBuilder uses LXC and is a complete open-source self-hosted PaaS; a Heroku-clone. How is it a Docker competitor? I cite it merely as an example of the sorts of cool things which are possible with LXC.

Truthfully, you plug ShipBuilder more frequently than I am comfortable with. It makes your related comments seem disingenuous.

Re: How is Docker.io different from a normal virtual machine?

#58

Post by jmspring »

justincormack wrote: post #53
FreeBSD-user wrote: post #46

Earlier quoted context omitted.

To be honest I've never worked out why Docker gets so much press. If you use the Ezjail utility to configure and manage FreeBSD jails you have been able to do most of the things Docker does for years (stacked fs using unionfs, templates/flavours, snapshots, export/import etc) and this seems like a much simpler and more stable solution. The networking stuff is also easy using pf.

Because almost no one around here uses FreeBSD it seems.

Some of us do, when appropriate.

Docker took a technology known to many that setup/admin/manage machines, added some fluff, made things simpler, and marketed the idea.

In a crowd that might spend more time thinking about nodejs and callbacks vs promises or how easily one can tip a rails app up on heroku, existing systems tools for things like jails/virtualization may either be over looked or not a concern.

For every docker, there are people (of which I may be one) that think , "big deal, it is just x". Meanwhile that thing is getting traction and popularity. It might not last, but it is around and making noise now.

Re: How is Docker.io different from a normal virtual machine?

#59

Post by alexwright »

aegiso wrote: post #42
manojlds wrote: post #41

Earlier quoted context omitted.

The kernel version has to be the same.

No, it just has to be modern enough to support LXC/Docker.

No there isn't a hosted child kernel. What the parent means is that the guest and host are using the same kernel instance, and the distro needs to be able to handle that to run.

Re: How is Docker.io different from a normal virtual machine?

#60

Post by mtkd »

jmspring wrote: post #58
justincormack wrote: post #53

Earlier quoted context omitted.

Because almost no one around here uses FreeBSD it seems.

Some of us do, when appropriate. Docker took a technology known to many that setup/admin/manage machines, added some fluff, made things simpler, and marketed the idea. In a crowd that might spend more time thinking about nodejs and callbacks vs promises or how easily one can tip a rails app up on heroku, existing systems tools for things like jails/virtualization may either be over looked or not a concern. For every…

It is a simple abstraction of something that many people find very complicated - or choose to not spend time understanding / configuring.

(You could say same about Github, Travis etc.)

Post reply on HN