Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Considered Harmful (2016)

catern.com

Post reply on HN
Print view View original

61–70 of 188 posts

Re: Docker Considered Harmful (2016)

#61

Post by derefr »

The point of Docker is basically that the container-image developer is specifying the sandbox, instead of the sysadmin specifying the sandbox.

None of the things mentioned solve the problem of the sysadmin having to "design" the solution from the top down. Docker does. A Docker image is an appliance. You don't architect it; you just configure it. You don't have to care which OS it's running inside. Docker images running on Windows don't even care whether it's Windows Core or Ubuntu inside them, even. It's a black box with defined configurability-points.

The only real comparisons to Docker are

1. Amazon's AMIs (though nobody hosts a public AMI registry except for Amazon, so it's not really a good comparison);

2. Canonical's "snap" format (https://snapcraft.io)

Both of these achieve the same things that Docker achieves: developer-distributed virtual appliances configured by the sysadmin but "managed" automatically by the runtime.

And both are just as complicated as Docker. The complexity is necessary.

Re: Docker Considered Harmful (2016)

#62

Post by jonnycoder »

ravenstine wrote: post #55
bunderbunder wrote: post #47

Earlier quoted context omitted.

> Every "Docker Considered Harmful" post I've read basically boils down to "Why would you use Docker if you can use the 10 technologies it wraps around and manage them yourself instead?" Why would I want to do that if I don't have to? Or if you can't? One feature driving Docker adoption that I think a lot of people miss is that it's got fairly workable (if warty in one case and obnoxious in the other) implementations…

> Sure, your ops team can put together a bunch of stuff manually. And then you can create a bunch of extra stuff that makes it easier for development to handle all of that inside virtual machines, and get the network bridging between those apps and the host machine working properly, and all that fun stuff. I think this is one of the biggest reasons people use Docker, although they tend to forget to mention it since i…

This right here. Can confirm, the #1 benefit of using Docker is that 98% of our "Ops" issues has gone away.

Re: Docker Considered Harmful (2016)

#63

Post by geggam »

majewsky wrote: post #5
majewsky wrote: post #4

> I think you could reimplement [some random part of what Docker does] easily yourself with a small shell script and some calls to mount; but I haven't bothered. Exactly.

Bonus round: > For most purposes, the main interesting thing that Docker containers provide is isolated networking. [...] What else prevents applications from using ports? The firewall that you already have installed on your server. Again, pointless abstraction to address already-solved problems. Comically missing the point.

until you realize the firewall is the same iptables that you use to isolate the network in docker containers

Re: Docker Considered Harmful (2016)

#64

Post by meddlepal »

This post totally misses the forest for some trees. Docker isn't a success because it is some amazing revolutionary technology that doesn't exist in another form. Docker is a success and beloved by many because it provides a UX that doesn't require learning about a lot of this stuff upfront so you can get a lot of the immediate benefit without knowing a ton.

Re: Docker Considered Harmful (2016)

#65

Post by majewsky »

wmf wrote: post #8
jzelinskie wrote: post #3

This article concludes that systemd-nspawn is a more unix-style alternative to Docker. Interestingly enough, this is what rkt uses for its default isolation (stage1). What Docker did is bring all of the aspects mentioned in this article together into something that could be easily understood and used. Now that the ideas are familiar and there are standards like the Open Container Initiative, I think we'll see more sm…

BTW, were these cool systemd features invented after Docker by any chance?

According to the "Initial release" dates on Wikipedia, systemd is 3 years older than Docker (2010 vs 2013). And one of the core objectives of systemd was to take advantage of then-still-new Linux kernel features like cgroups.

Re: Docker Considered Harmful (2016)

#66

Post by Theodores »

Silly question, but I have heard that around a fifth of the websites that you see on the internet use 'Wordpress'. 'Wordpress' is a simple blogging platform that has a really nice editor that people like working with. There are many add-ons for 'Wordpress' that enable people to customise what it does and what it looks like. These can complicate matters, however, at the end of the day, 'Wordpress' is just a neat blogging tool and does not require rocket surgery to work with.

In this age of fancy build tools and containerisation, is it necessary and advantageous to develop 'Wordpress' with Docker, Vagrant or any other containerisation?

I could see this as being helpful if you are only allowed a consumer operating system, e.g. Microsoft Windows, but is containerisation the way one would develop a simple Wordpress site if your company's IT department allowed you to run a linux machine?

Admittedly 'Wordpress' is the Hello World of getting online but I genuinely do not know if containerisation is what people would do these days for such a simple use case.

Re: Docker Considered Harmful (2016)

#68

Post by autotune »

Personally, and somewhat surprised it wasn't mentioned, I'm less concerned about everything mentioned in this post and more concerned about the docker ecosystem involving people using random and potentially compromised containers off of DockerHub: https://arstechnica.com/information-technology/2018/06/backd...

Re: Docker Considered Harmful (2016)

#70

Post by ohiovr »

tormeh wrote: post #19
ohiovr wrote: post #2

I'm not at all convinced that reams and reams of shell scripts to deploy complex applications is a good idea. But by all means go for it if you think that is the way to go.

This. Save me from shellscript. I guess it's possible to write good/tolerable shellscript, but most of it is garbage. Obfuscated disasters waiting to happen.

Then OS updates and or application updates can break your scripts. It is also nice not having to be married to a particular linux distro. That seems magical to me.
Post reply on HN