4 ms·

Why use Docker, when payload can be packaged into an OS package, and run inside of a SmartOS zone, which is a fully functional UNIX system, yet completely isola

• j_mcnally 11y ago
  Wait.... are you saying docker is slower than bare metal? Have you used docker?
  • Annatar 11y ago
    I'm saying that a lot of people end up running Docker in a VM... why? I'm also saying that dumping a bunch of files from a developer's laptop into a Docker image is going to be a nightmare in terms of lifecycle management (how about a subsystem rollback or upgrade inside of that image?) And finally, I'm saying I see no point to Docker, if I can just make OS packages and run them inside of zones. With zones, I have a fully functional UNIX server in complete isolation and security; with Docker, I have a re-invented init which isn't really init, and if I want SSH and all the other things one normally expects of a system, I have to engineer them myself. Why would I use Docker if I can use zones in SmartOS? What does Docker buy me?
    • azernik 11y ago
      a) from a quick look at SmartOS, it looks like yet another implementation of containerization, with an option to run a full KVM if you want. And it has to run as a full OpenSolaris-based system image, instead of just being a binary installable on a Linux system (much more familiar to most developers) b) "dumping a bunch of files from a developer's laptop into a Docker image"... I'm sorry, what? I have no idea what workflow you're referring to here. WRT your specific gripes about subsystem rollback - the usual Docker best practice is to have each container run only a single subsystem, and to have images be generated by checked-in Dockerfiles based only on checked-in resources. If you need to upgrade or downgrade, you spin up a new container running a different image, fail over to it, and kill the old one. Once a container starts running it is immutable. Any of the features of a running container can be inferred just from looking at the Dockerfile(s) that built it and the connections it has to storage volumes, other containers, and the external network.
      • Annatar 11y ago
        > from a quick look at SmartOS, it looks like yet another implementation of containerization It is the first ever implementation of true containers (zones were released in 2005), and it is modeled on BSD jails. What is or is not familiar to most developers is irrelevant to me when I am engineering a solution, because my focus is on encapsulation, stability and lifecycle management. What others are familiar with is irrelevant in that case, especially since correctness of operation and data integrity are priority, with everything else taking a back seat to those. > WRT your specific gripes about subsystem rollback - the usual Docker best practice is to have each container run only a single subsystem But it doesn't have to be: http://phusion.github.io/baseimage-docker/ http://phusion.github.io/baseimage-docker/ besides, if there is an issue, and one were to follow running only one service inside of a Docker image, one could not ssh in to troubleshoot the image. With Solaris zones on SmartOS, it is completely unnecessary to run a single service or process inside of a zone, because zones offer full isolation. I see no sense in opting for a harder approach with Docker, especially when that approach does not offer full isolation nor security. > If you need to upgrade or downgrade, you spin up a new container running a different image, fail over to it, and kill the old one Which I imagine means that I have to build a whole new image, presumably based on the old image, then deploy an entire image (what if it is an Oracle database software, which is anywhere from 800 MB to 2.5 GB, not counting the database?) It is much cheaper and faster to just rebuild the affected package, and upgrade it in place inside of a zone, than having to respin an entire image, especially if that image is several gigabytes.
        • jacques_chester 11y ago
          It's worth noting that Docker is not the only containerising system for Linux. Just as assuming that the limits of MySQL are the limits of relational databases, assuming that the limits of Docker are the limits of Linux containers is mistaken.
        • tra3 11y ago
          I want to discuss your last point. With Docker, you are free to either modify the image or the running container. An image is a "template" for a container and in the scenario you describe, the ideal solution is to create a new image because it can be potentially running on multiple nodes. However, nothing prevents you from accessing the container (no SSH required) and modifying the container in place. Although I do believe it is discouraged. Thanks for the SmartOS reference, it looks very interesting.
  • Estragon 11y ago
    Watch the talk. It's pretty entertaining. The point is that to get around Docker's security issues, you have to run it in a VM to get secure multitenancy.
• cyphar 11y ago
  Thanks for mentioning SmartOS (I was about to mention it myself). There is also LX-Branded zones which actually allow you to run Docker images in zones (ref: smart data center). I don't agree with your gripes about Docker though, it does actually solve problems and allows developers to define what the requirements are for their software to run (it also makes build systems much less horrible). More importantly, all software is "random files copied from the developers laptop", so I don't see why that's a negative.