5 ms·

Docker's Dirty Little Secret

6 points by dwighttk 10y ago

creshal 10y ago
TL;DR: Containers are containers, and not virtual machines. In other shocking news: Water is still wet.
crgwbr 10y ago
There's nothing dirty or secret about this. The whole point of docker is to be lighter weight than VM, because you're sharing a kernel with the host. It's no surprise, then, that you can't run a container with an OS using a different kernel from the host.
- kyptin 10y ago
  Author here. Thanks for your comment. I figured this would be obvious to some. Question: do you know of a good resource that describes docker in these terms, such that what I wrote about isn't surprising? The official architecture page [1] doesn't illuminate this issue. To be fair, it isn't super relevant—so long as you run Linux, OS X, or Windows. When you run alternative OS's, though, it becomes pretty important. [1] https://docs.docker.com/engine/understanding-docker/ https://docs.docker.com/engine/understanding-docker/
  - loukrazy 10y ago
    All OSes that are not Linux are alternative OSes. Even Windows and OS X are running docker under virtualization one way or another (docker machine or the more recent virtualization shims).
    - justincormack 10y ago
      No, Docker can run Windows containers natively, although this has not been officially released quite yet it is a preview.
  - brudgers 10y ago
    On Linux, Docker uses cgroups to isolate resources. Cgroups is a feature of the Linux kernel. Cgroups are almost ten years old. Docker on FreeBSD utilizes the Linux compatibility layer. It was introduced in 2015. It is officially experimental. https://wiki.freebsd.org/Docker https://wiki.freebsd.org/Docker To me, none of this is obvious and my limited understanding has taken several years and many hours of podcast listening and technical reading. I still don't know squat.
    - ibotty 10y ago
      > Docker on FreeBSD utilizes the Linux compatibility layer. It was introduced in 2015. It is officially experimental. Huh!? I remember running unmodified Linux binaries on FreeBSD (and other BSDs) in the late 90s. Maybe it was not suitable for most docker images and that started last year...
      - brudgers 10y ago
        Per the link, Docker [the subject of the thread] is experimental on FreeBSD.
- brudgers 10y ago
  I agree. It's more along the lines of: Terms and Conditions apply. Not available in all markets. Your mileage may very. Discount may not be combined with other offers. Limit five per customer. Participating stores only. It's an amazing technology. It's a useful technology. It's still brittle and complicated and not a silver bullet. The impedance mismatch between the level of technical knowledge required to understand containers and their implementation and the availability and promotion of Docker as "just another app" will invariably create these problems. Docker, the company, promotes Docker the product as easy to use. That's true for some definitions of "easy". It is true for fewer as Docker the product captures more mainstream users. To put it another way, the point of Docker, the product, is to be lighter weight than a VM. The complexities of sharing a kernel are implementation details. Ideally users would not encounter them unexpectedly. In fairness to Docker, the company, assuming comfort with technical complexity among BSD users is not a long reach.
Bulk70 10y ago
The clickbait is real with this one. Nothing shocking or "secret" here that a 30 second skim of the documentation wouldn't reveal.
- kyptin 10y ago
  Author here. Apologies if this came across as clickbait. Would you point to said documentation? I haven't been able to find the parts that illuminate this issue, including on the official architecture page [1]. Thanks! https://docs.docker.com/engine/understanding-docker/ https://docs.docker.com/engine/understanding-docker/
- brudgers 10y ago
  Docker [the technology not the company] has reached a level of success where it is discussed and used by people who are not aware of the technical details of its implementation. It is entirely practical to use Docker without ever visiting Docker's official documentation. Because Docker is an alternative to the virtual machines with which people tend to have more experience, it is normal for people to fill holes in their knowledge with facts about VM's. Much of the time, this works. I don't think the title is great, but I think more than anything else it reflects frustration with the complexity of containers and normal disappointment with things that at first appear to be silver bullets. The future is already here -- it's just not very evenly distributed. -- William Gibson
loukrazy 10y ago
This is of course also true of linux running on a different architecture such as power, you need specific images that are built for that architecture. I wonder if the author noticed that none of his docker images were actually running on Mac OS...

6 points by dwighttk 10y ago

TL;DR: Containers are containers, and not virtual machines. In other shocking news: Water is still wet.

There's nothing dirty or secret about this. The whole point of docker is to be lighter weight than VM, because you're sharing a kernel with the host. It's no surprise, then, that you can't run a container with an OS using a different kernel from the host.

kyptin 10y ago
Author here. Thanks for your comment. I figured this would be obvious to some. Question: do you know of a good resource that describes docker in these terms, such that what I wrote about isn't surprising? The official architecture page [1] doesn't illuminate this issue. To be fair, it isn't super relevant—so long as you run Linux, OS X, or Windows. When you run alternative OS's, though, it becomes pretty important. [1] https://docs.docker.com/engine/understanding-docker/ https://docs.docker.com/engine/understanding-docker/
- loukrazy 10y ago
  All OSes that are not Linux are alternative OSes. Even Windows and OS X are running docker under virtualization one way or another (docker machine or the more recent virtualization shims).
  - justincormack 10y ago
    No, Docker can run Windows containers natively, although this has not been officially released quite yet it is a preview.
- brudgers 10y ago
  On Linux, Docker uses cgroups to isolate resources. Cgroups is a feature of the Linux kernel. Cgroups are almost ten years old. Docker on FreeBSD utilizes the Linux compatibility layer. It was introduced in 2015. It is officially experimental. https://wiki.freebsd.org/Docker https://wiki.freebsd.org/Docker To me, none of this is obvious and my limited understanding has taken several years and many hours of podcast listening and technical reading. I still don't know squat.
  - ibotty 10y ago
    > Docker on FreeBSD utilizes the Linux compatibility layer. It was introduced in 2015. It is officially experimental. Huh!? I remember running unmodified Linux binaries on FreeBSD (and other BSDs) in the late 90s. Maybe it was not suitable for most docker images and that started last year...
    - brudgers 10y ago
      Per the link, Docker [the subject of the thread] is experimental on FreeBSD.
brudgers 10y ago
I agree. It's more along the lines of: Terms and Conditions apply. Not available in all markets. Your mileage may very. Discount may not be combined with other offers. Limit five per customer. Participating stores only. It's an amazing technology. It's a useful technology. It's still brittle and complicated and not a silver bullet. The impedance mismatch between the level of technical knowledge required to understand containers and their implementation and the availability and promotion of Docker as "just another app" will invariably create these problems. Docker, the company, promotes Docker the product as easy to use. That's true for some definitions of "easy". It is true for fewer as Docker the product captures more mainstream users. To put it another way, the point of Docker, the product, is to be lighter weight than a VM. The complexities of sharing a kernel are implementation details. Ideally users would not encounter them unexpectedly. In fairness to Docker, the company, assuming comfort with technical complexity among BSD users is not a long reach.

Bulk70 10y ago

The clickbait is real with this one. Nothing shocking or "secret" here that a 30 second skim of the documentation wouldn't reveal.

kyptin 10y ago
Author here. Apologies if this came across as clickbait. Would you point to said documentation? I haven't been able to find the parts that illuminate this issue, including on the official architecture page [1]. Thanks! https://docs.docker.com/engine/understanding-docker/ https://docs.docker.com/engine/understanding-docker/
brudgers 10y ago
Docker [the technology not the company] has reached a level of success where it is discussed and used by people who are not aware of the technical details of its implementation. It is entirely practical to use Docker without ever visiting Docker's official documentation. Because Docker is an alternative to the virtual machines with which people tend to have more experience, it is normal for people to fill holes in their knowledge with facts about VM's. Much of the time, this works. I don't think the title is great, but I think more than anything else it reflects frustration with the complexity of containers and normal disappointment with things that at first appear to be silver bullets. The future is already here -- it's just not very evenly distributed. -- William Gibson

loukrazy 10y ago

This is of course also true of linux running on a different architecture such as power, you need specific images that are built for that architecture. I wonder if the author noticed that none of his docker images were actually running on Mac OS...