4 ms·

As someone considering using Docker for production infrastructure I'd love to hear from a docker expert what their thoughts are on the following observations:

As someone considering using Docker for production infrastructure I'd love to hear from a docker expert what their thoughts are on the following observations: * Docker encourages fully disposable infrastructure * Docker containers can be more secure then traditional environments * Docker provides for indempotent environments agnostic of hardware concerns etc * Container management software (Kubernetes, etc.) makes Docker much more powerful/useful and is only going to get better Specifically, I'm curious if my observations are correct, and if they are why they are correct and why are they SO much better (vs current docker alternatives including non-container based approaches).

chousuke 10y ago
I'm not sure if I qualify as a docker expert, but I feel like I need to comment on these... Firstly, I think it is correct that docker encourages disposable infrastructure, because your docker setup basically must be able to recover from the loss of a container. I think it would not be sane to expect your containers to "just keep working". Regarding security, I don't think Docker provides much other than the illusion of better security at the moment. At least on Linux containers don't add security that you can't get with traditional services. I suppose if you use authenticated images you can at least be sure that you're running the code you think you are, but then again package managers have had signing for ages. You're always going to have to test your software in the environment you will be deploying it in, because driver bugs and weird interactions still exist. Docker doesn't really let you ignore the hardware I have no opinion of kubernetes and such at the moment. What docker does grant is an easy method of "packaging" software... Pretty much anyone can just throw everything together in a big bundle and distribute that. For certain use-cases, this can give a development team much more speed, since setting up a workable environment is much faster. There is also a nontrivial amount of software that simply does not bother with OS packaging where containers can help you deploy it in a more controlled fashion.
- DigitalJack 10y ago
  'I think it would not be sane to expect your containers to "just keep working".' Why?
jodumont 10y ago
As SysAdmin, I'm going slowly but surely to Docker. You have to follow good practice such as using devicemapper which is truly not by defaults even it CoreOS. For sure for developer it's a big thing, for SysAdmin and people thinking about the datas it's more a pain in the ass. Anyway, no way to go back. This is the future Jack. On the last DockerConf you could ear ADP talking about their success with Docker, but obviously their there to promote Docker. ;)
user5994461 10y ago
Author from the original article here. >>> * Docker encourages fully disposable infrastructure => I'd consider that incorrect and/or misleading Docker is meant to manage disposable (i.e. stateless) applications. They are expected to be killed/stopped/restarted at any time, no persistent state, no data. An application is either disposable OR not disposable by its design, docker doesn't change that. (For instance, don't try to dockerize databases). Docker gives you a quick, nice and easy way to package your applications with dependencies (as Docker image) AND deploy them. [This is valuable] It's especially great for development and test environments because you can run many containers (i.e. applications) on a dev/test machine, without dependency/deployment hell. [This is very valuable] >>> * Docker containers can be more secure then traditional environments => No. Just No. Docker has nothing to do with security. >>> * Docker provides for idempotent environments agnostic of hardware concerns etc Docker gets to ignore the hardware. You do not. You get to buy, setup and manage servers. Maintain a full environment that can run docker. It can be an undertaking full of dangers, as told by this article and mine :D >>> * Container management software (Kubernetes, etc.) makes Docker much more powerful/useful and is only going to get better Docker allows to package and deploy an application. It doesn't do anything about infrastructure at all (i.e. machines, load balancers, DNS, discovery), which you still have to manage and it's a HARD problem. The orchestration systems is supposed to help you manage all of that. As a result, it will be able to automatically kill/restart/move/add containers across a cluster and make the necessary [physical or virtual] infrastructure changes. Container + Orchestration will be a [r]evolution to manage entire giant fleets of hosts and applications. [This will be infinitely valuable (allowing me to automate the work of 10 people, all freeing all my time to enjoy unlimited free drinks and foods)] IMO: In the current state of affairs. Having docker without orchestration is like having cars without roads.
- closeparen 10y ago
  >Having docker without orchestration is like having cars without roads. Docker's stated purpose is to be the "shipping container" abstraction for server-side code. Shipping containers are not much more exciting than any other kind of box (VM, jail, whatever) in isolation. Things get more interesting when every port has container-optimized cranes and there are thousands of container ships competing for your business.
justincormack 10y ago
* Docker encourages fully disposable infrastructure Absolutely. You will get the most out of it like this. You can run pets, and treat containers VMs but I don't think you will get all the advantages. * Docker containers can be more secure then traditional environments Out of the box you get isolation from namespaces (not being able to see the host filesystem or network), resource limits via cgroups, a default seccomp profile that restricts some system calls that could be used in exploits, and more. You can set all these defaults yourself but the majorty of people do not. So there are definit benefits. * Docker provides for indempotent environments agnostic of hardware concerns etc Most applications do not talk directly to hardware, the default container does not directly present hardware interfaces, yes. * Container management software (Kubernetes, etc.) makes Docker much more powerful/useful and is only going to get better It does help to have software to manage programs across multiple computers, for scaling and redundancy, yes.

chousuke 10y ago

I'm not sure if I qualify as a docker expert, but I feel like I need to comment on these... Firstly, I think it is correct that docker encourages disposable infrastructure, because your docker setup basically must be able to recover from the loss of a container. I think it would not be sane to expect your containers to "just keep working". Regarding security, I don't think Docker provides much other than the illusion of better security at the moment. At least on Linux containers don't add security that you can't get with traditional services. I suppose if you use authenticated images you can at least be sure that you're running the code you think you are, but then again package managers have had signing for ages. You're always going to have to test your software in the environment you will be deploying it in, because driver bugs and weird interactions still exist. Docker doesn't really let you ignore the hardware I have no opinion of kubernetes and such at the moment. What docker does grant is an easy method of "packaging" software... Pretty much anyone can just throw everything together in a big bundle and distribute that. For certain use-cases, this can give a development team much more speed, since setting up a workable environment is much faster. There is also a nontrivial amount of software that simply does not bother with OS packaging where containers can help you deploy it in a more controlled fashion.

DigitalJack 10y ago
'I think it would not be sane to expect your containers to "just keep working".' Why?

jodumont 10y ago

As SysAdmin, I'm going slowly but surely to Docker. You have to follow good practice such as using devicemapper which is truly not by defaults even it CoreOS. For sure for developer it's a big thing, for SysAdmin and people thinking about the datas it's more a pain in the ass. Anyway, no way to go back. This is the future Jack. On the last DockerConf you could ear ADP talking about their success with Docker, but obviously their there to promote Docker. ;)

user5994461 10y ago

Author from the original article here. >>> * Docker encourages fully disposable infrastructure => I'd consider that incorrect and/or misleading Docker is meant to manage disposable (i.e. stateless) applications. They are expected to be killed/stopped/restarted at any time, no persistent state, no data. An application is either disposable OR not disposable by its design, docker doesn't change that. (For instance, don't try to dockerize databases). Docker gives you a quick, nice and easy way to package your applications with dependencies (as Docker image) AND deploy them. [This is valuable] It's especially great for development and test environments because you can run many containers (i.e. applications) on a dev/test machine, without dependency/deployment hell. [This is very valuable] >>> * Docker containers can be more secure then traditional environments => No. Just No. Docker has nothing to do with security. >>> * Docker provides for idempotent environments agnostic of hardware concerns etc Docker gets to ignore the hardware. You do not. You get to buy, setup and manage servers. Maintain a full environment that can run docker. It can be an undertaking full of dangers, as told by this article and mine :D >>> * Container management software (Kubernetes, etc.) makes Docker much more powerful/useful and is only going to get better Docker allows to package and deploy an application. It doesn't do anything about infrastructure at all (i.e. machines, load balancers, DNS, discovery), which you still have to manage and it's a HARD problem. The orchestration systems is supposed to help you manage all of that. As a result, it will be able to automatically kill/restart/move/add containers across a cluster and make the necessary [physical or virtual] infrastructure changes. Container + Orchestration will be a [r]evolution to manage entire giant fleets of hosts and applications. [This will be infinitely valuable (allowing me to automate the work of 10 people, all freeing all my time to enjoy unlimited free drinks and foods)] IMO: In the current state of affairs. Having docker without orchestration is like having cars without roads.

closeparen 10y ago
>Having docker without orchestration is like having cars without roads. Docker's stated purpose is to be the "shipping container" abstraction for server-side code. Shipping containers are not much more exciting than any other kind of box (VM, jail, whatever) in isolation. Things get more interesting when every port has container-optimized cranes and there are thousands of container ships competing for your business.

justincormack 10y ago

* Docker encourages fully disposable infrastructure Absolutely. You will get the most out of it like this. You can run pets, and treat containers VMs but I don't think you will get all the advantages. * Docker containers can be more secure then traditional environments Out of the box you get isolation from namespaces (not being able to see the host filesystem or network), resource limits via cgroups, a default seccomp profile that restricts some system calls that could be used in exploits, and more. You can set all these defaults yourself but the majorty of people do not. So there are definit benefits. * Docker provides for indempotent environments agnostic of hardware concerns etc Most applications do not talk directly to hardware, the default container does not directly present hardware interfaces, yes. * Container management software (Kubernetes, etc.) makes Docker much more powerful/useful and is only going to get better It does help to have software to manage programs across multiple computers, for scaling and redundancy, yes.