3 ms·

Docker built a better mousetrap. FreeBSD had jails in 2000. Linux had namespaces and cgroups for years. No one cared until Docker came up with containers in 20

by pdog 9y ago

Docker built a better mousetrap. FreeBSD had jails in 2000. Linux had namespaces and cgroups for years. No one cared until Docker came up with containers in 2013.

idorosen 9y ago
OpenVZ, user-mode Linux, and others were very widespread with web hosting and VPS providers since mid-/early-2000s (and probably a little earlier than that too). Docker didn't invent containers, but they were a first mover (as far as I know) in the current flavor of "PaaS" or hosted "non-frameworks" (i.e. environments that don't force you into the hosting provider's userland choices such as library versions, etc.). It's easy to dismiss it as a better mousetrap, but it was an inflection point in the same way puppet and cfengine before it were inflection points in configuration management and "infrastructure as code"... Still, I find the Docker daemon massively invasive and too much of a potential gaping security hole. I wish it was more modular and less of it ran privileged/as root, and don't run it on anything sensitive as a result. Usually properly configuring a box and relying on existing process and other forms of isolation (including namespaces) is good enough, especially with good package management. Great for UX/workflow tooling in a dev VM though!
- shykes 9y ago
  > I wish it was more modular and less of it ran privileged/as root Under the hood Docker has been heavily modularized. Check out https://containerd.io https://containerd.io which handles all the low-level container operations in a lightweight daemon with way less footprint. You can use it standalone without pulling in the rest of the Docker platform.
moosingin3space 9y ago
My personal opinion on this is that Docker's application of Linux namespaces+cgroups happened to solve a specific problem - reducing differences between prod and dev and doing stateless deployment - in a way that is pretty simple and didn't break people's expectations for how Linux works. Prior to that, namespaces and cgroups didn't have a "killer app".

by pdog 9y ago

Docker built a better mousetrap. FreeBSD had jails in 2000. Linux had namespaces and cgroups for years. No one cared until Docker came up with containers in 2013.

idorosen 9y ago

OpenVZ, user-mode Linux, and others were very widespread with web hosting and VPS providers since mid-/early-2000s (and probably a little earlier than that too). Docker didn't invent containers, but they were a first mover (as far as I know) in the current flavor of "PaaS" or hosted "non-frameworks" (i.e. environments that don't force you into the hosting provider's userland choices such as library versions, etc.). It's easy to dismiss it as a better mousetrap, but it was an inflection point in the same way puppet and cfengine before it were inflection points in configuration management and "infrastructure as code"... Still, I find the Docker daemon massively invasive and too much of a potential gaping security hole. I wish it was more modular and less of it ran privileged/as root, and don't run it on anything sensitive as a result. Usually properly configuring a box and relying on existing process and other forms of isolation (including namespaces) is good enough, especially with good package management. Great for UX/workflow tooling in a dev VM though!

shykes 9y ago
> I wish it was more modular and less of it ran privileged/as root Under the hood Docker has been heavily modularized. Check out https://containerd.io https://containerd.io which handles all the low-level container operations in a lightweight daemon with way less footprint. You can use it standalone without pulling in the rest of the Docker platform.

moosingin3space 9y ago

My personal opinion on this is that Docker's application of Linux namespaces+cgroups happened to solve a specific problem - reducing differences between prod and dev and doing stateless deployment - in a way that is pretty simple and didn't break people's expectations for how Linux works. Prior to that, namespaces and cgroups didn't have a "killer app".