4 ms·

Astute. I was trying to use jails for development in kinda a proto-Docker setup, where my apps each ran in their own BSD jail. I struggled to put the pieces tog

by jitl 9y ago

Astute. I was trying to use jails for development in kinda a proto-Docker setup, where my apps each ran in their own BSD jail. I struggled to put the pieces together to set up the jails, share a “base jail” with ZFS, forward ports, etc. I had scripts for messing with my pf rules to add port forwards, other scripts to update/apply config inside a jail... it was more frustrating to automate creating and destroying “immutable” jails, than maintaining a pet per app I developed... until I messed up an environment, and just abandoned the project! I think we’ll see the same sort of thing happening with FaaS frameworks, or any of the layers building on top of Swarm/Kubernetes/Mesos.

lilbobbytables 9y ago
What do you mean, in reference to layers on kubernetes, mesos, etc?
inferiorhuman 9y ago
Really? I've found iocage to work very well and combined with Ansible's jail support creating new jails is pretty darn easy. In terms of networking I created another loopback interface and assign each jail its own IP at creation time. It's not particularly elegant but it simplifies ipfw rules. I've automated doing some updates with jenkins+ansiblee+git, but overall maintaining them is a bit tough because ansible's pkgng support is lacking.
- cdancette 9y ago
  What you're describing is exactly the reason people use docker. No need to use ansible, or to manage interfaces if you don't want to, it just work out of the box, and you run just bash commands to configure it.
  - inferiorhuman 9y ago
    I'd argue no. Dockerfiles are riddled with gotchas and limitations. In this case using Anisble initally is more akin to using Packer to build an image. For ongoing maintenance it's because I maintain state in the jails. In terms of managing interfaces, iocage does that for you. The IP address has to be assigned manually, but that would be trivial to automate. A couple of IPFW rules work just fine to NAT the loopback aliases for a dynamic set of jails.
    - oblio 9y ago
      You sound like that comment on the Dropbox HN annoucement page: https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224 You've just added at least 2 more concepts to the thing you have to use: iocage and ansible. On top of the jails thing. That's the exact opposite of "easy to adopt". Especially since most people that use something like Docker already don't care or want to learn Docker, they just want the benefits of using containers.
      - inferiorhuman 9y ago
        That's a bit like saying that Docker is one more thing on top of LXC that you have to learn. jails : iocage :: lxc : docker ansible : iocage :: packer : docker The workflow and terminology is somewhat different but that doesn't make it inherently more difficult to adopt. The "slick" DSL that Dockerfiles provide become quite limiting in short order especially as each line bloats the eventual Docker image quite significantly. Case in point, you can't set file ownership when you copy files into the image so that extra step adds that much more bloat.
        oblio 9y ago
        You only learn about docker... Regarding your later edit about bloat, well, it seems most people don't really care about that.
        inferiorhuman 9y ago
        You only learn about iocage… (although even with Docker you should have at least a little knowledge of how things work under the hood for when things invariably break).
        oblio 9y ago
        I was curious about iocage, is it this thing? https://github.com/iocage/iocage https://github.com/iocage/iocage It's FreeBSD only, why are we even having this discussion? :)
AgentME 9y ago
Yeah, if you want to use jails or any container-type technology on your own to use for application deployments, then you have to write a ton of scripts for creating, managing, and destroying them. I'd rather use someone's pre-existing set of scripts for that. And I am. It's called Docker. To me, asking why people are using Docker instead of plain jails combined with a series of other technologies is like asking why people make buildings out of wooden planks instead of trees. The question seems a bit wrong, because Docker is just built on existing container technologies. And I'd rather save a few steps. Planks are the exact shape and size that I want to deal with when building an application anyway.

by jitl 9y ago

lilbobbytables 9y ago

What do you mean, in reference to layers on kubernetes, mesos, etc?

inferiorhuman 9y ago

Really? I've found iocage to work very well and combined with Ansible's jail support creating new jails is pretty darn easy. In terms of networking I created another loopback interface and assign each jail its own IP at creation time. It's not particularly elegant but it simplifies ipfw rules. I've automated doing some updates with jenkins+ansiblee+git, but overall maintaining them is a bit tough because ansible's pkgng support is lacking.

cdancette 9y ago
What you're describing is exactly the reason people use docker. No need to use ansible, or to manage interfaces if you don't want to, it just work out of the box, and you run just bash commands to configure it.
- inferiorhuman 9y ago
  I'd argue no. Dockerfiles are riddled with gotchas and limitations. In this case using Anisble initally is more akin to using Packer to build an image. For ongoing maintenance it's because I maintain state in the jails. In terms of managing interfaces, iocage does that for you. The IP address has to be assigned manually, but that would be trivial to automate. A couple of IPFW rules work just fine to NAT the loopback aliases for a dynamic set of jails.
  - oblio 9y ago
    You sound like that comment on the Dropbox HN annoucement page: https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224 You've just added at least 2 more concepts to the thing you have to use: iocage and ansible. On top of the jails thing. That's the exact opposite of "easy to adopt". Especially since most people that use something like Docker already don't care or want to learn Docker, they just want the benefits of using containers.
    - inferiorhuman 9y ago
      That's a bit like saying that Docker is one more thing on top of LXC that you have to learn. jails : iocage :: lxc : docker ansible : iocage :: packer : docker The workflow and terminology is somewhat different but that doesn't make it inherently more difficult to adopt. The "slick" DSL that Dockerfiles provide become quite limiting in short order especially as each line bloats the eventual Docker image quite significantly. Case in point, you can't set file ownership when you copy files into the image so that extra step adds that much more bloat.
      - oblio 9y ago
        You only learn about docker... Regarding your later edit about bloat, well, it seems most people don't really care about that.
        inferiorhuman 9y ago
        You only learn about iocage… (although even with Docker you should have at least a little knowledge of how things work under the hood for when things invariably break).
        oblio 9y ago
        I was curious about iocage, is it this thing? https://github.com/iocage/iocage https://github.com/iocage/iocage It's FreeBSD only, why are we even having this discussion? :)

AgentME 9y ago

Yeah, if you want to use jails or any container-type technology on your own to use for application deployments, then you have to write a ton of scripts for creating, managing, and destroying them. I'd rather use someone's pre-existing set of scripts for that. And I am. It's called Docker. To me, asking why people are using Docker instead of plain jails combined with a series of other technologies is like asking why people make buildings out of wooden planks instead of trees. The question seems a bit wrong, because Docker is just built on existing container technologies. And I'd rather save a few steps. Planks are the exact shape and size that I want to deal with when building an application anyway.