4 ms·

Docker is primarily a packaging framework + a runtime mechanism. It's like VM + hypervisor in one box. Thinking this way, it's easy to understand why it's pop

Docker is primarily a packaging framework + a runtime mechanism. It's like VM + hypervisor in one box. Thinking this way, it's easy to understand why it's popular. It did things that no other have done.

djsumdog 9y ago
It's not like that at all in any way. You're using existing OS packages in your base (apk in Alpine or apt in Debian/Ubuntu) to pull in all your dependencies and then placing your app on top of that. (Or using the base go, python or ruby container and letting it use pip/bundle to pull in dependencies and put your app on top of that). It only runs a single process, unlike a VM (or even an LXC container which is more similar to a VM). Containers are (mostly) immutable, so you're typically not running security updates on the same thing that provides all your dependencies. You should rebuild your containers when there are security updates .. but people rarely scan for those or do that; relying more on isolation and cgroups to keep those containerized apps safe. There's very little tooling within the container, so when things go wrong, you're either execing into a single container and apt-getting all the tools you need (which you gotta do each time you rebuild it) or you need to use something like sysdig. It's popular because you can create an easy to replicate artifact that doesn't rely on a ton of system dependencies with a really basic (although kinda primitive) package building system (Dockerfile) and that is way more lightweight than a VM while providing a pretty heavy layer of isolation.
- bboreham 9y ago
  Small correction: Docker containers can run any number of processes. For example the standard apache container runs five.
  - jacques_chester 9y ago
    They can, but Docker-as-Docker won't support multiple processes. Instead you have to provide your own logic to spin up multiple processes.
- justicezyx 9y ago
  It’s a packaging mechanism plus runtime, right? It’s just oriented onwards container...

djsumdog 9y ago

It's not like that at all in any way. You're using existing OS packages in your base (apk in Alpine or apt in Debian/Ubuntu) to pull in all your dependencies and then placing your app on top of that. (Or using the base go, python or ruby container and letting it use pip/bundle to pull in dependencies and put your app on top of that). It only runs a single process, unlike a VM (or even an LXC container which is more similar to a VM). Containers are (mostly) immutable, so you're typically not running security updates on the same thing that provides all your dependencies. You should rebuild your containers when there are security updates .. but people rarely scan for those or do that; relying more on isolation and cgroups to keep those containerized apps safe. There's very little tooling within the container, so when things go wrong, you're either execing into a single container and apt-getting all the tools you need (which you gotta do each time you rebuild it) or you need to use something like sysdig. It's popular because you can create an easy to replicate artifact that doesn't rely on a ton of system dependencies with a really basic (although kinda primitive) package building system (Dockerfile) and that is way more lightweight than a VM while providing a pretty heavy layer of isolation.

bboreham 9y ago
Small correction: Docker containers can run any number of processes. For example the standard apache container runs five.
- jacques_chester 9y ago
  They can, but Docker-as-Docker won't support multiple processes. Instead you have to provide your own logic to spin up multiple processes.
justicezyx 9y ago
It’s a packaging mechanism plus runtime, right? It’s just oriented onwards container...