5 ms·

IMO docker is the Myspace of containers. There's so many bugs I've just stopped caring. Like many devs, I have a bash alias to blow everything away when the da

IMO docker is the Myspace of containers. There's so many bugs I've just stopped caring. Like many devs, I have a bash alias to blow everything away when the daemon gets funky. And it behaves differently enough between platforms that, at least at my company, we've given up on running the same containers between different OS. I really think the endgame will be a VM based container system backwards compatible with docker. At VM level it's far easier to deal with kernel level incompatibility. Not to mention the constant security bugs that come from sharing a kernel. Somewhat ironically MS is already doing this in a way by hosting a Linux kernel in a VM for their docker implementation. They're only a step away from launching a kernel for each container. With how cheap ram is these days, sharing a kernel is pointless. You save maybe 50mb of ram per container in return for maddening implementation complexity and worse performance

piinbinary 7y ago
> With how cheap ram is these days, sharing a kernel is pointless I don't think ram use is the reason to share the kernel - the main advantages are startup time and IO performance.
- nullwasamistake 7y ago
  IO is actually better in VM these days due to PCI support for device sharing. IO sharing in containers uses virtualized software networks that generally don't perform as well as hardware that supports SR-IOV Startup time is definitely a consideration but you could lower this to container levels in many cases by keeping a couple VM's "warm" but not running
  - ecnahc515 7y ago
    Containers access disks and devices the same as anything on the host. For networking there's just as many options as with VMs. You can directly pass a specific NIC to the container without any overhead, and you can also use other options that have no more overhead than a regular network interface on the host. There's no way virtualized access to IO should be better than the host, so the containers should be no worse than that.
    - nullwasamistake 7y ago
      There's more software overhead for container networking because the host needs to maintain NAT between the containers and host network. With SR-IOV on VM's each gets it's own network stack and it's handled in hardware by the NIC. VM networking is as fast as the host. Container networking is not
hn_throwaway_99 7y ago
> I really think the endgame will be a VM based container system backwards compatible with docker. At VM level it's far easier to deal with kernel level incompatibility. Not to mention the constant security bugs that come from sharing a kernel. This is pretty much what ChromeOS does to run Linux apps with Crostini. IMO it's pretty fantastic.
cyphar 7y ago
You should check out LXD. It's containers, but they act like VMs (you have proper systemd inside the container) and the tooling is far more sane than anything Docker has. It's developed by the same folks that work on LXC (and despite what you might've heard, LXC is very good).
- aitchnyu 7y ago
  I used Lxdock to provision a dev environment as a LXC VM. It is now unmaintained and changed file permission when sharing files from host to guest. I changed to Vagrant, which has infuriating startup delays, needs restarts and breaks inotify-based tools. At least its cross platform. Is there an alternative?
dehrmann 7y ago
> And it behaves differently enough between platforms that, at least at my company, we've given up on running the same containers between different OS Since Docker just uses Linux namespaces under the hood, I assumed it would have different behaviors between Linux, Linux in a VM, FreeBSD Linux compat, etc. Maybe VMs got us used to a level of compatibility that Docker can't provide.
- nullwasamistake 7y ago
  Yes. Different kernels and various incompatibility between docker deamons on different OS'es has taken away the build once run anywhere aspect that's the whole point of docker.
Matrixik 7y ago
> I really think the endgame will be a VM based container system backwards compatible with docker. Kata Containers? > Kata Containers is an open source community working to build a secure container runtime with lightweight virtual machines that feel and perform like containers, but provide stronger workload isolation using hardware virtualization technology as a second layer of defense. https://katacontainers.io/ https://katacontainers.io/
- krageon 7y ago
  Kata containers give you all the disadvantages of containers, with none of the benefits.
ravedave5 7y ago
I've stopped updating my docker on my dev machine because every time I did I ran into new issues. I'll stick with known issues I can work around.
- nullwasamistake 7y ago
  Hah! Same. As an org we've started updating docker in the same manner we do OS upgrades. Too much risk of breaking everything, which happened to us multiple times

piinbinary 7y ago

> With how cheap ram is these days, sharing a kernel is pointless I don't think ram use is the reason to share the kernel - the main advantages are startup time and IO performance.

nullwasamistake 7y ago
IO is actually better in VM these days due to PCI support for device sharing. IO sharing in containers uses virtualized software networks that generally don't perform as well as hardware that supports SR-IOV Startup time is definitely a consideration but you could lower this to container levels in many cases by keeping a couple VM's "warm" but not running
- ecnahc515 7y ago
  Containers access disks and devices the same as anything on the host. For networking there's just as many options as with VMs. You can directly pass a specific NIC to the container without any overhead, and you can also use other options that have no more overhead than a regular network interface on the host. There's no way virtualized access to IO should be better than the host, so the containers should be no worse than that.
  - nullwasamistake 7y ago
    There's more software overhead for container networking because the host needs to maintain NAT between the containers and host network. With SR-IOV on VM's each gets it's own network stack and it's handled in hardware by the NIC. VM networking is as fast as the host. Container networking is not

hn_throwaway_99 7y ago

> I really think the endgame will be a VM based container system backwards compatible with docker. At VM level it's far easier to deal with kernel level incompatibility. Not to mention the constant security bugs that come from sharing a kernel. This is pretty much what ChromeOS does to run Linux apps with Crostini. IMO it's pretty fantastic.

cyphar 7y ago

You should check out LXD. It's containers, but they act like VMs (you have proper systemd inside the container) and the tooling is far more sane than anything Docker has. It's developed by the same folks that work on LXC (and despite what you might've heard, LXC is very good).

aitchnyu 7y ago
I used Lxdock to provision a dev environment as a LXC VM. It is now unmaintained and changed file permission when sharing files from host to guest. I changed to Vagrant, which has infuriating startup delays, needs restarts and breaks inotify-based tools. At least its cross platform. Is there an alternative?

dehrmann 7y ago

> And it behaves differently enough between platforms that, at least at my company, we've given up on running the same containers between different OS Since Docker just uses Linux namespaces under the hood, I assumed it would have different behaviors between Linux, Linux in a VM, FreeBSD Linux compat, etc. Maybe VMs got us used to a level of compatibility that Docker can't provide.

nullwasamistake 7y ago
Yes. Different kernels and various incompatibility between docker deamons on different OS'es has taken away the build once run anywhere aspect that's the whole point of docker.

Matrixik 7y ago

> I really think the endgame will be a VM based container system backwards compatible with docker. Kata Containers? > Kata Containers is an open source community working to build a secure container runtime with lightweight virtual machines that feel and perform like containers, but provide stronger workload isolation using hardware virtualization technology as a second layer of defense. https://katacontainers.io/ https://katacontainers.io/

krageon 7y ago
Kata containers give you all the disadvantages of containers, with none of the benefits.

ravedave5 7y ago

I've stopped updating my docker on my dev machine because every time I did I ran into new issues. I'll stick with known issues I can work around.

nullwasamistake 7y ago
Hah! Same. As an org we've started updating docker in the same manner we do OS upgrades. Too much risk of breaking everything, which happened to us multiple times