3 ms·

And I'm not sure why the OPs link is relevant. If you look at the blog post it's all old architecture and most of the first round of points of "why not Docker"

And I'm not sure why the OPs link is relevant. If you look at the blog post it's all old architecture and most of the first round of points of "why not Docker" (a favorite way of RHEL employees to have a conversation about containers) are completely outdated and wrong as it stands today. It's actually a pretty entertaining read given most of the points no longer apply.

mceachen 7y ago
What bits are outdated? Can docker run rootless now or without a daemon? (I'm actually asking, I'm not a docker expert)
- windexh8er 7y ago
  The entire architecture in the blog post is wrong and thereby most of the bulleted reasons the author claims. The container runtime is now containerd and, yes, there have been many strides to run rootless [0]. [0] https://medium.com/@tonistiigi/experimenting-with-rootless-docker-416c9ad8c0d6 https://medium.com/@tonistiigi/experimenting-with-rootless-d...
  - ipbabble 7y ago
    dockerd/containerd ¯\_(ツ)_/¯
freedomben 7y ago
I don't disagree with you, but two things worth considering: 1. Perhaps it's blog posts like these and innovation in RH tools that spurred docker into action making things better? 2. You've got to remember the target market where RH operates: huge scale, and often extremely high security. To you a daemon may not be a big deal, but to a bank that's an attack surface that is scary. You might not find the "docker has an unnecessary daemon" argument compelling, but many in the high security field definitely do. Disclaimer: I work for Red Hat
- windexh8er 7y ago
  Docker architecture isn't reflective of that blog post anymore. Considering containerd is now the runtime, the arguments outlined initially for "why Docker isn't good in Redhats eyes" are no longer valid in the case of how the argument is laid out. I don't feel Docker was incented to do anything based on RH's blog posts. I worked for Docker and the joke internally was how hard RH went out of their way in a "me too" fashion to compare their homegrown products, that weren't offering any upside and offering a lot of replacements that weren't nearly with feature parity. Dan Walsh was the butt of many jokes with his tirades about how one should never say Docker, and in turn probably exposed more people to Docker than he turned away. High security? As I understand it RH doesn't have a way to guarantee containers that are requested to be run have been signed by appropriate release control. Docker can. Since you're a RH employee maybe you can share the innovative reasoning why RH removed all Docker bits (that they could) from the OS and started telling customers Docker on RHEL wasn't supported? Sounds very anti-innovative to me, but would love your feedback.
  - freedomben 7y ago
    Thanks for sharing your perspective, I appreciate it! > Since you're a RH employee maybe you can share the innovative reasoning why RH removed all Docker bits (that they could) from the OS and started telling customers Docker on RHEL wasn't supported? Sounds very anti-innovative to me, but would love your feedback. I don't work on any of the podman/buildah/etc stuff so I can't speak about any of that as an employee since I have no special insight. (I just disclosed my employer previously so people can judge for themselves if my opinions/thoughts reflect a conflict of interest). But speaking just as a fan of docker (and of podman too), I actually agree that removing the docker bits from RHEL isn't cool. I've used Fedora as my workstation for over 10 years now and were I still working for various start ups I'd have a harder time since I used Docker for containerizing and deploying our apps. I'd probably have to run Ubuntu in a VM so I could use "real" docker, which would make me sad. As I understand it tho it wasn't a decision they reached lightly. There were compatibility issues (such as cgroups v2) that would have held back other things. Sorry I can't be any more specific. I just don't know enough about the background. I do think the real or perceived animosity tho is counter-productive, and I agree the Dan Walsh stuff was a bit on the silly side. I mean, "docker" and "containers" really did become synonymous in many developer minds, but I don't see why that was a big deal (and it certainly wasn't unfairly earned). Can you comment about the Docker closed API stuff? As I understand it, Docker (the company) never released the API to the community (or CNCF, etc) and that is part of the reason why RH didn't want to support it for reasons of legal ambiguity and not wanting to be on the hook for a specific vendor's implementation. I think it's a shame there isn't more collaboration between the RH people and Docker people. The rift may not be reparable now, but I hope we don't end up with a huge divide in the community where all RH/Fedora people have to use podman and Ubuntu/Debian people use Docker, and each OS doesn't support the either. That would be bad for everyone. Sorry this comment is going on forever, but lastly since you worked for docker, thank you! Docker revolutionized the way I did things and has made my life better. Regardless what happens, Docker will have a warm place in my heart.

mceachen 7y ago

What bits are outdated? Can docker run rootless now or without a daemon? (I'm actually asking, I'm not a docker expert)

windexh8er 7y ago
The entire architecture in the blog post is wrong and thereby most of the bulleted reasons the author claims. The container runtime is now containerd and, yes, there have been many strides to run rootless [0]. [0] https://medium.com/@tonistiigi/experimenting-with-rootless-docker-416c9ad8c0d6 https://medium.com/@tonistiigi/experimenting-with-rootless-d...
- ipbabble 7y ago
  dockerd/containerd ¯\_(ツ)_/¯

freedomben 7y ago

I don't disagree with you, but two things worth considering: 1. Perhaps it's blog posts like these and innovation in RH tools that spurred docker into action making things better? 2. You've got to remember the target market where RH operates: huge scale, and often extremely high security. To you a daemon may not be a big deal, but to a bank that's an attack surface that is scary. You might not find the "docker has an unnecessary daemon" argument compelling, but many in the high security field definitely do. Disclaimer: I work for Red Hat

windexh8er 7y ago
Docker architecture isn't reflective of that blog post anymore. Considering containerd is now the runtime, the arguments outlined initially for "why Docker isn't good in Redhats eyes" are no longer valid in the case of how the argument is laid out. I don't feel Docker was incented to do anything based on RH's blog posts. I worked for Docker and the joke internally was how hard RH went out of their way in a "me too" fashion to compare their homegrown products, that weren't offering any upside and offering a lot of replacements that weren't nearly with feature parity. Dan Walsh was the butt of many jokes with his tirades about how one should never say Docker, and in turn probably exposed more people to Docker than he turned away. High security? As I understand it RH doesn't have a way to guarantee containers that are requested to be run have been signed by appropriate release control. Docker can. Since you're a RH employee maybe you can share the innovative reasoning why RH removed all Docker bits (that they could) from the OS and started telling customers Docker on RHEL wasn't supported? Sounds very anti-innovative to me, but would love your feedback.
- freedomben 7y ago
  Thanks for sharing your perspective, I appreciate it! > Since you're a RH employee maybe you can share the innovative reasoning why RH removed all Docker bits (that they could) from the OS and started telling customers Docker on RHEL wasn't supported? Sounds very anti-innovative to me, but would love your feedback. I don't work on any of the podman/buildah/etc stuff so I can't speak about any of that as an employee since I have no special insight. (I just disclosed my employer previously so people can judge for themselves if my opinions/thoughts reflect a conflict of interest). But speaking just as a fan of docker (and of podman too), I actually agree that removing the docker bits from RHEL isn't cool. I've used Fedora as my workstation for over 10 years now and were I still working for various start ups I'd have a harder time since I used Docker for containerizing and deploying our apps. I'd probably have to run Ubuntu in a VM so I could use "real" docker, which would make me sad. As I understand it tho it wasn't a decision they reached lightly. There were compatibility issues (such as cgroups v2) that would have held back other things. Sorry I can't be any more specific. I just don't know enough about the background. I do think the real or perceived animosity tho is counter-productive, and I agree the Dan Walsh stuff was a bit on the silly side. I mean, "docker" and "containers" really did become synonymous in many developer minds, but I don't see why that was a big deal (and it certainly wasn't unfairly earned). Can you comment about the Docker closed API stuff? As I understand it, Docker (the company) never released the API to the community (or CNCF, etc) and that is part of the reason why RH didn't want to support it for reasons of legal ambiguity and not wanting to be on the hook for a specific vendor's implementation. I think it's a shame there isn't more collaboration between the RH people and Docker people. The rift may not be reparable now, but I hope we don't end up with a huge divide in the community where all RH/Fedora people have to use podman and Ubuntu/Debian people use Docker, and each OS doesn't support the either. That would be bad for everyone. Sorry this comment is going on forever, but lastly since you worked for docker, thank you! Docker revolutionized the way I did things and has made my life better. Regardless what happens, Docker will have a warm place in my heart.