11 ms·

What Exactly is Docker?

152 points by karakanb 7y ago

senderista 7y ago
Minor correction: ECS isn't serverless. You need to explicitly allocate instances for your cluster.
- ranrotx 7y ago
  You don’t need to allocate instances in advance if you use Fargate.
- karakanb 7y ago
  Oh, I didn't know that, thanks a lot for the correction. I updated the article to reflect that.
Waterluvian 7y ago
I'll admit it took me a while to realise that Docker containers aren't magical apparatuses that can run software. They are just an OS running like a VM. Yes there's differences but I really wish learning resources began with that. I think a lot of it has to do with the experts accidentally talking past beginners, missing a lot of the basics before getting into teaching abstractions. It also reminds me of the feeling I'm experiencing now about learning Elasticsearch. I'm amazed just how few JSON examples I can find online for the API. It was amazing how much it helped for a peer to say, "an index is a table, a document is a record and it's kind of like monogdb." Furthermore this all reminds me of wrong atomic models in high school. Please just teach me a really simple but wrong explanation then slowly work out the details.
- mav3rick 7y ago
  "OS running like a VM" is a wrong summary. Containers are collection of namespaces. Docker manages (starts , stops etc) these containers. It also provides an easy gateway into readymade container images.
  - capableweb 7y ago
    I think Waterluvian's point was that _before_ you start talking about things like containers, namespaces, images and so on, you need to explain the basics. Depending on the previous knowledge, your summary may or may not make sense. If you don't know what containers, namespaces or images mean here (basically, you haven't seen docker before), then your summary makes no sense. If you're a programmer, you most probably have heard about OSes and VMs before, one way or another. Then, the analogy is a bit easier for the beginner to understand. Hence the "slightly wrong but somehow still manages to be a bit informative"-summary Waterluvian gave can teach the beginner the first steps.
    - Waterluvian 7y ago
      Yeah. I'm getting a lot of "no it's not that". And surely this failing is on my end. But I'd learn better with an approach of "yes it's like a VM in these ways. But then it's different in these ways..." Maybe it's just me. I love teaching and learning by starting with a common but wrong model and learning piece by piece what's different until its an evolved, more accurate model.
  - Waterluvian 7y ago
    So it's an OS though right? Like Ubuntu is running, chugging along like Ubuntu does. And is it sitting on top of some virtual hardware interface to simulate IO?
    - detaro 7y ago
      > And is it sitting on top of some virtual hardware interface to simulate IO? Not really, no. Software in a container directly talks to the kernel of the host using the normal APIs the kernel provides. A container does not contain a kernel!
    - dharmab 7y ago
      No, this is absolutely wrong. Docker containers don't contain a kernel or any init system. They are simply Linux processes that are isolated from each other using a few native features of Linux.
- dharmab 7y ago
  >They are just an OS running like a VM. This is exactly what Docker containers AREN'T. Don't think of containers like tiny VMs. Think of them as processes with additional isolation from each other.
  - 3fe9a03ccd14ca5 7y ago
    A VM is a good way to logically think about the containers, and I’m sure it’s the way the vast majority of people first think about them. Under the hood they are simply a process isolated with namespaces, but their behavior on the outside feels like getting a VM.
    - FartyMcFarter 7y ago
      But docker containers don't run their own kernel, which is a huge difference to a VM.
      - 3fe9a03ccd14ca5 7y ago
        My point is that most people don’t even really know that’s how a VM works. They just think of a VM as a fresh sandbox where they can install and run stuff without deleting somebody else’s files or programs.
        wrs 7y ago
        I'm hearing a repeated theme in your comments that people don't know much about how anything works, and that's supposedly OK. That's actually not OK. :)
        kortex 7y ago
        No, that's how learning curves work. Until we can Matrix beam info into our skulljack, humans will spend a notrivial amount of time having to make do with using things while not fully understanding how they work. Unless one is 31337-rockstar-ninja-IQ150-programmer, the uptake of new skills is painful and takes time. The pedagogical process is important. It's totally OK to not know how anything works as long as you acknowledge that and are willing to learn.
- smoe 7y ago
  My maybe cynical view on this is twofold: 1. For software, open source or not, that is driven by a commercial company, it is often not in their best interest to tell people what it actually is, that they are selling. They care more about conversion rates than educating. E.g. notice how the docker.com website doesn't seem to explain at all what these "Docker containers" are, instead throw around phrases the marketing department came up with: "Docker is the de facto developer standard for building and sharing apps that enable simplicity, agility and choice [...]". Doesn't mean the tech is good or bad. It can just make it obnoxious to sift trough the propaganda to get the info you want/need. 2. There are plenty of developers that can't be bothered to obtain a deeper understanding of the things they are working with, beyond the getting started tutorial. Which is fine in the beginning, but eventually one should get past that.
  - netsharc 7y ago
    > "Docker is the de facto developer standard for building and sharing apps that enable simplicity, agility and choice [...]". You're right. It's only slightly better than zombo.com (https://html5zombo.com/ https://html5zombo.com/)
  - viraptor 7y ago
    For a less cynical view that says pretty much the same: They want to tell people what's the software usef for / what do they gain from using the software, and not internal details. Would you prefer to know what docker containers are, or what they provide? For example would you rather the first explanation started "Containers allow you to run applications in an environment with its own filesystem and network, isolated from the resources of the main system", or "Containers are a standardised abstraction layer over linux namespaces and resource use restrictions, with common interfaces for network and volume management"? And would you stop using containers if they provided the same benefits, but technically in a different way?
Ericson2314 7y ago
Docker is bad because while docker images crudely compose sequentially (the fs layers), docker files don't compose at all. The goal of Nix and Nixpkgs is to have effient recipes for building everything ever, in all configurations. The docker ecosystem could never get there. Now containers do make sense for deployment, but that has little to do with docker, as those docker replacements for kubernetes demonstrate.
- 3fe9a03ccd14ca5 7y ago
  > The goal of Nix and Nixpkgs is to have effient recipes for building everything ever, in all configurations. The docker ecosystem could never get there. Packaging is just one component of a container, and it actually works quite well in docker, since it feels like you’re packaging up the entire OS.
orf 7y ago
> # install chromedriver > RUN apk update > RUN apk add chromium chromium-chromedriver These kind of poor examples lead to a huge amount of waste when using Docker because people learning it are not taught about how layers interact, leading to ridiculous things like 'COPY' followed by 'RUN chown'. Layers are a _core_ part of how Docker works, why not make this example "correct" by doing: > RUN apk --no-cache add chromium chromium-chromedriver Then just a comment like this: "it's important to group layers if possible to reduce your image size. By using `--no-cache` apk will update at the same time as installing".
- deleted 7y ago
  [deleted]
- sneak 7y ago
  This article also has an image that shows containers running “on top of” docker; that’s not how any of this works. Docker is just the daemon that sets up the namespaces and runs the containers. It’s not some magical runtime, any more than “iptables” is. It just talks to the kernel. I think this post is attempting to oversimplify, and is doing a bad job of teaching in the process.
  - kortex 7y ago
    Running Docker containers is definitely on top of the Docker runtime. Maybe not from a PID parent point of view, but absolutely from an abstraction point of view. Try doing anything hardware-network-topology relevant stuff without `network=host`, like running a ROS cluster with direct ethernet connections between hosts and cameras. It's definitely "on top" in a way bare-metal isn't. Same way that a vm is "on top of" kvm even though the cpu supports hardware virtualization. Nvidia-docker is another abstraction. It's a pass-through. It's not the same as bare-metal. Certainly feels the same 98% of the time, but in that 2% it is very much apparent there is a layer in between.
- 3fe9a03ccd14ca5 7y ago
  The article is a “what is docker?” and This is a perfectly fine way to use docker. There’s always room for optimizing layers in the future. Always start with the basics rather than overwhelming people with details.
notyourday 7y ago
Docker is hipster for "shared hosting"
- tarellel 7y ago
  This has to be one of the dumbest statements I've ever read about docker. I admit some people definitely abuse the usage of Docker, because of their bad copy/paste practices from basic step-by-step walk-throughs. But the thing that makes docker great is it's easy of use to create reproducible deployments. And if you don't want to use a projects docker images; a projects Dockerfile is still a great reference on how to get a project deployed on a linux platform.
  - notyourday 7y ago
    Docker does not give you a reproducible builds - it 100% depends on a host platform.
    - progval 7y ago
      Also, any Dockerfile that downloads something that might be updated (especially package managers, but also any wget/curl/... that doesn't check against a hardcoded hash) isn't reproducible at all.
      - 2ion 7y ago
        Recently somebody showed me their sophisticated Docker file that was supposed to build a Maven project "in a reproducible way". When you ran it it spent 5 minutes downloading a bazillion files from the internet…no prior information on the content of those files was on the system. If the content of version X of a dependency changed in the meantime, you'd never know.
cosmolev 7y ago
cgroups + namespaces
- toomuchtodo 7y ago
  And tar files!
zzzeek 7y ago
> We are going to containerize our app, use container orchestration tools for deployments, and we have to install Docker. you do not. you may also install Podman. Docker does not "own" containers, there is an open standard for containers that any vendor may implement.
yegle 7y ago
The post emphasize that docker (or its proper name, a container) provide weaker isolation compare to VM but I wish author can expand on this topic a little bit. Also I'm disappointed that the good old chroot is not mentioned, or the BSD jail system.
fulafel 7y ago
The title was promising but it seems that the author hasn't noticed that Docker the company uses the same name for many different things. On Mac and Windows, Docker is a VM. On Linux it's what this article discusses. I don't even know what Docker Enterprise is.
- karakanb 7y ago
  Hey, OP here, thanks a lot for the input. I know that the company uses the same name for multiple stuff, but I also think that, from my very own experience, people associate the name "Docker" with containers in general, regardless of the runtime used with them; therefore, I wanted to come up with an explanation that is simple enough to get started with containers, and decorate it with some examples to make things more approachable for beginners. I believe that there are certain improvements that containers might bring to software development lifecycle of certain products, and I wanted to enable people to attempt improving their workflows with this article. If you have suggestions to improve my point above in the article itself I'd be glad to take that input and incorporate it into the article itself, feel free to write here or reach out to me via email in my bio. Again, thank you for the feedback.
- mr_toad 7y ago
  On Windows most people will be using a VM to run Linux in which will then be used to run containers. It’s more correct to say that Docker runs inside a VM on Windows (and on MacOS). On Windows it is also possible to run Windows containers (no Linux at all) that use the Windows kernel and run Windows programs.
d_burfoot 7y ago
> therefore, you will be externalizing these values and decouple them from the application, which will give you great flexibility in the long term I think this is one of the worst "Best Practices" ideas that are parroted by people who haven't thought deeply about the issue. It's really a bad legacy from the era when most software was actually distributed. Now that most software runs in environments that are controlled by the same organization that developed the software, the principle is far less valuable. Nowadays, most software should have most of its configuration information - paths, DB URLs, HTTP endpoints, etc - hard-coded into it. This strategy follows the "convention over configuration" philosophy, and it gives you a range of benefits. First of all, you can run tests on your config to make sure everything is working properly (check various files are present, do a SELECT * LIMIT 1 from DB tables, etc). You can catch config errors at compile time, eg by using enums like prod/dev/qa to represent environment names. And it prompts you to apply a refactoring mindset to your config - when you notice that your config code is repeating itself extensively, you'll realize this and be able to take steps to refactor, standardize, and simplify the config.
- lbotos 7y ago
  This feels... backwards, but it's probably because I'm indoctrinated to external configs. Do you have references to companies that are developing software this way at scale?
  - Izkata 7y ago
    I'm not entirely sure if this is what GP was describing, but as a quick example, likely any that use the Django web framework. By default it puts the settings inside the repo, and at least at my work we just build off of that by putting multiple settings files in the repo and switch between them depending on dev/beta/live/etc.
otabdeveloper2 7y ago
> What Exactly is Docker? For 99% of the world, the answer is "a file format like .tar.gz except composable". These guys are really missing their target audience needs by a mile.
- petilon 7y ago
  More like a VM that shares the host machine's OS.
city41 7y ago
I have a SQL library that I maintain and it supports Postgres, Maria, MySQL and SQLite. I use Docker for integration testing and it works really well. I have no need for these db engines otherwise, so making them just completely go away when not working on the library is excellent.
z3t4 7y ago
I'm currently working on implementing Docker support for a multi tenant service where users can login to their IDE from a Chromebook or what not... It seems docker was not designed for that use case. And every tutorial out there assumes you are running as root and have the Docker daemon installed on your local system...
- wrboyce 7y ago
  I deal with Docker daily and don’t run as root and quite frequently am not dealing with a local Docker instance. Maybe you should RTFM, as they say?
  - z3t4 7y ago
    How do you solve local mounts, eg. a folder on your local developer machine mounted to a folder inside the container, if using a remote docker daemon? My current solution is to give each user their own docker daemon running in a dedicated virtual machine... Do you have a better solution?
skube 7y ago
docker is dead - thank god
kdot 7y ago
Can anyone speak to why deploying your application as a container is more expensive than deploying on an VM instance?
stevebmark 7y ago
> The actual way containers work is a complex topic that I will not get into here, but overall the concept is simple: give me an operating system (OS) level virtualization so that I can play around with different stuff in isolation. Sad to see he gave up before he started, and instead of explaining what Docker is, went off into the docker and docker-compose CLI commands. What an opaque explanation too :( Docker is hard to explain, and the official documentation won't help you understand it. I'm sad that so few people are self aware enough to combine just the right, minimal depth of concepts about kernels, operating systems, systemd, namespaces, and the fact this all only works on Linux, to make a truly approachable explanation. Most developers are really bad at teaching, they only describe things they already know, vs actually trying to teach something.
- petilon 7y ago
  > and the fact this all only works on Linux Docker runs on Windows. Windows containers run on Windows. Linux containers run on Linux as well as Windows. (To run Linux containers on Windows a small Linux kernel is run inside HyperV.) You can think of Docker containers as VMs, except instead of running its own copy of the OS it runs directly on top of the host machine's OS.
  - bitbang 7y ago
    That is not anything close to the kernel namespaces used to provide different types of userspace isolation. That's crippled virtualization.
- karakanb 7y ago
  Hey, OP here, thanks a lot for the feedback. I understand some bits and pieces about how containers work internally on different platforms, I also have a draft article that goes into depth with these, but the goal of this specific article was to give some general information as a basis for people to get started. You don't have to how namespaces work on Linux in order to build a Dockerfile for your project and share it with your colleagues. You don't have to have the most optimal image in order to replace your `git pull` on your server with a simple Docker Compose setup. My goal was to give high-level overview of these technologies and include actionable examples so that the improvements I believe these technologies bring can be applied immediately by the readers. > Most developers are really bad at teaching As per this one, I am honestly sad to read this, though I am glad that you gave this feedback. I had a really hard time a couple of years ago when I was starting to learn these technologies, and I remember very vividly that everything I read was very abstract and lost in detail, which made me feel very dumb. I personally believe that any complex topic can be explained to a layman if the teacher knows the topic well enough, and I wanted to attempt to build a document that I wish existed at the time I was trying to learn these stuff. I was thinking I did a decent job with this article, but clearly there are some short-comings in terms of the content and the way I explained things. If you have any suggestions, please feel free to give suggestions so that I can make improvements to the article and keep it as a living document, I am genuinely interested in improving both my skills and this article itself. Again, thanks a lot for the feedback.
arminiusreturns 7y ago
cgroups and pid's, just like every other container tech
lazyant 7y ago
Docker is 1) namespace and chroot for separating processes 2) cgroups to limit hardware resources (CPU/RAM) . This allows for this "packaging" and kind of "sandbox". In addition, it adds a file-saving feature by using a layering filesystem. Please watch this awesome presentation: https://www.youtube.com/watch?v=zGw_xKF47T0 https://www.youtube.com/watch?v=zGw_xKF47T0
- jdnier 7y ago
  That video really is awesome. A lot of practical experience distilled.
enriquto 7y ago
just an extremely static executable
mmis1000 7y ago
I thought Docker is a common standard that defines. How archive format? How build file format? How the config format? What operation system need to support in order to be fully compatible with docker cli? Instead of a cli tool. Because there are already standalone docker implementations that implemented with completely different technology. Just like docker on windows (the one runs exe).
jeffehobbs 7y ago
This is a wonderful overview. Many thanks to the OP for putting this together.
- karakanb 7y ago
  Thank you very much for your comment, it made my day. I have had a hard time getting started with these technologies, especially with everyone talking about these without explaining what they actually are in a basic state, that's why I tried to come up with an article that I wish existed when I started. There is probably a lot of stuff to improve there, but I hope it helps getting started with these topics somehow.
sadness2 7y ago
What is Docker? We just don't know.
deleted 7y ago
[deleted]

152 points by karakanb 7y ago

senderista 7y ago

Minor correction: ECS isn't serverless. You need to explicitly allocate instances for your cluster.

ranrotx 7y ago
You don’t need to allocate instances in advance if you use Fargate.
karakanb 7y ago
Oh, I didn't know that, thanks a lot for the correction. I updated the article to reflect that.

Waterluvian 7y ago

I'll admit it took me a while to realise that Docker containers aren't magical apparatuses that can run software. They are just an OS running like a VM. Yes there's differences but I really wish learning resources began with that. I think a lot of it has to do with the experts accidentally talking past beginners, missing a lot of the basics before getting into teaching abstractions. It also reminds me of the feeling I'm experiencing now about learning Elasticsearch. I'm amazed just how few JSON examples I can find online for the API. It was amazing how much it helped for a peer to say, "an index is a table, a document is a record and it's kind of like monogdb." Furthermore this all reminds me of wrong atomic models in high school. Please just teach me a really simple but wrong explanation then slowly work out the details.

mav3rick 7y ago
"OS running like a VM" is a wrong summary. Containers are collection of namespaces. Docker manages (starts , stops etc) these containers. It also provides an easy gateway into readymade container images.
- capableweb 7y ago
  I think Waterluvian's point was that _before_ you start talking about things like containers, namespaces, images and so on, you need to explain the basics. Depending on the previous knowledge, your summary may or may not make sense. If you don't know what containers, namespaces or images mean here (basically, you haven't seen docker before), then your summary makes no sense. If you're a programmer, you most probably have heard about OSes and VMs before, one way or another. Then, the analogy is a bit easier for the beginner to understand. Hence the "slightly wrong but somehow still manages to be a bit informative"-summary Waterluvian gave can teach the beginner the first steps.
  - Waterluvian 7y ago
    Yeah. I'm getting a lot of "no it's not that". And surely this failing is on my end. But I'd learn better with an approach of "yes it's like a VM in these ways. But then it's different in these ways..." Maybe it's just me. I love teaching and learning by starting with a common but wrong model and learning piece by piece what's different until its an evolved, more accurate model.
- Waterluvian 7y ago
  So it's an OS though right? Like Ubuntu is running, chugging along like Ubuntu does. And is it sitting on top of some virtual hardware interface to simulate IO?
  - detaro 7y ago
    > And is it sitting on top of some virtual hardware interface to simulate IO? Not really, no. Software in a container directly talks to the kernel of the host using the normal APIs the kernel provides. A container does not contain a kernel!
  - dharmab 7y ago
    No, this is absolutely wrong. Docker containers don't contain a kernel or any init system. They are simply Linux processes that are isolated from each other using a few native features of Linux.
dharmab 7y ago
>They are just an OS running like a VM. This is exactly what Docker containers AREN'T. Don't think of containers like tiny VMs. Think of them as processes with additional isolation from each other.
- 3fe9a03ccd14ca5 7y ago
  A VM is a good way to logically think about the containers, and I’m sure it’s the way the vast majority of people first think about them. Under the hood they are simply a process isolated with namespaces, but their behavior on the outside feels like getting a VM.
  - FartyMcFarter 7y ago
    But docker containers don't run their own kernel, which is a huge difference to a VM.
    - 3fe9a03ccd14ca5 7y ago
      My point is that most people don’t even really know that’s how a VM works. They just think of a VM as a fresh sandbox where they can install and run stuff without deleting somebody else’s files or programs.
      - wrs 7y ago
        I'm hearing a repeated theme in your comments that people don't know much about how anything works, and that's supposedly OK. That's actually not OK. :)
        kortex 7y ago
        No, that's how learning curves work. Until we can Matrix beam info into our skulljack, humans will spend a notrivial amount of time having to make do with using things while not fully understanding how they work. Unless one is 31337-rockstar-ninja-IQ150-programmer, the uptake of new skills is painful and takes time. The pedagogical process is important. It's totally OK to not know how anything works as long as you acknowledge that and are willing to learn.
smoe 7y ago
My maybe cynical view on this is twofold: 1. For software, open source or not, that is driven by a commercial company, it is often not in their best interest to tell people what it actually is, that they are selling. They care more about conversion rates than educating. E.g. notice how the docker.com website doesn't seem to explain at all what these "Docker containers" are, instead throw around phrases the marketing department came up with: "Docker is the de facto developer standard for building and sharing apps that enable simplicity, agility and choice [...]". Doesn't mean the tech is good or bad. It can just make it obnoxious to sift trough the propaganda to get the info you want/need. 2. There are plenty of developers that can't be bothered to obtain a deeper understanding of the things they are working with, beyond the getting started tutorial. Which is fine in the beginning, but eventually one should get past that.
- netsharc 7y ago
  > "Docker is the de facto developer standard for building and sharing apps that enable simplicity, agility and choice [...]". You're right. It's only slightly better than zombo.com (https://html5zombo.com/ https://html5zombo.com/)
- viraptor 7y ago
  For a less cynical view that says pretty much the same: They want to tell people what's the software usef for / what do they gain from using the software, and not internal details. Would you prefer to know what docker containers are, or what they provide? For example would you rather the first explanation started "Containers allow you to run applications in an environment with its own filesystem and network, isolated from the resources of the main system", or "Containers are a standardised abstraction layer over linux namespaces and resource use restrictions, with common interfaces for network and volume management"? And would you stop using containers if they provided the same benefits, but technically in a different way?

Ericson2314 7y ago

Docker is bad because while docker images crudely compose sequentially (the fs layers), docker files don't compose at all. The goal of Nix and Nixpkgs is to have effient recipes for building everything ever, in all configurations. The docker ecosystem could never get there. Now containers do make sense for deployment, but that has little to do with docker, as those docker replacements for kubernetes demonstrate.

3fe9a03ccd14ca5 7y ago
> The goal of Nix and Nixpkgs is to have effient recipes for building everything ever, in all configurations. The docker ecosystem could never get there. Packaging is just one component of a container, and it actually works quite well in docker, since it feels like you’re packaging up the entire OS.

orf 7y ago

> # install chromedriver > RUN apk update > RUN apk add chromium chromium-chromedriver These kind of poor examples lead to a huge amount of waste when using Docker because people learning it are not taught about how layers interact, leading to ridiculous things like 'COPY' followed by 'RUN chown'. Layers are a _core_ part of how Docker works, why not make this example "correct" by doing: > RUN apk --no-cache add chromium chromium-chromedriver Then just a comment like this: "it's important to group layers if possible to reduce your image size. By using `--no-cache` apk will update at the same time as installing".

deleted 7y ago
[deleted]
sneak 7y ago
This article also has an image that shows containers running “on top of” docker; that’s not how any of this works. Docker is just the daemon that sets up the namespaces and runs the containers. It’s not some magical runtime, any more than “iptables” is. It just talks to the kernel. I think this post is attempting to oversimplify, and is doing a bad job of teaching in the process.
- kortex 7y ago
  Running Docker containers is definitely on top of the Docker runtime. Maybe not from a PID parent point of view, but absolutely from an abstraction point of view. Try doing anything hardware-network-topology relevant stuff without `network=host`, like running a ROS cluster with direct ethernet connections between hosts and cameras. It's definitely "on top" in a way bare-metal isn't. Same way that a vm is "on top of" kvm even though the cpu supports hardware virtualization. Nvidia-docker is another abstraction. It's a pass-through. It's not the same as bare-metal. Certainly feels the same 98% of the time, but in that 2% it is very much apparent there is a layer in between.
3fe9a03ccd14ca5 7y ago
The article is a “what is docker?” and This is a perfectly fine way to use docker. There’s always room for optimizing layers in the future. Always start with the basics rather than overwhelming people with details.

notyourday 7y ago

Docker is hipster for "shared hosting"

tarellel 7y ago
This has to be one of the dumbest statements I've ever read about docker. I admit some people definitely abuse the usage of Docker, because of their bad copy/paste practices from basic step-by-step walk-throughs. But the thing that makes docker great is it's easy of use to create reproducible deployments. And if you don't want to use a projects docker images; a projects Dockerfile is still a great reference on how to get a project deployed on a linux platform.
- notyourday 7y ago
  Docker does not give you a reproducible builds - it 100% depends on a host platform.
  - progval 7y ago
    Also, any Dockerfile that downloads something that might be updated (especially package managers, but also any wget/curl/... that doesn't check against a hardcoded hash) isn't reproducible at all.
    - 2ion 7y ago
      Recently somebody showed me their sophisticated Docker file that was supposed to build a Maven project "in a reproducible way". When you ran it it spent 5 minutes downloading a bazillion files from the internet…no prior information on the content of those files was on the system. If the content of version X of a dependency changed in the meantime, you'd never know.

cosmolev 7y ago

cgroups + namespaces

toomuchtodo 7y ago
And tar files!

zzzeek 7y ago

> We are going to containerize our app, use container orchestration tools for deployments, and we have to install Docker. you do not. you may also install Podman. Docker does not "own" containers, there is an open standard for containers that any vendor may implement.

yegle 7y ago

The post emphasize that docker (or its proper name, a container) provide weaker isolation compare to VM but I wish author can expand on this topic a little bit. Also I'm disappointed that the good old chroot is not mentioned, or the BSD jail system.

fulafel 7y ago

The title was promising but it seems that the author hasn't noticed that Docker the company uses the same name for many different things. On Mac and Windows, Docker is a VM. On Linux it's what this article discusses. I don't even know what Docker Enterprise is.

karakanb 7y ago
Hey, OP here, thanks a lot for the input. I know that the company uses the same name for multiple stuff, but I also think that, from my very own experience, people associate the name "Docker" with containers in general, regardless of the runtime used with them; therefore, I wanted to come up with an explanation that is simple enough to get started with containers, and decorate it with some examples to make things more approachable for beginners. I believe that there are certain improvements that containers might bring to software development lifecycle of certain products, and I wanted to enable people to attempt improving their workflows with this article. If you have suggestions to improve my point above in the article itself I'd be glad to take that input and incorporate it into the article itself, feel free to write here or reach out to me via email in my bio. Again, thank you for the feedback.
mr_toad 7y ago
On Windows most people will be using a VM to run Linux in which will then be used to run containers. It’s more correct to say that Docker runs inside a VM on Windows (and on MacOS). On Windows it is also possible to run Windows containers (no Linux at all) that use the Windows kernel and run Windows programs.

d_burfoot 7y ago

> therefore, you will be externalizing these values and decouple them from the application, which will give you great flexibility in the long term I think this is one of the worst "Best Practices" ideas that are parroted by people who haven't thought deeply about the issue. It's really a bad legacy from the era when most software was actually distributed. Now that most software runs in environments that are controlled by the same organization that developed the software, the principle is far less valuable. Nowadays, most software should have most of its configuration information - paths, DB URLs, HTTP endpoints, etc - hard-coded into it. This strategy follows the "convention over configuration" philosophy, and it gives you a range of benefits. First of all, you can run tests on your config to make sure everything is working properly (check various files are present, do a SELECT * LIMIT 1 from DB tables, etc). You can catch config errors at compile time, eg by using enums like prod/dev/qa to represent environment names. And it prompts you to apply a refactoring mindset to your config - when you notice that your config code is repeating itself extensively, you'll realize this and be able to take steps to refactor, standardize, and simplify the config.

lbotos 7y ago
This feels... backwards, but it's probably because I'm indoctrinated to external configs. Do you have references to companies that are developing software this way at scale?
- Izkata 7y ago
  I'm not entirely sure if this is what GP was describing, but as a quick example, likely any that use the Django web framework. By default it puts the settings inside the repo, and at least at my work we just build off of that by putting multiple settings files in the repo and switch between them depending on dev/beta/live/etc.

otabdeveloper2 7y ago

> What Exactly is Docker? For 99% of the world, the answer is "a file format like .tar.gz except composable". These guys are really missing their target audience needs by a mile.

petilon 7y ago
More like a VM that shares the host machine's OS.

city41 7y ago

I have a SQL library that I maintain and it supports Postgres, Maria, MySQL and SQLite. I use Docker for integration testing and it works really well. I have no need for these db engines otherwise, so making them just completely go away when not working on the library is excellent.

z3t4 7y ago

I'm currently working on implementing Docker support for a multi tenant service where users can login to their IDE from a Chromebook or what not... It seems docker was not designed for that use case. And every tutorial out there assumes you are running as root and have the Docker daemon installed on your local system...

wrboyce 7y ago
I deal with Docker daily and don’t run as root and quite frequently am not dealing with a local Docker instance. Maybe you should RTFM, as they say?
- z3t4 7y ago
  How do you solve local mounts, eg. a folder on your local developer machine mounted to a folder inside the container, if using a remote docker daemon? My current solution is to give each user their own docker daemon running in a dedicated virtual machine... Do you have a better solution?

skube 7y ago

docker is dead - thank god

kdot 7y ago

Can anyone speak to why deploying your application as a container is more expensive than deploying on an VM instance?

stevebmark 7y ago

> The actual way containers work is a complex topic that I will not get into here, but overall the concept is simple: give me an operating system (OS) level virtualization so that I can play around with different stuff in isolation. Sad to see he gave up before he started, and instead of explaining what Docker is, went off into the docker and docker-compose CLI commands. What an opaque explanation too :( Docker is hard to explain, and the official documentation won't help you understand it. I'm sad that so few people are self aware enough to combine just the right, minimal depth of concepts about kernels, operating systems, systemd, namespaces, and the fact this all only works on Linux, to make a truly approachable explanation. Most developers are really bad at teaching, they only describe things they already know, vs actually trying to teach something.

petilon 7y ago
> and the fact this all only works on Linux Docker runs on Windows. Windows containers run on Windows. Linux containers run on Linux as well as Windows. (To run Linux containers on Windows a small Linux kernel is run inside HyperV.) You can think of Docker containers as VMs, except instead of running its own copy of the OS it runs directly on top of the host machine's OS.
- bitbang 7y ago
  That is not anything close to the kernel namespaces used to provide different types of userspace isolation. That's crippled virtualization.
karakanb 7y ago
Hey, OP here, thanks a lot for the feedback. I understand some bits and pieces about how containers work internally on different platforms, I also have a draft article that goes into depth with these, but the goal of this specific article was to give some general information as a basis for people to get started. You don't have to how namespaces work on Linux in order to build a Dockerfile for your project and share it with your colleagues. You don't have to have the most optimal image in order to replace your `git pull` on your server with a simple Docker Compose setup. My goal was to give high-level overview of these technologies and include actionable examples so that the improvements I believe these technologies bring can be applied immediately by the readers. > Most developers are really bad at teaching As per this one, I am honestly sad to read this, though I am glad that you gave this feedback. I had a really hard time a couple of years ago when I was starting to learn these technologies, and I remember very vividly that everything I read was very abstract and lost in detail, which made me feel very dumb. I personally believe that any complex topic can be explained to a layman if the teacher knows the topic well enough, and I wanted to attempt to build a document that I wish existed at the time I was trying to learn these stuff. I was thinking I did a decent job with this article, but clearly there are some short-comings in terms of the content and the way I explained things. If you have any suggestions, please feel free to give suggestions so that I can make improvements to the article and keep it as a living document, I am genuinely interested in improving both my skills and this article itself. Again, thanks a lot for the feedback.

arminiusreturns 7y ago

cgroups and pid's, just like every other container tech

lazyant 7y ago

Docker is 1) namespace and chroot for separating processes 2) cgroups to limit hardware resources (CPU/RAM) . This allows for this "packaging" and kind of "sandbox". In addition, it adds a file-saving feature by using a layering filesystem. Please watch this awesome presentation: https://www.youtube.com/watch?v=zGw_xKF47T0 https://www.youtube.com/watch?v=zGw_xKF47T0

jdnier 7y ago
That video really is awesome. A lot of practical experience distilled.

enriquto 7y ago

just an extremely static executable

mmis1000 7y ago

I thought Docker is a common standard that defines. How archive format? How build file format? How the config format? What operation system need to support in order to be fully compatible with docker cli? Instead of a cli tool. Because there are already standalone docker implementations that implemented with completely different technology. Just like docker on windows (the one runs exe).

jeffehobbs 7y ago

This is a wonderful overview. Many thanks to the OP for putting this together.

karakanb 7y ago
Thank you very much for your comment, it made my day. I have had a hard time getting started with these technologies, especially with everyone talking about these without explaining what they actually are in a basic state, that's why I tried to come up with an article that I wish existed when I started. There is probably a lot of stuff to improve there, but I hope it helps getting started with these topics somehow.

sadness2 7y ago

What is Docker? We just don't know.

deleted 7y ago

[deleted]