4 ms·

Why do you say that docker-in-docker buys him nothing? It's not obvious at all and you go into no detail whatsoever to back up your opinion. In my experience,

Why do you say that docker-in-docker buys him nothing? It's not obvious at all and you go into no detail whatsoever to back up your opinion. In my experience, that is not true at all. Docker-in-docker allows me to deliver smaller images that can fit into a CI flow as language plugins instead of shipping a beastly 5G docker image with every possible language runtime I need to support for my CI tool.

core-questions 6y ago
> beastly 5G docker image my beastly 12GB image that even includes Matlab wants a word with you
- joana035 6y ago
  >> beastly 5G docker image > my beastly 12GB image that even includes Matlab wants a word with you Perhaps in the next 10 years we will be rediscovering packages. :P If you are in the business of charging complex prices per bits over the network, then docker seems to be quite a good investment and making it as popular as possible is a good strategy to print money. /s
  - core-questions 6y ago
    Well, to be fair, it is packages - I'm just using Docker (for this section of our stack) as a different sort of VM, essentially. It runs a service manager and a VNC X session, for chrissakes ;)
  - disgruntledphd2 6y ago
    > If you are in the business of charging complex prices per bits over the network, then docker seems to be quite a good investment and making it as popular as possible is a good strategy to print money. /s True, that. To be fair, at least it allows me to avoid lots of the brokenness of Python packaging.
    - joana035 6y ago
      Is always good to report packaging bugs so then people can fix them, do you have examples of python packages that can be improved?
      - disgruntledphd2 6y ago
        See my previous comments. tl;dr pip silently breaks my environments, mostly connected to upgrading numpy and other scientific/data science libraries.
- deleted 6y ago
  [deleted]
- maccard 6y ago
  Our images are 35GB, and I've spent much of the last two weeks breaking up files so we don't hit the 8GB per file limit, and my next week will be trying to avoid hitting the per-layer limit.
joana035 6y ago
It is because to build the image using docker requires the docker client to talk with a dockerd daemon, so one has to configure the client to access the dockerd which allow untrusted code to run as root in the host. Docker-in-docker is a workaround to make docker work in CI. Basically a security nightmare and bad design that podman doesn't have.
- wwright 6y ago
  Kubernetes as a layer of indirection is another solution.
  - joana035 6y ago
    Kubernetes is a consistent management api for linux (so then you don't need to interact with iptables, mount and all that "hard stuff"). I don't think kubernetes is a solution for context of building an image (a rootfs tree into a .tar.gz file). Unless you are using kaniko which extends the kubernetes api to add the capability of creating images, but that is handled by kaniko itself via the same api.
    - wwright 6y ago
      I was probably unclear. Kubernetes is a good solution for managing containers (obviously). I use it for CI and it works very, very well, though the CI tools still have more features they could add with the integration.
- hinkley 6y ago
  Any build script can do serious damage to the environment it runs in. Before docker, you'd have to create a new VM from time to time because the build agent had rotted away or died in an altercation with a bad build. Docker in Docker in CI is like a lock on a door. It keeps honest people from being naughty, and is fairly efficient about it. I don't think the question is "should I run CI in docker in docker," it's whose CI should I run in docker in docker. Me in my coworkers can share docker images. Customers or freeloaders cannot. So if that's in your problem domain, then you're right, it's a bad idea. But it isn't for most people.

core-questions 6y ago

> beastly 5G docker image my beastly 12GB image that even includes Matlab wants a word with you

joana035 6y ago
>> beastly 5G docker image > my beastly 12GB image that even includes Matlab wants a word with you Perhaps in the next 10 years we will be rediscovering packages. :P If you are in the business of charging complex prices per bits over the network, then docker seems to be quite a good investment and making it as popular as possible is a good strategy to print money. /s
- core-questions 6y ago
  Well, to be fair, it is packages - I'm just using Docker (for this section of our stack) as a different sort of VM, essentially. It runs a service manager and a VNC X session, for chrissakes ;)
- disgruntledphd2 6y ago
  > If you are in the business of charging complex prices per bits over the network, then docker seems to be quite a good investment and making it as popular as possible is a good strategy to print money. /s True, that. To be fair, at least it allows me to avoid lots of the brokenness of Python packaging.
  - joana035 6y ago
    Is always good to report packaging bugs so then people can fix them, do you have examples of python packages that can be improved?
    - disgruntledphd2 6y ago
      See my previous comments. tl;dr pip silently breaks my environments, mostly connected to upgrading numpy and other scientific/data science libraries.
deleted 6y ago
[deleted]
maccard 6y ago
Our images are 35GB, and I've spent much of the last two weeks breaking up files so we don't hit the 8GB per file limit, and my next week will be trying to avoid hitting the per-layer limit.

joana035 6y ago

It is because to build the image using docker requires the docker client to talk with a dockerd daemon, so one has to configure the client to access the dockerd which allow untrusted code to run as root in the host. Docker-in-docker is a workaround to make docker work in CI. Basically a security nightmare and bad design that podman doesn't have.

wwright 6y ago
Kubernetes as a layer of indirection is another solution.
- joana035 6y ago
  Kubernetes is a consistent management api for linux (so then you don't need to interact with iptables, mount and all that "hard stuff"). I don't think kubernetes is a solution for context of building an image (a rootfs tree into a .tar.gz file). Unless you are using kaniko which extends the kubernetes api to add the capability of creating images, but that is handled by kaniko itself via the same api.
  - wwright 6y ago
    I was probably unclear. Kubernetes is a good solution for managing containers (obviously). I use it for CI and it works very, very well, though the CI tools still have more features they could add with the integration.
hinkley 6y ago
Any build script can do serious damage to the environment it runs in. Before docker, you'd have to create a new VM from time to time because the build agent had rotted away or died in an altercation with a bad build. Docker in Docker in CI is like a lock on a door. It keeps honest people from being naughty, and is fairly efficient about it. I don't think the question is "should I run CI in docker in docker," it's whose CI should I run in docker in docker. Me in my coworkers can share docker images. Customers or freeloaders cannot. So if that's in your problem domain, then you're right, it's a bad idea. But it isn't for most people.