4 ms·

This is a pretty common sentiment on HN and I’m sure you have your reasons for it, but to me personally it just seems bonkers. Docker is an absolutely game-chan

by laingc 6y ago

This is a pretty common sentiment on HN and I’m sure you have your reasons for it, but to me personally it just seems bonkers. Docker is an absolutely game-changing tool for me. I can’t count the number of times it’s saved me from completely screwed up system libraries, tools installing config files in weird places, conflicting versions of this or that, or other versions of system pollution. I write a simple docker-compose.yml and I’m good to go - Docker takes care of sand boxing, networking, mounts - the works. As I said before, you must have your reasons for your view, but my own experience is the polar opposite. edit: typo

mherrmann 6y ago
Sure, we're all just talking about our personal experiences. I just haven't run into the problems you describe. I use virtual environments to keep my system installation clean, and PostgreSQL / Nginx are so stable that the version I happen to have on my dev machine usually works with all my projects dating back to 2014 (but kept up-to-date).
- laingc 6y ago
  Do you by any chance often have cause to compile and use tools or libraries written by academics? Or regularly use projects that aren’t as big and well-developed as Postgres and Nginx?
  - mherrmann 6y ago
    No. But I can see how Docker would be useful in such cases.
- growse 6y ago
  > Sure, we're all just talking about our personal experiences. I just haven't run into the problems you describe. I use virtual environments to keep my system installation clean, and PostgreSQL / Nginx are so stable that the version I happen to have on my dev machine usually works with all my projects dating back to 2014 (but kept up-to-date). One of the most important thing docker provides is an abstraction between the application and the OS. If you don't need the abstraction, then it's only going to look like cost. On the other hand, being able to write an some code in python 3.9 and deploy it anywhere across a heterogeneous production environment without fighting with the OS about how many versions of python it has installed is a useful thing.
  - mattmanser 6y ago
    To who? Certainly not the vast majority of developers. And if you're using Java/Node/C#/etc? Where all dependencies are included in the compiled output?
    - matsemann 6y ago
      I use mostly java, and still prefer java so I can control the jvm parameters and version (compared to managed aws for instance).
- woile 6y ago
  I find it really useful for development. For example when I configure nginx + a service, if it works in my local env, I have to run one command and I'll have the same in prod, and I don't have to debug in the server. Also is useful to keep track of the OS dependencies. But it ends up being a matter of preference, I could still do it without it, but I'm used to it now, for some reason I feel that it makes my systems more "reproducible" in a simpler way.
- sjtindell 6y ago
  It sounds like you have a small or even solo team. That could play a big role.
antidocker 6y ago
If you think Docker helps with Sandboxing, you're mistaken. Docker is a huge security hole. Oh, Crypto miners ....
- toyg 6y ago
  Yeah. Somebody above goes “users are already setup in docker” and it makes me laugh...
- johnpython 6y ago
  He was referring to sandboxing in terms of not polluting the installed packages/libraries on the server and not from a security perspective. But even from a security perspective, there are solutions to this problem like running containers as an unprivileged user using podman.
- yjftsjthsd-h 6y ago
  Explain? I'm aware that giving a host user permission to control Docker is equivalent to root, but that's no worse than wheel/sudo in most cases, and not a "sandbox" failure. So I assume you're thinking of container escape, which I was given to believe is actually hard these days?
  - antidocker 6y ago
    What makes you to think it's easier anyway? Docker use shared resources like Kernel. Linux Kernel is big ugly C mess (Compared to includeOS) and probably one can find a good enough exploit for the kernel then escape the Docker. That's and VM provides much better security. Well, VM escape exploits exists but they are at least much harder than say a Docker level escape.
blandflakes 6y ago
I'm a bit of a docker cynic, but if you tell me I have to deploy any of Ruby, Python, Node.js, or Perl, I'm using docker to manage the dependencies. My opinion is that this is actually docker's primary value-add. Yes, it enables who hosts of orchestration benefits, but it also makes it actually possible to just package these runtimes in a reasonable-ish way. For platforms which support more self-contained binaries, I'm going to keep trying to avoid docker as much as possible.

by laingc 6y ago

mherrmann 6y ago

Sure, we're all just talking about our personal experiences. I just haven't run into the problems you describe. I use virtual environments to keep my system installation clean, and PostgreSQL / Nginx are so stable that the version I happen to have on my dev machine usually works with all my projects dating back to 2014 (but kept up-to-date).

laingc 6y ago
Do you by any chance often have cause to compile and use tools or libraries written by academics? Or regularly use projects that aren’t as big and well-developed as Postgres and Nginx?
- mherrmann 6y ago
  No. But I can see how Docker would be useful in such cases.
growse 6y ago
> Sure, we're all just talking about our personal experiences. I just haven't run into the problems you describe. I use virtual environments to keep my system installation clean, and PostgreSQL / Nginx are so stable that the version I happen to have on my dev machine usually works with all my projects dating back to 2014 (but kept up-to-date). One of the most important thing docker provides is an abstraction between the application and the OS. If you don't need the abstraction, then it's only going to look like cost. On the other hand, being able to write an some code in python 3.9 and deploy it anywhere across a heterogeneous production environment without fighting with the OS about how many versions of python it has installed is a useful thing.
- mattmanser 6y ago
  To who? Certainly not the vast majority of developers. And if you're using Java/Node/C#/etc? Where all dependencies are included in the compiled output?
  - matsemann 6y ago
    I use mostly java, and still prefer java so I can control the jvm parameters and version (compared to managed aws for instance).
woile 6y ago
I find it really useful for development. For example when I configure nginx + a service, if it works in my local env, I have to run one command and I'll have the same in prod, and I don't have to debug in the server. Also is useful to keep track of the OS dependencies. But it ends up being a matter of preference, I could still do it without it, but I'm used to it now, for some reason I feel that it makes my systems more "reproducible" in a simpler way.
sjtindell 6y ago
It sounds like you have a small or even solo team. That could play a big role.

antidocker 6y ago

If you think Docker helps with Sandboxing, you're mistaken. Docker is a huge security hole. Oh, Crypto miners ....

toyg 6y ago
Yeah. Somebody above goes “users are already setup in docker” and it makes me laugh...
johnpython 6y ago
He was referring to sandboxing in terms of not polluting the installed packages/libraries on the server and not from a security perspective. But even from a security perspective, there are solutions to this problem like running containers as an unprivileged user using podman.
yjftsjthsd-h 6y ago
Explain? I'm aware that giving a host user permission to control Docker is equivalent to root, but that's no worse than wheel/sudo in most cases, and not a "sandbox" failure. So I assume you're thinking of container escape, which I was given to believe is actually hard these days?
- antidocker 6y ago
  What makes you to think it's easier anyway? Docker use shared resources like Kernel. Linux Kernel is big ugly C mess (Compared to includeOS) and probably one can find a good enough exploit for the kernel then escape the Docker. That's and VM provides much better security. Well, VM escape exploits exists but they are at least much harder than say a Docker level escape.

blandflakes 6y ago

I'm a bit of a docker cynic, but if you tell me I have to deploy any of Ruby, Python, Node.js, or Perl, I'm using docker to manage the dependencies. My opinion is that this is actually docker's primary value-add. Yes, it enables who hosts of orchestration benefits, but it also makes it actually possible to just package these runtimes in a reasonable-ish way. For platforms which support more self-contained binaries, I'm going to keep trying to avoid docker as much as possible.