3 ms·

> Seriously. Adding a docker layer to a device as lightweight as a Raspberry Pi just seems like insanity. Your definition of insanity is perplexing. Docker in

by nuerow 5y ago

> Seriously. Adding a docker layer to a device as lightweight as a Raspberry Pi just seems like insanity. Your definition of insanity is perplexing. Docker in this context is pretty trivial to setup and run, and it's used mainly to manage packaging and deployment. Do you happen to have any experience at all with Docker?

patrakov 5y ago
It still does have a non-zero cost, especially in the long run, when security vulnerabilities pop up. With distribution package management, on Ubuntu, you can rely on your Nginx being updated and restarted automatically while you sleep. With Docker, you need to subscribe to a security mailing list in order to know about the vulnerability in the first place, and then run some commands manually that re-create the container.
- nuerow 5y ago
  > It still does have a non-zero cost, especially in the long run, when security vulnerabilities pop up. It really doesn't. Unless you were planning on doing a one-and-done deployment, it's trivial to update and redeploy Docker images. Even in my side projects I have CI/CD pipelines updating and redeploying Docker images daily. > With distribution package management, on Ubuntu, you can rely on your Nginx being updated and restarted automatically while you sleep. Whatever you can do with Ubuntu, you can do precisely the same with Docker when running a base image of Ubuntu. > With Docker, you need to subscribe to a security mailing list in order to know about the vulnerability in the first place, and then run some commands manually that re-create the container. No, you really don't. Just pull the latest base image, build your images by calling apt to update your dependencies, and you're done. Whatever you can do with a bare metal/VM install, you can do with Docker. There is nothing magical stopping you from doing the basic stuff with Docker.
  - capableweb 5y ago
    patrakov is talking about updating the docker daemon/engine (that runs on the host), not the images that you run with docker.
    - patrakov 5y ago
      Nope, I was talking about the images. More precisely, about knowing when to update them.
LeoPanthera 5y ago
Yes, and it's doubly pointless here, because it isn't doing anything that couldn't be done better by the OS's own package manager. Better, probably, because you will get timely security updates.
- nuerow 5y ago
  > Yes, and it's doubly pointless here, because it isn't doing anything that couldn't be done better by the OS's own package manager. No, not really. With Docker, packaging is a solved problem, and you also get for free a deployment history which you can roll back and forward at will. You also get introspection and blue/green deployments, and if you really want to you can also setup a cluster of nodes for free where you can run whole application stacks with a one-liner. There is really no excuse to do things the hard way.

by nuerow 5y ago

patrakov 5y ago

It still does have a non-zero cost, especially in the long run, when security vulnerabilities pop up. With distribution package management, on Ubuntu, you can rely on your Nginx being updated and restarted automatically while you sleep. With Docker, you need to subscribe to a security mailing list in order to know about the vulnerability in the first place, and then run some commands manually that re-create the container.

nuerow 5y ago
> It still does have a non-zero cost, especially in the long run, when security vulnerabilities pop up. It really doesn't. Unless you were planning on doing a one-and-done deployment, it's trivial to update and redeploy Docker images. Even in my side projects I have CI/CD pipelines updating and redeploying Docker images daily. > With distribution package management, on Ubuntu, you can rely on your Nginx being updated and restarted automatically while you sleep. Whatever you can do with Ubuntu, you can do precisely the same with Docker when running a base image of Ubuntu. > With Docker, you need to subscribe to a security mailing list in order to know about the vulnerability in the first place, and then run some commands manually that re-create the container. No, you really don't. Just pull the latest base image, build your images by calling apt to update your dependencies, and you're done. Whatever you can do with a bare metal/VM install, you can do with Docker. There is nothing magical stopping you from doing the basic stuff with Docker.
- capableweb 5y ago
  patrakov is talking about updating the docker daemon/engine (that runs on the host), not the images that you run with docker.
  - patrakov 5y ago
    Nope, I was talking about the images. More precisely, about knowing when to update them.

LeoPanthera 5y ago

Yes, and it's doubly pointless here, because it isn't doing anything that couldn't be done better by the OS's own package manager. Better, probably, because you will get timely security updates.

nuerow 5y ago
> Yes, and it's doubly pointless here, because it isn't doing anything that couldn't be done better by the OS's own package manager. No, not really. With Docker, packaging is a solved problem, and you also get for free a deployment history which you can roll back and forward at will. You also get introspection and blue/green deployments, and if you really want to you can also setup a cluster of nodes for free where you can run whole application stacks with a one-liner. There is really no excuse to do things the hard way.