5 ms·

Funny, because I feel that simple tasks that would take minutes in my machine are now a dev adventure with docker. And I mean funny. I suspect it is different

by taeric 5y ago

Funny, because I feel that simple tasks that would take minutes in my machine are now a dev adventure with docker. And I mean funny. I suspect it is different mindsets. And I personally like that both seem to be thriving.

goodpoint 5y ago
It's well documented that Docker and especially docker hub had a terrible impact on security. Once you factor in the efforts required in the long term to mitigate a decade of bundling gigabytes of applications and libraries it's a huge "dev adventure"
- oauea 5y ago
  Just build your own images like you would otherwise install the software on bare metal. Base those images on official images, not community images.
  - kryptk 5y ago
    YMMV. Personally, you would have to pry my Bitnami images out of my cold dead hands.. there is just no way my team of 2 can do anywhere near as good.
    - oauea 5y ago
      Fair, there are a few high quality "vendors" that we also trust, and Bitnami is one of them. RandomJoe42/SomeImage is out, though.
  - goodpoint 5y ago
    > Just build your own images This is like saying "just wear a mask": it's not enough. You rely on what other people are doing now and what they've done in the past. This is an ecosystem problem, not an an individual problem.
- Frost1x 5y ago
  More like developer Towers of Babel waiting to collapse on every build attempt. Docker is fine if it's used correctly but it does add a layer of complexity, it doesn't abstract it away.. The way I see it rampantly (ab)used is as a shortcut to get some software up and running by leveraging a public image and passing tech debt for some component of one's system onto the maintainer of the Docker image, then cobbling together multistage builds from those and microservice architectures to try and support this tech debt model. Sometimes it works, many times it breaks, often it turns into complete and utter nightmares to deal with. "Amazing Andy got this fantastically complex system up and running in a week all by their self way under time and budget and it works. Now I just want to add this feature or modify this one thing and you're telling me that's going to take how long?" Yea, I've seen this more times than I care to admit.
  - kwertyoowiyop 5y ago
    “You mean Amazing Architect Andy who just left for Google?” :-(
    - KronisLV 5y ago
      That's at least partially why we have CV driven development be a thing in the industry. Either you jump on the NoSQL, AI, ML, blockchain, serverless, microservice, container, $FOO bandwagons, or you'll miss out on job opportunities and will have your CV stagnate. That's not to say that those technologies don't have good use cases in particular circumstances, it's just that you as an IC probably don't have strong incentives to care about where the project will be in 5-10 years when you will have left for another company in 2-3. A lot of accidental complexity is an unavoidable reality when you have people who put their own careers ahead of most other concerns.
aspaceman 5y ago
I feel similarly with Docker. But it's easier to explain to newer folks because it's only a single layer of abstraction above shell commands.
- dnautics 5y ago
  I really wish something like singularity containers had taken over -- that was literally just shell commands.
  - mst 5y ago
    Possibly https://buildah.io/ https://buildah.io/ would be of interest.
    - dnautics 5y ago
      I do use podman, not really stoked about buildah because it's still a bunch of buildah commands in a shell-driven DSL, which I suppose is better than a dockerfile. Singularity was literally a build file that was a shell script divided into sections that denoted phases.
      - mst 5y ago
        Bit late now but you could probably make something like it using buildkit - https://github.com/moby/buildkit/blob/master/examples/buildkit1/buildkit.go https://github.com/moby/buildkit/blob/master/examples/buildk...
- taeric 5y ago
  I call this. It isn't a single abstraction over shell. It is a single closure over shell. And that is surprisingly hard to explain. Again, though, I am glad both are thriving. Competition of implementation is... not that compelling to me. Competition of approach, is amazing.
- aequitas 5y ago
  The issue with simple solutions is that the underlying problem still has the same complexity. This complexity rises up sooner or later and depending on your abstraction will be nice caught within it or make a complete mess.
oauea 5y ago
If you can do it in minutes on your machine, you can spend those minutes updating your Dockerfile to automate the steps instead. It's essentially the same thing.
- taeric 5y ago
  Unless auth is concerned. There are loads of tools I run that I want to just be me. Not whatever user is configured in the image. And learning how to manage that mapping was a heck of a time sink.
  - oauea 5y ago
    How you going to run those tools on CI? Or by your colleagues? These are all questions that need answering anyway, regardless of your usage of Docker.
    - taeric 5y ago
      I already authed as me on my machine. Annoying to also have to auth as me in the container. Or have we reached the stage where folks have secrets management for containers fully orchestrated at a personal user level?

by taeric 5y ago

goodpoint 5y ago

It's well documented that Docker and especially docker hub had a terrible impact on security. Once you factor in the efforts required in the long term to mitigate a decade of bundling gigabytes of applications and libraries it's a huge "dev adventure"

oauea 5y ago
Just build your own images like you would otherwise install the software on bare metal. Base those images on official images, not community images.
- kryptk 5y ago
  YMMV. Personally, you would have to pry my Bitnami images out of my cold dead hands.. there is just no way my team of 2 can do anywhere near as good.
  - oauea 5y ago
    Fair, there are a few high quality "vendors" that we also trust, and Bitnami is one of them. RandomJoe42/SomeImage is out, though.
- goodpoint 5y ago
  > Just build your own images This is like saying "just wear a mask": it's not enough. You rely on what other people are doing now and what they've done in the past. This is an ecosystem problem, not an an individual problem.
Frost1x 5y ago
More like developer Towers of Babel waiting to collapse on every build attempt. Docker is fine if it's used correctly but it does add a layer of complexity, it doesn't abstract it away.. The way I see it rampantly (ab)used is as a shortcut to get some software up and running by leveraging a public image and passing tech debt for some component of one's system onto the maintainer of the Docker image, then cobbling together multistage builds from those and microservice architectures to try and support this tech debt model. Sometimes it works, many times it breaks, often it turns into complete and utter nightmares to deal with. "Amazing Andy got this fantastically complex system up and running in a week all by their self way under time and budget and it works. Now I just want to add this feature or modify this one thing and you're telling me that's going to take how long?" Yea, I've seen this more times than I care to admit.
- kwertyoowiyop 5y ago
  “You mean Amazing Architect Andy who just left for Google?” :-(
  - KronisLV 5y ago
    That's at least partially why we have CV driven development be a thing in the industry. Either you jump on the NoSQL, AI, ML, blockchain, serverless, microservice, container, $FOO bandwagons, or you'll miss out on job opportunities and will have your CV stagnate. That's not to say that those technologies don't have good use cases in particular circumstances, it's just that you as an IC probably don't have strong incentives to care about where the project will be in 5-10 years when you will have left for another company in 2-3. A lot of accidental complexity is an unavoidable reality when you have people who put their own careers ahead of most other concerns.

aspaceman 5y ago

I feel similarly with Docker. But it's easier to explain to newer folks because it's only a single layer of abstraction above shell commands.

dnautics 5y ago
I really wish something like singularity containers had taken over -- that was literally just shell commands.
- mst 5y ago
  Possibly https://buildah.io/ https://buildah.io/ would be of interest.
  - dnautics 5y ago
    I do use podman, not really stoked about buildah because it's still a bunch of buildah commands in a shell-driven DSL, which I suppose is better than a dockerfile. Singularity was literally a build file that was a shell script divided into sections that denoted phases.
    - mst 5y ago
      Bit late now but you could probably make something like it using buildkit - https://github.com/moby/buildkit/blob/master/examples/buildkit1/buildkit.go https://github.com/moby/buildkit/blob/master/examples/buildk...
taeric 5y ago
I call this. It isn't a single abstraction over shell. It is a single closure over shell. And that is surprisingly hard to explain. Again, though, I am glad both are thriving. Competition of implementation is... not that compelling to me. Competition of approach, is amazing.
aequitas 5y ago
The issue with simple solutions is that the underlying problem still has the same complexity. This complexity rises up sooner or later and depending on your abstraction will be nice caught within it or make a complete mess.

oauea 5y ago

If you can do it in minutes on your machine, you can spend those minutes updating your Dockerfile to automate the steps instead. It's essentially the same thing.

taeric 5y ago
Unless auth is concerned. There are loads of tools I run that I want to just be me. Not whatever user is configured in the image. And learning how to manage that mapping was a heck of a time sink.
- oauea 5y ago
  How you going to run those tools on CI? Or by your colleagues? These are all questions that need answering anyway, regardless of your usage of Docker.
  - taeric 5y ago
    I already authed as me on my machine. Annoying to also have to auth as me in the container. Or have we reached the stage where folks have secrets management for containers fully orchestrated at a personal user level?