13 ms·

Wouldn't removing Docker entirely be a good optimization?

by memish 5y ago

kube-system 5y ago
Docker adds other value to the lifecycle of your deployment. An "optimization" where you're removing value is just a compromise. Otherwise we'd all run our static sites on UEFI.
- ar_lan 5y ago
  This is a really good point, and something I think a lot of people forget. It's true, the most secure web app is one written with no code/no OS/does nothing. Adding value is a compromise of some increased security risk - and it's our job to mitigate that as much as possible by writing quality software.
- jamal-kumar 5y ago
  yeah see some of us still do this on OSes that haven't turned into a giant bloated hodgepodge of security theatre and false panacea software. docker has dead whale on the beach vibes. what value does it offer to those of us who have moved on from the mess linux is becoming?
  - kube-system 5y ago
    I’m not suggesting it has value to everyone. I’m suggesting it has value to the people who see value in it.
    - jamal-kumar 5y ago
      I'm super curious to know what the value to people who see that happens to be. It's serving static websites, why do I need to wrap THAT of all things in a container? Really, enlighten me
      - kube-system 5y ago
        > why do I need to wrap THAT of all things in a container? If you can't see a reason why, then you probably don't need to. You probably have different needs than other people. Many people use Docker not because of what they're doing inside of the container, but because it is convenient for tangential activities. Like lifecycle management, automation, portability, scheduling, etc. I have several static sites in Docker containers in production. We also have dozens of other microservices in containers. We could do everything the same way, or we can one-off an entirely separate architecture for our static sites. The former makes more sense for us.
      - rektide 5y ago
        If you literally ONLY ever need to run a single static website, then yeah, containers might not be helpful to you. But once you start wanting to run a significant number of things, or a significant number of instances of a thing, it becomes more helpful to have a all-purpose tool designed to manage images & run instances of them. Having a common operational pattern for all your systems is a nice, overt, clean, common practice everyone can adapt & gain expertise in. Rather than each project or company defining it's own deployment/operationization/management patterns & implementations. The cost of containers is also essentially near zero (alas somewhat less true with regards to local FS performance, but basically equal for many volume mounts). They come with great features like snapshots & the ability to make images off images- CoW style capabilities, the ability to mix together different volumes- there's some really great operational tools in containers too. Some people just don't have real needs. For everyone else...
      - deberon 5y ago
        I actually found myself needing something like this a couple weeks ago. I use a self-hosted platform (cloudron.io) that allows for custom apps. I wanted to host a static blog on that server. Some people are happy to accept "bloat" if it does, in fact, make life easier in some way.
      - mise_en_place 5y ago
        Because you want a reproducible environment/runtime for that static server. Nix/NixOS takes it a step further, in that it provides not only a reproducible runtime environment, but a reproducible dev and build environment as well.
  - themacguffinman 5y ago
    Out of curiosity, what OS have you moved on to?
    - jamal-kumar 5y ago
      OpenBSD for the past 10 years or so has been really good to me and my clients, and it just keeps on getting better while linux keeps on getting worse. It's kind of a nobrainer these days. Hell if you just need to serve static HTTP it even has its own built in webserver now: https://man.openbsd.org/httpd https://man.openbsd.org/httpd
- vanviegen 5y ago
  What value is that, for running such a simple piece of software?
  - vorticalbox 5y ago
    A few off the top of my head. The ability to pull the image on to any machine without needing to clone the source files and build it. Smaller images mean faster pod starts when you auto scale.
    - spicybright 5y ago
      You have to login to some docker repository anyways and know the series of commands to actually run it. Cloning a repo and running a shell script is probably a lot easier and faster than that. What kind of work are you doing that requires really fast auto scaling? Is a few minutes to spin up a new instance really that cumbersome? Can you not signal for it to spin up a new instance a tiny bit earlier than when it's needed when you see traffic increases?
      - kube-system 5y ago
        > You have to login to some docker repository anyways and know the series of commands to actually run it. Cloning a repo and running a shell script is probably a lot easier and faster than that. In isolation, yes. But if, for instance, you're already running a container orchestration tool with hundreds of containers, and have CI/CD pipelines already set up to do all of that, it's easier just to tack on another container.
    - bryanrasmussen 5y ago
      Ok when you say a few off the top of my head it implies that there are a bunch and these are like some super obvious ones, but it sounds like this is actually only useful if you have a bunch of infrastructure set up to serve sites for projects and customers that need containerization and then you just throw this simple little static site docker instance in there because when you're maintaining a lot of docker instances it is just simpler to do? Which seems like sort of an edge case for value adding, and makes me feel like it really doesn't add any value to do this unless you already are doing it for everything, and thus you really wouldn't be throwing out any value by just serving the static site without the docker overhead.
- jart 5y ago
  Redbean supports UEFI too. Although we haven't added a bare metal implementation of berkeley sockets yet. Although it's on the roadmap for the future.
  - jamal-kumar 5y ago
    oh wow are you justine? i've been meaning to ask you this for a decade. whatever happened to when you wrote a blog with insanely irritating serifs that connected certain letters together? what was the rationale behind that? never seen it since I'm insanely impressed by APE and redbean by the way, blows OP out of the water!
    - jart 5y ago
      Oh you mean the blog with the long s? I was reading a lot of books at the time that were written before 1800 and I found it so fascinating how different typography was back then. I found a font I could pay for called Quant that did a really good job reproducing archaic ligatures and the long s, so I used it on a blog for a short period of time. Sadly it got negative feedback. So lately I've been focusing on https://justine.lol/ https://justine.lol/ which uses Roboto. I'm glad to hear you're enjoying it!
      - jamal-kumar 5y ago
        ahhh ligatures, that's the word I was looking for here. Yeah it was kind of irritating but good blog content so I just read it anyways. it was kind of hard not to read it as someone lisping everything though.
        jart 5y ago
        Perhaps next time I'll blog in elvish cryptograms.
        jamal-kumar 5y ago
        mayan hieroglyphics or bust
throwanem 5y ago
In terms of CPU cycles and disk space, maybe. In terms of engineer cycles, absolutely not. Which costs more?
- danuker 5y ago
  Hmm, a SCP shell script on my laptop, prompting my SSH key's password and deploying the site to the target machine? Or a constantly-updating behemoth, running as root, installing packages from yet another unauditable repository chain?
  - hyperhopper 5y ago
    The first option is something custom that you had to write yourself and remember how to use years later, or explain how to use to others The second option is standardized and usually the same 1 or 2 commands to run anywhere
  - somenewaccount1 5y ago
    You forgot the step where you had to provision that server to run the software and maintain all the systems security updates on the live running server, and that server requires all the same maintenance, with or without docker. And if you fuck it up, better call the wife and cancell Sunday plans because you forgot how it all gets installed and ......yeah, just use docker :p
    - danuker 5y ago
      Debian offers unattended upgrades: https://wiki.debian.org/UnattendedUpgrades https://wiki.debian.org/UnattendedUpgrades And security updates, as you said, are needed regardless of whether you run Docker on top. I think Docker is a needless complexity and security risk.
      - throwanem 5y ago
        And you're welcome to think so, but if you intend to make a case for removing Docker as optimization, you still have yet to start.

Wouldn't removing Docker entirely be a good optimization?

by memish 5y ago

Wouldn't removing Docker entirely be a good optimization?

Docker adds other value to the lifecycle of your deployment. An "optimization" where you're removing value is just a compromise. Otherwise we'd all run our static sites on UEFI.

ar_lan 5y ago
This is a really good point, and something I think a lot of people forget. It's true, the most secure web app is one written with no code/no OS/does nothing. Adding value is a compromise of some increased security risk - and it's our job to mitigate that as much as possible by writing quality software.
jamal-kumar 5y ago
yeah see some of us still do this on OSes that haven't turned into a giant bloated hodgepodge of security theatre and false panacea software. docker has dead whale on the beach vibes. what value does it offer to those of us who have moved on from the mess linux is becoming?
- kube-system 5y ago
  I’m not suggesting it has value to everyone. I’m suggesting it has value to the people who see value in it.
  - jamal-kumar 5y ago
    I'm super curious to know what the value to people who see that happens to be. It's serving static websites, why do I need to wrap THAT of all things in a container? Really, enlighten me
    - kube-system 5y ago
      > why do I need to wrap THAT of all things in a container? If you can't see a reason why, then you probably don't need to. You probably have different needs than other people. Many people use Docker not because of what they're doing inside of the container, but because it is convenient for tangential activities. Like lifecycle management, automation, portability, scheduling, etc. I have several static sites in Docker containers in production. We also have dozens of other microservices in containers. We could do everything the same way, or we can one-off an entirely separate architecture for our static sites. The former makes more sense for us.
    - rektide 5y ago
      If you literally ONLY ever need to run a single static website, then yeah, containers might not be helpful to you. But once you start wanting to run a significant number of things, or a significant number of instances of a thing, it becomes more helpful to have a all-purpose tool designed to manage images & run instances of them. Having a common operational pattern for all your systems is a nice, overt, clean, common practice everyone can adapt & gain expertise in. Rather than each project or company defining it's own deployment/operationization/management patterns & implementations. The cost of containers is also essentially near zero (alas somewhat less true with regards to local FS performance, but basically equal for many volume mounts). They come with great features like snapshots & the ability to make images off images- CoW style capabilities, the ability to mix together different volumes- there's some really great operational tools in containers too. Some people just don't have real needs. For everyone else...
    - deberon 5y ago
      I actually found myself needing something like this a couple weeks ago. I use a self-hosted platform (cloudron.io) that allows for custom apps. I wanted to host a static blog on that server. Some people are happy to accept "bloat" if it does, in fact, make life easier in some way.
    - mise_en_place 5y ago
      Because you want a reproducible environment/runtime for that static server. Nix/NixOS takes it a step further, in that it provides not only a reproducible runtime environment, but a reproducible dev and build environment as well.
- themacguffinman 5y ago
  Out of curiosity, what OS have you moved on to?
  - jamal-kumar 5y ago
    OpenBSD for the past 10 years or so has been really good to me and my clients, and it just keeps on getting better while linux keeps on getting worse. It's kind of a nobrainer these days. Hell if you just need to serve static HTTP it even has its own built in webserver now: https://man.openbsd.org/httpd https://man.openbsd.org/httpd
vanviegen 5y ago
What value is that, for running such a simple piece of software?
- vorticalbox 5y ago
  A few off the top of my head. The ability to pull the image on to any machine without needing to clone the source files and build it. Smaller images mean faster pod starts when you auto scale.
  - spicybright 5y ago
    You have to login to some docker repository anyways and know the series of commands to actually run it. Cloning a repo and running a shell script is probably a lot easier and faster than that. What kind of work are you doing that requires really fast auto scaling? Is a few minutes to spin up a new instance really that cumbersome? Can you not signal for it to spin up a new instance a tiny bit earlier than when it's needed when you see traffic increases?
    - kube-system 5y ago
      > You have to login to some docker repository anyways and know the series of commands to actually run it. Cloning a repo and running a shell script is probably a lot easier and faster than that. In isolation, yes. But if, for instance, you're already running a container orchestration tool with hundreds of containers, and have CI/CD pipelines already set up to do all of that, it's easier just to tack on another container.
  - bryanrasmussen 5y ago
    Ok when you say a few off the top of my head it implies that there are a bunch and these are like some super obvious ones, but it sounds like this is actually only useful if you have a bunch of infrastructure set up to serve sites for projects and customers that need containerization and then you just throw this simple little static site docker instance in there because when you're maintaining a lot of docker instances it is just simpler to do? Which seems like sort of an edge case for value adding, and makes me feel like it really doesn't add any value to do this unless you already are doing it for everything, and thus you really wouldn't be throwing out any value by just serving the static site without the docker overhead.
jart 5y ago
Redbean supports UEFI too. Although we haven't added a bare metal implementation of berkeley sockets yet. Although it's on the roadmap for the future.
- jamal-kumar 5y ago
  oh wow are you justine? i've been meaning to ask you this for a decade. whatever happened to when you wrote a blog with insanely irritating serifs that connected certain letters together? what was the rationale behind that? never seen it since I'm insanely impressed by APE and redbean by the way, blows OP out of the water!
  - jart 5y ago
    Oh you mean the blog with the long s? I was reading a lot of books at the time that were written before 1800 and I found it so fascinating how different typography was back then. I found a font I could pay for called Quant that did a really good job reproducing archaic ligatures and the long s, so I used it on a blog for a short period of time. Sadly it got negative feedback. So lately I've been focusing on https://justine.lol/ https://justine.lol/ which uses Roboto. I'm glad to hear you're enjoying it!
    - jamal-kumar 5y ago
      ahhh ligatures, that's the word I was looking for here. Yeah it was kind of irritating but good blog content so I just read it anyways. it was kind of hard not to read it as someone lisping everything though.
      - jart 5y ago
        Perhaps next time I'll blog in elvish cryptograms.
        jamal-kumar 5y ago
        mayan hieroglyphics or bust

throwanem 5y ago

In terms of CPU cycles and disk space, maybe. In terms of engineer cycles, absolutely not. Which costs more?

danuker 5y ago
Hmm, a SCP shell script on my laptop, prompting my SSH key's password and deploying the site to the target machine? Or a constantly-updating behemoth, running as root, installing packages from yet another unauditable repository chain?
- hyperhopper 5y ago
  The first option is something custom that you had to write yourself and remember how to use years later, or explain how to use to others The second option is standardized and usually the same 1 or 2 commands to run anywhere
- somenewaccount1 5y ago
  You forgot the step where you had to provision that server to run the software and maintain all the systems security updates on the live running server, and that server requires all the same maintenance, with or without docker. And if you fuck it up, better call the wife and cancell Sunday plans because you forgot how it all gets installed and ......yeah, just use docker :p
  - danuker 5y ago
    Debian offers unattended upgrades: https://wiki.debian.org/UnattendedUpgrades https://wiki.debian.org/UnattendedUpgrades And security updates, as you said, are needed regardless of whether you run Docker on top. I think Docker is a needless complexity and security risk.
    - throwanem 5y ago
      And you're welcome to think so, but if you intend to make a case for removing Docker as optimization, you still have yet to start.