8 ms·

Ouch. This is the security posture that half a billion dollars, hundreds of engineers, multiple layers of abstraction to a firewall ruleset and each Stream-alig

Ouch. This is the security posture that half a billion dollars, hundreds of engineers, multiple layers of abstraction to a firewall ruleset and each Stream-aligned team with an embedded Product Manager and UX Designer[0] buys you. I too contributed security fixes to Docker in the early stages but soon gave up. Docker is a fascinating study in hype. Containers already existed, docker wrapped them very badly, raised half a billion dollars, popularized their wrapper (I understand kubernetes is the fad-wrapper now) and then failed to obtain a revenue stream. I didn't see them return much to open source, though perhaps they contributed to projects I don't see. Honestly, the whole thing has a plotline like a Shakespearean tragedy. Someone could do a film, starting with interviews with the guys who wrote the original Linux containers and namespacing kernel code at IBM, the maintainers of jails in FreeBSD, and an early hacker at VMWare. [0] https://www.docker.com/blog/building-stronger-happier-engineering-teams-with-team-topologies/ https://www.docker.com/blog/building-stronger-happier-engine...

xvector 4y ago
How is K8S a fad?
- natpalmer1776 4y ago
  On a long enough timeline, everything can be considered a fad!
- blowski 4y ago
  Ask me in 10 years, I'll tell you whether it was a fad or not.
  - languageserver 4y ago
    a 20 year run in tech is not a "fad".
    - 867-5309 4y ago
      "tech" was a fad to your future AI overlords
- ipaddr 4y ago
  The shortening of the name to what you have above is your first clue.
  - hn_throwaway_99 4y ago
    Uh-oh, guess we have to tell everyone internationalization is just a fad because everyone writes it i18n.
    - lmm 4y ago
      It absolutely is. Approximately no-one gets real business value out of internationalization, they just use it as a stick to beat technologies they dislike.
      - hn_throwaway_99 4y ago
        This is hilarious.
- iasay 4y ago
  It's not a fad, but a fashion. People wear it because it looks cool on your CV or consultancy offering, not because it keeps you warm and dry. They don't even understand it properly. Even AWS, who I work with regularly on EKS issues, seem not to understand their own offering properly. Ultimately in a lot of companies it ends up an expensive piss soaked nightmare wearing a jacket with "success" printed across it. I like the idea but the implementation sucks and echoing the root poster, containers have some unique problems which can indeed cause you some real trouble and friction. It makes sense for really horizontal simple things, which isn't a lot of stuff on the market.
  - dekhn 4y ago
    I used borg for over a decade, I know what k8s is for.
voidfunc 4y ago
1. Docker has contributed a lot and provided if not technology at least ideas others have iterated on. 2. k8s is not a fad. Nor is it wrapper or really even equivalent with docker the container bit.
0xbadcafebee 4y ago
Docker's hype train was absolutely absurd, but it was instrumental in making containers ubiquitous, and the wrapper is the reason why. Containers were painful as hell to set up and use; it was like using Git, but worse. Docker made it convenient, simple, and useful. By now everybody understands that immutable artifacts and simple configuration formats are extremely effective. Docker is one of the only tools I can think of that was designed with a human being in mind rather than a machine.
- toomuchtodo 4y ago
  Docker is like brew in that they are both huge productivity levers, except Docker found a way to pay a bunch of technologists with VC dollars to evangelize the model.
Beltalowda 4y ago
I mean, these are the same people who released an entire new daemon in the 2013 that ... can only run as root. Party like it's 1983. I believe they added some experimental caveated "non-root" mode last year, but how this was not even supported, much less the default, from day one is just ... ugh. That being said, Docker is more than just "Linux containers" or FreeBSD jails; the key thing it brought was the push/pull commands, which made setting up and distributing containers a lot easier, as well as some other UI/UX things. I think these ideas are implemented badly, but they do add value. Compare this with FreeBSD jails, where the instructions were "download the base set from the FreeBSD ftp and extract it to the destination dir, manually set up /dev, twiddle with /etc/rc.conf, muck about with ifconfig for networking, etc." Looking at the current handbook[1], things are better now: there's bsdinstall and /etc/jail.conf, but e.g. jail.conf was added only a few months before Docker was released, but the key value proposition of Docker (push/pull) is still missing. Right now, setting up nginx or PostgreSQL in a FreeBSD jail is more work than setting it up system-wide. People don't use Docker because it runs in containers per se, they use it so they can run something in one easy step. IMHO Docker is more or less the Sendmail of our age[2]; we just have to wait for "Docker Postfix" or "Docker qmail" :-) I'd make a punt, but I don't really have that much time. [1]: https://docs.freebsd.org/en/books/handbook/jails/#jails-build https://docs.freebsd.org/en/books/handbook/jails/#jails-buil... [2]: People have forgotten now, but Sendmail solved a lot of issues in the early 80s and dealt with the wildgrowth of different email systems better than anything else; while crusty and ugly, it added a lot of value when it was first released.
- halostatue 4y ago
  Wouldn’t "Docker Postfix" or "Docker qmail" be podman?
  - Beltalowda 4y ago
    Maybe; I haven't used it. Whenever I needed containers I used runc or just set up some cgroups manually, but it's been a while since I had to do so.
- staticassertion 4y ago
willjp 4y ago
I’m not sure that is entirely fair. Sure containers like LXC and bsd-jails existed, but I think the feature that won the hearts of devs was the incremental builds that let people fail quickly in a forgiving way. With jails, the best I know of achieving this is creating a base jail filesystem (thin jail), and creating a new one. (Apologies in advance if another tool addresses this).
- pjmlp 4y ago
  HP-UX vaults date back to late 90's, as one of the first container models for UNIX systems.
manigandham 4y ago
The Docker UX is what made the difference, not the underlying tech. Building containers in an easy incremental and reproducible way that could then be stored in a repo and pulled over HTTP was the evolution in packaging that was needed. UX alone can be a multi-billion dollar business, for example Dropbox was just a folder that syncs. I'll leave you to find that classic HN comment about it. Docker just executed poorly and didn't have much worth paying for.
- eptcyka 4y ago
  How does one build containers reproducably? I can make parts of my stack reproducable if I use existing, pinned containers, but due to all the `apt-get`ing in my dockerfiles, I'd call them anything but reproducable.
  - kwentin360 4y ago
    I've seen success building them in centralized server(s) and 'apt-get'ing specific dependencies instead of the latest ones.
  - wmanley 4y ago
    With apt2ostree[1] we use lockfiles to allow us to version control the exact versions that were used to build a container. This makes updating the versions explicit and controlled, and building the containers functionally reproducible - albeit not byte-for-byte reproducible. [1]: https://github.com/stb-tester/apt2ostree#lockfiles https://github.com/stb-tester/apt2ostree#lockfiles
  - compsciphd 4y ago
    that's where docker failed in only copying part of what I built (they simplified it, and to an extent that was good for making a product, but I had proposed the need for (and prototyped) a container/layer aware. see https://www.usenix.org/conference/lisa11/improving-virtual-appliance-management-through-virtual-layered-file-systems https://www.usenix.org/conference/lisa11/improving-virtual-a.... the "problem" is building that layer aware linux distribution, so Docker just skipped it and relied on existing things and building each image up linearly. This was actually an advantage of CoreOS's rkt (and the ACI format), where it enabled images to be constructed from "random" layers instead of linear layers (though the primary tooling didn't really provide it and were just docker analogues, there were other tools that enabled you to manually select which layer IDs should be part of an image - but docker "won" and we were left with its linearized layer model).
scubbo 4y ago
> Containers already existed Fascinating. I'm admittedly very new to container-land, but my understanding was precisely the opposite - that Docker invented this concept and practice of building a runtime environment that can then be replicated and deployed to many hosts. Do you have any search terms or articles I should pursue to learn more about the predecessors? I've read through this[0], but it mostly suggests that approaches prior to Docker provided isolation/jailing, which is an important part of containerization but neglects a lot of tooling around building, deploying, etc. [0] https://blog.aquasec.com/a-brief-history-of-containers-from-1970s-chroot-to-docker-2016 https://blog.aquasec.com/a-brief-history-of-containers-from-... EDIT: various other comments ("The Docker UX is what made the difference, not the underlying tech. Building containers in an easy incremental and reproducible way that could then be stored in a repo and pulled over HTTP was the evolution in packaging that was needed.", "I think the feature that won the hearts of devs was the incremental builds that let people fail quickly in a forgiving way", "Containers were painful as hell to set up and use; it was like using Git, but worse. Docker made it convenient, simple, and useful. By now everybody understands that immutable artifacts and simple configuration formats are extremely effective") seem to support this perception. EDIT2: Thanks to all those that replied!
- dekhn 4y ago
  Containers absolutely existed before. THere was a long-running project, I think it was LXC but there may have been one before that, which was doing great work fixing all the underlying problems before the technology went exponential.
  - turminal 4y ago
    > I think it was LXC Still is :)
- contingencies 4y ago
  https://en.wikipedia.org/wiki/LXC https://en.wikipedia.org/wiki/LXC
- tnorgaard 4y ago
  I belive that Solaris (OpenSolaris) Zones predates LXC by around 3 years. Even when working with k8s and docker every day, I still find what OpenSolaris had in 2009 superior. Crossbow and zfs tied it all together so neatly. What OpenSolaris could have been in another world. :D
doliveira 4y ago
Docker is an imperfect solution to problems we shouldn't have after decades of Linux and Unix and its value is exactly in its DX. But considering the pride in finding the right incantation to build C/C++ code, to set up a system service, to set up routing rules or any other advanced feature... I guess anything that tries to hide it will count as hype
technonerd 4y ago
Security is an afterthought in docker, deploy first questions later the dirty harry way. I learned lots about dockers lack of defense while trying to harden my instances and questioned why some of the options weren't enabled by default (--cap-drop=all and --security-opt=no-new-privileges and userns remap) other than exposing bad dockerfiles practices.
jcelerier 4y ago
so, uhm, before Docker, what was the one-liner that allowed me to get a ubuntu, fedora, nixos, ... shell automatically ?
- deleted 4y ago
  [deleted]
- eddyschai 4y ago
  You can do something with lxc - I had to use it instead of Docker on a Chromebook a while back. The wrapper isn't as nice, but it's not actually that hard to get going.
- withinboredom 4y ago
  tar -zf ubuntu.tar.gz && chroot ubuntu ish
  - deleted 4y ago
    [deleted]
  - jcelerier 4y ago
    $ tar -xzf ubuntu.tar.gz && chroot ubuntu tar (child): ubuntu.tar.gz: Cannot open: No such file or directory tar (child): Error is not recoverable: exiting now tar: Child returned status 2 if I have to do wget of something (and find the url to wget) it's not worth it
    - injinj 4y ago
      I would use debootstrap. https://semjonov.de/posts/2021-09/minimal-ubuntu-installation-with-debootstrap/ https://semjonov.de/posts/2021-09/minimal-ubuntu-installatio...
      - jcelerier 4y ago
        If it requires to read a whole blog article like this to setup someone can make and sell a product with a one-liner command that does it. They could call it, idk, decker or something
nonameiguess 4y ago
I get that this comment is currently being pummeled from all sides, but just to be clear on what Docker offered, and the value I think they created, it wasn't containers, but: * The public registry. Obviously, there are a lot of downsides to this with respect to security, but the convenience of "just install docker and then you can run basically anything that has already been uploaded to Docker Hub" can't really be overstated. * OCI. They were kind of forced into this much later on, but it's great to have a standard for how to package a container image and a bundle that can be loaded into a runtime. Containers may have already existed, but there was not standard way to package, deliver, and run them. * The Dockerfile. For better or worse, it isn't perfect and is full of footguns, but as the "hello world" equivalent of build systems go, it's pretty easy to get started and understand what it's doing. * I think, but am not certain, that Docker was the first to combine containers with union filesystems, saving quite a bit of disk space when you're running many containers that share layers. This also helped usher in the era of read-only root filesystems and immutable infrastructure. It's also important to remember that developers are not the only people involved in delivering and running software. I see a lot of complaining here that containers add friction to their workflow, but look at it from the perspective of systems administrators, IT operators, and SREs that have to install, configure, run, monitor, and troubleshoot potentially hundreds of applications, some internally developed, some third-party, all using whatever language, whatever runtime, and whatever dependency chain they feel like without regard to what the others are doing. Having a standardized way to package, deliver, and run applications that is totally agnostic to anything other than "you need Linux" was pretty powerful.
- deleted 4y ago
  [deleted]
corrral 4y ago
Docker accidentally(?) created my very favorite cross-distro Linux server package & service manager. That it uses containers is just an implementation detail, to me. All the docker replacements will be useless to me if they don't come with a huge repository of pre-built relatively-trustworthy up-to-date containers for tons of services. I love no longer needing to care much about the underlying distro. LTS? Fine. I still get up-to-date services. Red hat? Debian-based? Something else? Barely matters, once Docker is installed. On my home server it even saves me from ever having to think about the distro's init system. Bonus: dockerized services are often much easier to configure than their distro-repo counterparts, and it's usually easier to track down everything they write that you need to back up, and that's all the same no matter what distro they're running on.
- neoromantique 4y ago
  >huge repository of pre-built relatively-trustworthy >relatively-trustworthy yeah, that's not really the case with docker either I'm afraid
  - heywoodlh 4y ago
    > yeah, that's not really the case with docker either I'm afraid I feel like two places I disagree with this statement: - Docker's official image library - When a project you are looking to run has an official image they maintain When those constraints are not met, I try to build my own image (based on the official images). I try not to trust any other external images (with some exceptions from reputable sources such as linuxserver.io or Bitnami).
  - corrral 4y ago
    Shrug just about every service I want to run has an official image. I use a couple unofficial ones (e.g. Minecraft, and I think my Samba container—oh man, talk about being easier to configure than typical distro packaging—is unofficial) for my personal use and it's pretty easy to read the Dockerfile and build them myself, so that's not a big deal. At work, most any database or self-hosted service or anything like that has an official image. So yes, it is.
- 4y ago
sjtgraham 4y ago
> failed to obtain a revenue stream Docker is throwing off incredible amounts of cash with Docker Desktop licensing alone.
xarope 4y ago
Sadly. This is why I recommend running docker inside of a container (e.g. LXC) or a VM, as I just don't trust the security profiles for docker images.

xvector 4y ago

How is K8S a fad?

natpalmer1776 4y ago
On a long enough timeline, everything can be considered a fad!
blowski 4y ago
Ask me in 10 years, I'll tell you whether it was a fad or not.
- languageserver 4y ago
  a 20 year run in tech is not a "fad".
  - 867-5309 4y ago
    "tech" was a fad to your future AI overlords
ipaddr 4y ago
The shortening of the name to what you have above is your first clue.
- hn_throwaway_99 4y ago
  Uh-oh, guess we have to tell everyone internationalization is just a fad because everyone writes it i18n.
  - lmm 4y ago
    It absolutely is. Approximately no-one gets real business value out of internationalization, they just use it as a stick to beat technologies they dislike.
    - hn_throwaway_99 4y ago
      This is hilarious.
iasay 4y ago
It's not a fad, but a fashion. People wear it because it looks cool on your CV or consultancy offering, not because it keeps you warm and dry. They don't even understand it properly. Even AWS, who I work with regularly on EKS issues, seem not to understand their own offering properly. Ultimately in a lot of companies it ends up an expensive piss soaked nightmare wearing a jacket with "success" printed across it. I like the idea but the implementation sucks and echoing the root poster, containers have some unique problems which can indeed cause you some real trouble and friction. It makes sense for really horizontal simple things, which isn't a lot of stuff on the market.
- dekhn 4y ago
  I used borg for over a decade, I know what k8s is for.

voidfunc 4y ago

1. Docker has contributed a lot and provided if not technology at least ideas others have iterated on. 2. k8s is not a fad. Nor is it wrapper or really even equivalent with docker the container bit.

0xbadcafebee 4y ago

Docker's hype train was absolutely absurd, but it was instrumental in making containers ubiquitous, and the wrapper is the reason why. Containers were painful as hell to set up and use; it was like using Git, but worse. Docker made it convenient, simple, and useful. By now everybody understands that immutable artifacts and simple configuration formats are extremely effective. Docker is one of the only tools I can think of that was designed with a human being in mind rather than a machine.

toomuchtodo 4y ago
Docker is like brew in that they are both huge productivity levers, except Docker found a way to pay a bunch of technologists with VC dollars to evangelize the model.

Beltalowda 4y ago

I mean, these are the same people who released an entire new daemon in the 2013 that ... can only run as root. Party like it's 1983. I believe they added some experimental caveated "non-root" mode last year, but how this was not even supported, much less the default, from day one is just ... ugh. That being said, Docker is more than just "Linux containers" or FreeBSD jails; the key thing it brought was the push/pull commands, which made setting up and distributing containers a lot easier, as well as some other UI/UX things. I think these ideas are implemented badly, but they do add value. Compare this with FreeBSD jails, where the instructions were "download the base set from the FreeBSD ftp and extract it to the destination dir, manually set up /dev, twiddle with /etc/rc.conf, muck about with ifconfig for networking, etc." Looking at the current handbook[1], things are better now: there's bsdinstall and /etc/jail.conf, but e.g. jail.conf was added only a few months before Docker was released, but the key value proposition of Docker (push/pull) is still missing. Right now, setting up nginx or PostgreSQL in a FreeBSD jail is more work than setting it up system-wide. People don't use Docker because it runs in containers per se, they use it so they can run something in one easy step. IMHO Docker is more or less the Sendmail of our age[2]; we just have to wait for "Docker Postfix" or "Docker qmail" :-) I'd make a punt, but I don't really have that much time. [1]: https://docs.freebsd.org/en/books/handbook/jails/#jails-build https://docs.freebsd.org/en/books/handbook/jails/#jails-buil... [2]: People have forgotten now, but Sendmail solved a lot of issues in the early 80s and dealt with the wildgrowth of different email systems better than anything else; while crusty and ugly, it added a lot of value when it was first released.

halostatue 4y ago
Wouldn’t "Docker Postfix" or "Docker qmail" be podman?
- Beltalowda 4y ago
  Maybe; I haven't used it. Whenever I needed containers I used runc or just set up some cgroups manually, but it's been a while since I had to do so.
staticassertion 4y ago

willjp 4y ago

I’m not sure that is entirely fair. Sure containers like LXC and bsd-jails existed, but I think the feature that won the hearts of devs was the incremental builds that let people fail quickly in a forgiving way. With jails, the best I know of achieving this is creating a base jail filesystem (thin jail), and creating a new one. (Apologies in advance if another tool addresses this).

pjmlp 4y ago
HP-UX vaults date back to late 90's, as one of the first container models for UNIX systems.

manigandham 4y ago

The Docker UX is what made the difference, not the underlying tech. Building containers in an easy incremental and reproducible way that could then be stored in a repo and pulled over HTTP was the evolution in packaging that was needed. UX alone can be a multi-billion dollar business, for example Dropbox was just a folder that syncs. I'll leave you to find that classic HN comment about it. Docker just executed poorly and didn't have much worth paying for.

eptcyka 4y ago
How does one build containers reproducably? I can make parts of my stack reproducable if I use existing, pinned containers, but due to all the `apt-get`ing in my dockerfiles, I'd call them anything but reproducable.
- kwentin360 4y ago
  I've seen success building them in centralized server(s) and 'apt-get'ing specific dependencies instead of the latest ones.
- wmanley 4y ago
  With apt2ostree[1] we use lockfiles to allow us to version control the exact versions that were used to build a container. This makes updating the versions explicit and controlled, and building the containers functionally reproducible - albeit not byte-for-byte reproducible. [1]: https://github.com/stb-tester/apt2ostree#lockfiles https://github.com/stb-tester/apt2ostree#lockfiles
- compsciphd 4y ago
  that's where docker failed in only copying part of what I built (they simplified it, and to an extent that was good for making a product, but I had proposed the need for (and prototyped) a container/layer aware. see https://www.usenix.org/conference/lisa11/improving-virtual-appliance-management-through-virtual-layered-file-systems https://www.usenix.org/conference/lisa11/improving-virtual-a.... the "problem" is building that layer aware linux distribution, so Docker just skipped it and relied on existing things and building each image up linearly. This was actually an advantage of CoreOS's rkt (and the ACI format), where it enabled images to be constructed from "random" layers instead of linear layers (though the primary tooling didn't really provide it and were just docker analogues, there were other tools that enabled you to manually select which layer IDs should be part of an image - but docker "won" and we were left with its linearized layer model).

scubbo 4y ago

> Containers already existed Fascinating. I'm admittedly very new to container-land, but my understanding was precisely the opposite - that Docker invented this concept and practice of building a runtime environment that can then be replicated and deployed to many hosts. Do you have any search terms or articles I should pursue to learn more about the predecessors? I've read through this[0], but it mostly suggests that approaches prior to Docker provided isolation/jailing, which is an important part of containerization but neglects a lot of tooling around building, deploying, etc. [0] https://blog.aquasec.com/a-brief-history-of-containers-from-1970s-chroot-to-docker-2016 https://blog.aquasec.com/a-brief-history-of-containers-from-... EDIT: various other comments ("The Docker UX is what made the difference, not the underlying tech. Building containers in an easy incremental and reproducible way that could then be stored in a repo and pulled over HTTP was the evolution in packaging that was needed.", "I think the feature that won the hearts of devs was the incremental builds that let people fail quickly in a forgiving way", "Containers were painful as hell to set up and use; it was like using Git, but worse. Docker made it convenient, simple, and useful. By now everybody understands that immutable artifacts and simple configuration formats are extremely effective") seem to support this perception. EDIT2: Thanks to all those that replied!

dekhn 4y ago
Containers absolutely existed before. THere was a long-running project, I think it was LXC but there may have been one before that, which was doing great work fixing all the underlying problems before the technology went exponential.
- turminal 4y ago
  > I think it was LXC Still is :)
contingencies 4y ago
https://en.wikipedia.org/wiki/LXC https://en.wikipedia.org/wiki/LXC
tnorgaard 4y ago
I belive that Solaris (OpenSolaris) Zones predates LXC by around 3 years. Even when working with k8s and docker every day, I still find what OpenSolaris had in 2009 superior. Crossbow and zfs tied it all together so neatly. What OpenSolaris could have been in another world. :D

doliveira 4y ago

Docker is an imperfect solution to problems we shouldn't have after decades of Linux and Unix and its value is exactly in its DX. But considering the pride in finding the right incantation to build C/C++ code, to set up a system service, to set up routing rules or any other advanced feature... I guess anything that tries to hide it will count as hype

technonerd 4y ago

Security is an afterthought in docker, deploy first questions later the dirty harry way. I learned lots about dockers lack of defense while trying to harden my instances and questioned why some of the options weren't enabled by default (--cap-drop=all and --security-opt=no-new-privileges and userns remap) other than exposing bad dockerfiles practices.

jcelerier 4y ago

so, uhm, before Docker, what was the one-liner that allowed me to get a ubuntu, fedora, nixos, ... shell automatically ?

deleted 4y ago
[deleted]
eddyschai 4y ago
You can do something with lxc - I had to use it instead of Docker on a Chromebook a while back. The wrapper isn't as nice, but it's not actually that hard to get going.
withinboredom 4y ago
tar -zf ubuntu.tar.gz && chroot ubuntu ish
- deleted 4y ago
  [deleted]
- jcelerier 4y ago
  $ tar -xzf ubuntu.tar.gz && chroot ubuntu tar (child): ubuntu.tar.gz: Cannot open: No such file or directory tar (child): Error is not recoverable: exiting now tar: Child returned status 2 if I have to do wget of something (and find the url to wget) it's not worth it
  - injinj 4y ago
    I would use debootstrap. https://semjonov.de/posts/2021-09/minimal-ubuntu-installation-with-debootstrap/ https://semjonov.de/posts/2021-09/minimal-ubuntu-installatio...
    - jcelerier 4y ago
      If it requires to read a whole blog article like this to setup someone can make and sell a product with a one-liner command that does it. They could call it, idk, decker or something

nonameiguess 4y ago

I get that this comment is currently being pummeled from all sides, but just to be clear on what Docker offered, and the value I think they created, it wasn't containers, but: * The public registry. Obviously, there are a lot of downsides to this with respect to security, but the convenience of "just install docker and then you can run basically anything that has already been uploaded to Docker Hub" can't really be overstated. * OCI. They were kind of forced into this much later on, but it's great to have a standard for how to package a container image and a bundle that can be loaded into a runtime. Containers may have already existed, but there was not standard way to package, deliver, and run them. * The Dockerfile. For better or worse, it isn't perfect and is full of footguns, but as the "hello world" equivalent of build systems go, it's pretty easy to get started and understand what it's doing. * I think, but am not certain, that Docker was the first to combine containers with union filesystems, saving quite a bit of disk space when you're running many containers that share layers. This also helped usher in the era of read-only root filesystems and immutable infrastructure. It's also important to remember that developers are not the only people involved in delivering and running software. I see a lot of complaining here that containers add friction to their workflow, but look at it from the perspective of systems administrators, IT operators, and SREs that have to install, configure, run, monitor, and troubleshoot potentially hundreds of applications, some internally developed, some third-party, all using whatever language, whatever runtime, and whatever dependency chain they feel like without regard to what the others are doing. Having a standardized way to package, deliver, and run applications that is totally agnostic to anything other than "you need Linux" was pretty powerful.

deleted 4y ago
[deleted]

corrral 4y ago

Docker accidentally(?) created my very favorite cross-distro Linux server package & service manager. That it uses containers is just an implementation detail, to me. All the docker replacements will be useless to me if they don't come with a huge repository of pre-built relatively-trustworthy up-to-date containers for tons of services. I love no longer needing to care much about the underlying distro. LTS? Fine. I still get up-to-date services. Red hat? Debian-based? Something else? Barely matters, once Docker is installed. On my home server it even saves me from ever having to think about the distro's init system. Bonus: dockerized services are often much easier to configure than their distro-repo counterparts, and it's usually easier to track down everything they write that you need to back up, and that's all the same no matter what distro they're running on.

neoromantique 4y ago
>huge repository of pre-built relatively-trustworthy >relatively-trustworthy yeah, that's not really the case with docker either I'm afraid
- heywoodlh 4y ago
  > yeah, that's not really the case with docker either I'm afraid I feel like two places I disagree with this statement: - Docker's official image library - When a project you are looking to run has an official image they maintain When those constraints are not met, I try to build my own image (based on the official images). I try not to trust any other external images (with some exceptions from reputable sources such as linuxserver.io or Bitnami).
- corrral 4y ago
  Shrug just about every service I want to run has an official image. I use a couple unofficial ones (e.g. Minecraft, and I think my Samba container—oh man, talk about being easier to configure than typical distro packaging—is unofficial) for my personal use and it's pretty easy to read the Dockerfile and build them myself, so that's not a big deal. At work, most any database or self-hosted service or anything like that has an official image. So yes, it is.
4y ago

sjtgraham 4y ago

> failed to obtain a revenue stream Docker is throwing off incredible amounts of cash with Docker Desktop licensing alone.

xarope 4y ago

Sadly. This is why I recommend running docker inside of a container (e.g. LXC) or a VM, as I just don't trust the security profiles for docker images.