3 ms·

This looks great. Definitely a few idioms I will have to explore further. I can use Docker in a basic sense, but it is amazing to me how much black arts still

This looks great. Definitely a few idioms I will have to explore further. I can use Docker in a basic sense, but it is amazing to me how much black arts still exists for what has become a cornerstone of modern deployment. Lots of conflicting/dated advice about best practices. Unsure which advice is still required/applies to podman, etc.

sneak 4y ago
> but it is amazing to me how much black arts still exists for what has become a cornerstone of modern deployment. What?! Unless you are using complicated networking, docker is simple. Dockerfiles are essentially just annoying-syntax shell scripts. We have plenty of black arts in computing. Docker isn't one of them.
- fbdab103 4y ago
  So, am I still supposed to specify UID and GID? Should I be using Alpine or Debian? How do I handle loading certificates? Should I use an override config for development? In this thread, someone was indicating that the naive volume option does not work over SSH. Also in this thread was a request to pin by tag and not hash. Do I still need to worry about Docker blowing a hole in iptables? Maybe not black magic, but there are a lot of subtle optimizations for which there is much conflicting guidance.
  - smaccona 4y ago
    This is how people end up using Kubernetes, despite its warts. [edit: added second clause]
    - doix 4y ago
      Kubernetes doesn't answer any of the parents questions though, does it? You still need a Dockerfile for k8s and all those questions still apply.
  - nickjj 4y ago
    > So, am I still supposed to specify UID and GID? If you run your container as a non-root user and create a user without setting a UID / GID it'll default to 1000:1000, so unless your Docker host's user isn't 1000:1000 then things work out of the box. A lot of this is general Linux knowledge around user / file permissions, not so much Docker. > Should I be using Alpine or Debian? Debian, no contest in my opinion. > How do I handle loading certificates? You can volume mount them or deal with SSL certificates in a way where Docker isn't involved such as running nginx on your Docker host directly or putting a load balancer in front of your app and handling SSL there. > Should I use an override config for development? You can use the same docker-compose.yml file in all environments and tweak things with environment variables. The compose file supports variable interpolation. Docker Compose profiles also let you control which services to run in each environment, it's even configurable by a single env variable. > Do I still need to worry about Docker blowing a hole in iptables? If you use -p 8000:8000, yes this will publish the port in a way where the outside world can access it. Likewise without Docker if you edit iptables to allow that port it will too. I wouldn't classify this as blowing a hole in iptables. This is "user configured application to make a port open to the world". > Maybe not black magic, but there are a lot of subtle optimizations for which there is much conflicting guidance. In the end my example apps address most of these issues for you. You're on your own with certificates since that varies on your deployment, but everything else is fully set up and ready to go and it protects yourself from blowing a hole in iptables since it only publishes the port to localhost by default, not 0.0.0.0. This would let nginx or another web server access it directly on your Docker host but no one else.
- renox 4y ago
  'black art' maybe not, overcomplicated mess? Yes! I've tried to use the docker compose command to limit the maximum number of CPUs used, I failed, even though it's possible: the support team managed to do it, but why did I fail? Because the doc and the design aren't great..

sneak 4y ago

> but it is amazing to me how much black arts still exists for what has become a cornerstone of modern deployment. What?! Unless you are using complicated networking, docker is simple. Dockerfiles are essentially just annoying-syntax shell scripts. We have plenty of black arts in computing. Docker isn't one of them.

fbdab103 4y ago
So, am I still supposed to specify UID and GID? Should I be using Alpine or Debian? How do I handle loading certificates? Should I use an override config for development? In this thread, someone was indicating that the naive volume option does not work over SSH. Also in this thread was a request to pin by tag and not hash. Do I still need to worry about Docker blowing a hole in iptables? Maybe not black magic, but there are a lot of subtle optimizations for which there is much conflicting guidance.
- smaccona 4y ago
  This is how people end up using Kubernetes, despite its warts. [edit: added second clause]
  - doix 4y ago
    Kubernetes doesn't answer any of the parents questions though, does it? You still need a Dockerfile for k8s and all those questions still apply.
- nickjj 4y ago
  > So, am I still supposed to specify UID and GID? If you run your container as a non-root user and create a user without setting a UID / GID it'll default to 1000:1000, so unless your Docker host's user isn't 1000:1000 then things work out of the box. A lot of this is general Linux knowledge around user / file permissions, not so much Docker. > Should I be using Alpine or Debian? Debian, no contest in my opinion. > How do I handle loading certificates? You can volume mount them or deal with SSL certificates in a way where Docker isn't involved such as running nginx on your Docker host directly or putting a load balancer in front of your app and handling SSL there. > Should I use an override config for development? You can use the same docker-compose.yml file in all environments and tweak things with environment variables. The compose file supports variable interpolation. Docker Compose profiles also let you control which services to run in each environment, it's even configurable by a single env variable. > Do I still need to worry about Docker blowing a hole in iptables? If you use -p 8000:8000, yes this will publish the port in a way where the outside world can access it. Likewise without Docker if you edit iptables to allow that port it will too. I wouldn't classify this as blowing a hole in iptables. This is "user configured application to make a port open to the world". > Maybe not black magic, but there are a lot of subtle optimizations for which there is much conflicting guidance. In the end my example apps address most of these issues for you. You're on your own with certificates since that varies on your deployment, but everything else is fully set up and ready to go and it protects yourself from blowing a hole in iptables since it only publishes the port to localhost by default, not 0.0.0.0. This would let nginx or another web server access it directly on your Docker host but no one else.
renox 4y ago
'black art' maybe not, overcomplicated mess? Yes! I've tried to use the docker compose command to limit the maximum number of CPUs used, I failed, even though it's possible: the support team managed to do it, but why did I fail? Because the doc and the design aren't great..