4 ms·

You can use Debian stable as a base image and run its nginx everywhere where there is Linux. The host OS doesn't matter much if everything is containerized.

• bandrami 3y ago
  Except the host does matter, that's the thing, because you're still ultimately running on it. I remember this really bit me once in the RHEL 6 to 7 shift when the syscall semantics changed. Our brilliant plan of keeping our applications in RHEL 6 containers and running them on 7 while we did the upgrade, but everything realtime failed (these were audio processing engines) because of that ABI change. Not to mention the fact that your stack is only as secure as its least secure element, and now you've got two (or more) platforms to keep an eye on for that.
  • jupp0r 3y ago
    Wait, did you happen to work at Citrix a few years ago? I ran into the exact same problem, also working on audio processing engines :)
    • bandrami 3y ago
      No, a flight simulator manufacturer, but we ended up not being remotely the only team it bit (for that matter it may have been you guys' mailing list trail we followed to find the kernel tweak to work around it since Red Hat's answer was "yeah don't do that")
  • rbanffy 3y ago
    The downside of containers is that you have whatever kernel is on the host. I avoid running Docker containers on bare metal for that reason. You can still have RH6 VMs running containers hosted on a RH7 server. All this conversation reminded me of Solaris containers having Linux compatibility layers that pretended you were running on Linux even though you had a Solaris kernel under it. Wonder how much of that lives now in Illumos and other descendants of OpenSolaris.
• rbanffy 3y ago
  The host matters a lot in container/VM escape attacks. I actively avoid running workloads on bare metal and have been doing so since the early 2000’s. It’s always easier to move a VM image to a new generic VM host than to reinstall everything from scratch. What Docker does is to make delivering the app easier (it’s less involved than a full VM) and also automate the build process with a simple tool (Docker build).
  • justinclift 3y ago
    > It’s always easier to move a VM image to a new generic VM host than to reinstall everything from scratch. Ansible?
    • doubled112 3y ago
      This is my backup solution on machines that don’t hold data. Rebuild from playbooks, and/or Docker compose.
    • rbanffy 3y ago
      You don’t move the data with Ansible. You can move a VM to do load shifting.