3 ms·

What are the additional features that docker provides over the basic containers in the article?

by osrec 3y ago

thwarted 3y ago
This is mentioned near the top. Docker have features such as layered images, networking, container orchestration, and extensive tooling that make it a powerful and versatile solution for deploying applications.
dtauzell 3y ago
The article says “Docker have features such as layered images, networking, container orchestration, and extensive tooling that make it a powerful and versatile “
deleted 3y ago
[deleted]
dhx 3y ago
Docker by default also applies a seccomp system call whitelist per [1] and restricts capabilities per [2], amongst numerous other default hardening practices that are applied. If a Docker container really had a need to call the "reboot" system call, this permission could be explicitly added. More complex sandboxing techniques include opening handles for sockets, pipes, files, etc and then hardening seccomp filters on top to prevent any new handles being opened. In this way, some containers can read/write defined files on a volume without having any ability to otherwise interact with file systems such as opening new files (all file system related system calls could be disabled). [1] https://github.com/moby/moby/blob/master/profiles/seccomp/default.json https://github.com/moby/moby/blob/master/profiles/seccomp/de... [2] https://docs.docker.com/engine/security/#linux-kernel-capabilities https://docs.docker.com/engine/security/#linux-kernel-capabi...
raesene9 3y ago
In addition to the other features that siblings have mentioned, what Docker offers is simplicity, in that you don't need to understand the details of namespaces, capabilities, cgroups etc to get an application running in a container :).
8organicbits 3y ago
Documentation, third-party tooling, third-party training, large number of software engineers already experienced, extensive real-world usage and testing, plus the items others have mentioned.
fulafel 3y ago
It's hard to say as "Docker" as a term or product name has diluted pretty much as they variously use it for various products with various functionalitites, and they don't have anything just called "Docker" any more. There's a lot of virtualization stuff for various operating systems, orchestration stuff, etc. (Note that the article also doesn't to link to any specific product, just to the Docker company front page. For me the first link the front page offers is "Docker Desktop for Linux" which is I guess a virtualization based system)
exploderate 3y ago
Dockerfile and "market place" (hub) were the big ones in my opinion. Even though Dockerfile syntax was a mess in the beginning, being able to specify a base and a few commands was a huge improvement in usability. Then running build and push to make your image widely available. Collaboration was so easy compared to the alternatives, Linux jails, jailer, debootstrap, lxc and such.

What are the additional features that docker provides over the basic containers in the article?

by osrec 3y ago

What are the additional features that docker provides over the basic containers in the article?

This is mentioned near the top. Docker have features such as layered images, networking, container orchestration, and extensive tooling that make it a powerful and versatile solution for deploying applications.

dtauzell 3y ago

The article says “Docker have features such as layered images, networking, container orchestration, and extensive tooling that make it a powerful and versatile “

deleted 3y ago

[deleted]

dhx 3y ago

Docker by default also applies a seccomp system call whitelist per [1] and restricts capabilities per [2], amongst numerous other default hardening practices that are applied. If a Docker container really had a need to call the "reboot" system call, this permission could be explicitly added. More complex sandboxing techniques include opening handles for sockets, pipes, files, etc and then hardening seccomp filters on top to prevent any new handles being opened. In this way, some containers can read/write defined files on a volume without having any ability to otherwise interact with file systems such as opening new files (all file system related system calls could be disabled). [1] https://github.com/moby/moby/blob/master/profiles/seccomp/default.json https://github.com/moby/moby/blob/master/profiles/seccomp/de... [2] https://docs.docker.com/engine/security/#linux-kernel-capabilities https://docs.docker.com/engine/security/#linux-kernel-capabi...

raesene9 3y ago

In addition to the other features that siblings have mentioned, what Docker offers is simplicity, in that you don't need to understand the details of namespaces, capabilities, cgroups etc to get an application running in a container :).

8organicbits 3y ago

Documentation, third-party tooling, third-party training, large number of software engineers already experienced, extensive real-world usage and testing, plus the items others have mentioned.

fulafel 3y ago

It's hard to say as "Docker" as a term or product name has diluted pretty much as they variously use it for various products with various functionalitites, and they don't have anything just called "Docker" any more. There's a lot of virtualization stuff for various operating systems, orchestration stuff, etc. (Note that the article also doesn't to link to any specific product, just to the Docker company front page. For me the first link the front page offers is "Docker Desktop for Linux" which is I guess a virtualization based system)

exploderate 3y ago

Dockerfile and "market place" (hub) were the big ones in my opinion. Even though Dockerfile syntax was a mess in the beginning, being able to specify a base and a few commands was a huge improvement in usability. Then running build and push to make your image widely available. Collaboration was so easy compared to the alternatives, Linux jails, jailer, debootstrap, lxc and such.