16 ms·

Docker Is Four Things

lazyant 3y ago
I'd say it's four things: - Dockerfile. - Docker image. - Docker container. - Docker repository. the docker desktop and docker hub is an implementation of one of those, other concepts like overlay filesystem as well.
- krick 3y ago
  It's also a CLI, a daemon, a network abstraction, a company… It just doesn't make any sense to try to count how many things "docker" is. It makes sense to ask which "docker" do you mean when you talk about "docker". But since the author doesn't really talk about anything coherent here, it doesn't make sense to ask.
WirelessGigabit 3y ago
And Docker Hub is the default repository where images are fetched from when you do docker pull ubuntu Which doesn't feel right. I wish the hub URL was mandatory.
_peeley 3y ago
I remember when I was diving deep into Docker for the first time a few years ago, I would have really appreciated seeing something like this. I wrote something kind of similar in a blog post [0], but that was only a semi-confident note to self that took quite a bit of digging through READMEs and GitHub issues. All the different container runtimes/engines/interfaces are really enough to make your head spin. [0] https://blog.janissary.xyz/posts/docker-gripes https://blog.janissary.xyz/posts/docker-gripes , see `Conclusion` section
wuming2 3y ago
Most commonly used languages are available on all platforms. Together with the vast cornucopia of their libraries. So if I want to develop on a Mac or Windows, as is common, native versions are available for either of them. For who target Linux as deployment platform, as is common, Docker instead forces to run the Linux version of interpreters and libraries on a Mac or Windows. On top of a Linux mini VM. Could not be otherwise?
throw1234651234 3y ago
Has probably been a decade until I have seen a USEFUL 12-line article like this.
bhawks 3y ago
> First, the Dockerfile file format for declaratively describing a machine (operating system, installed packages, processes, etc). I have a hard time calling Dockerfile declarative when the RUN statement literally runs a sequence of user provided shell commands in a container. Is a shell script declarative or imperative? It is structured and mostly results in an easy to understand set of instructions to create a container image. But it is a set of instructions and you can shoot yourself in the foot (especially with reproducibility)
- danielvaughn 3y ago
  In my book, if the order of statements influenced the order operations, then it’s imperative. So I think Dockerfiles count.
- sverhagen 3y ago
  RUN is the escape hatch that everybody (understandably) abused. And because we do, it's maybe the first thing you think of when thinking of a Dockerfile. But in the context of the other Dockerfile keywords I can probably live with calling it declarative. I'm a Java guy, I'd definitely call Maven declarative, but it surely has some escape hatches too. And what about <fill in your example>...
  - sdf4j 3y ago
    add COPY to the list of keywords we rather ignore so we can call Dockerfiles declarative.
    - dharmab 3y ago
      And ADD (which you should almost never use instead of COPY because it does extra stuff you don't need)
  - diarrhea 3y ago
    Abuse, how? What does not abusing it look like? Not using it is not an option either; it would make for very boring containers.
Wingy 3y ago
I think it's important to recognize the difference between Dockerfiles and Docker images. Docker Engine builds Dockerfiles to Docker images, but you don't need a Dockerfile to run a pre-built image.
- yjftsjthsd-h 3y ago
  You can also make container images without using Dockerfiles (ex. using nix)
  - lokar 3y ago
    Or tar
  - metaltyphoon 3y ago
    Dotnet added tooling to its SDK to build a docker image without having docker installed.
- jonhohle 3y ago
  I came here to say the same thing. Images and their layers are loosely related to the Dockerfile format (each command is a layer), but Dockerfiles are as useful for execution as C Source files are. Likewise images can be sent and received without a Dockerfile just like an executable without its source.
- justsomehnguy 3y ago
  >Docker Engine builds Dockerfiles to Docker images Docker Engine uses a Dockerfile as an instruction to build a Docker Image
  - malablaster 3y ago
    In a software context, “build” implicitly means to use as instruction. The clarification was unnecessary.
    - justsomehnguy 3y ago
phartenfeller 3y ago
With GitHub Container Repo, Podman, Colima, etc., the Dockerfile format is maybe the only one that will stick for a long time. I don't think Docker is going away, but I think it is such a great format that there is no need to reinvent it. Same for docker-compose.
- ants_everywhere 3y ago
  > Dockerfile format is maybe the only one that will stick for a long time Do you mean the image format? The Dockerfile as a recipe for building an image seems like it can be replaced pretty easily with a nicer interface whenever someone feels like building one. But the image format will probably continue to be supported for some time.
- amluto 3y ago
  The Dockerfile format is, in my opinion, crap. It’s extremely useful, and it’s fairly straightforward to kludge together a container build process using it, but: It’s very hard to get reproducible output. It’s even fairly hard to get output where the inputs are well controlled. It can’t do a clean crossbuild — you have to run the container to build it. As a side effect, you need all the tooling to install things into the container to be in the container. (Yes, there are workarounds. They’re ugly.) It leaves trash behind. You need to fight with it to even get /tmp to be temporary. It has no usable efficient way to supply large input files. You can bind-mount into a RUN, but getting permissions right when doing so is an uphill battle.
  - lopkeny12ko 3y ago
    It is inherently not possible for Dockerfiles, as a format, to generate reproducible outputs/images. You can run whatever command you want in a Dockerfile. Docker engine itself has no way of knowing whether that command's behavior is reproducible--and in turn, has no way to guarantee reproducible images from a Dockerfile.
    - amluto 3y ago
      The format and engine could try a lot harder to make improved reproducibility the default. As a trivial example, network access for RUN should be opt-in, not opt-out. The fact that the easiest ways to pull data in involve things like RUN wget is a design error. A much better approach would be to have packages that install with as little script involvement as possible. Most Linux images are put together using rpm or deb packages and, other than pre/post-install scripts (which are not usually particularly necessary), package installation is fundamentally reproducible and does not require running the image. A good image building system IMO would mostly look more like: INSTALLPACKAGES foo bar baz And dependencies would get solved and packages installed, reproducibly.
whirlwin 3y ago
> Second, the Docker Engine which takes a Dockerfile and runs it on a Linux host natively, without a virtual machine. This is a grand oversimplification/misconception. The Dockerfile is just a description on how to build a container image. Running a container on an engine is a different story.
- wlonkly 3y ago
  I'm not even sure if it's an oversimplification or misconception. I think it might just be a plain old error, and the author meant to write "takes a Docker image".
  - krick 3y ago
    Honestly, it doesn't seem to me that the author knows what he is is talking about anyway.
- krick 3y ago
  I mean, that post is a grand oversimplification to the point of being basically wrong on so many levels, that I'm not even sure why do you pick specifically that point to argue about. Even though you are totally right.
- moolcool 3y ago
  I think it's pedantic to call it a "grand oversimplification". It seems like a reasonable simplification to me. Like calling a .py file an application is reasonable IMO, even though it's a simplification because it's "just" instructions for an interpreter.
  - baobabKoodaa 3y ago
    > It seems like a reasonable simplification to me. It's not reasonable at all. If someone is trying to learn Docker and they read this misleading article, they will think they can somehow run their Dockerfile as a container, and they will be wholly confused as to why it's not going to work out.
redhale 3y ago
5. Docker Inc., the company that sells and provides support for Docker Desktop and Docker Hub Also, Windows containers are a thing.
halfjoking 3y ago
Fifth thing: Bricker of Windows https://github.com/docker/for-win/issues/1549 https://github.com/docker/for-win/issues/1549 Still pissed my HP Windows laptop was bricked from it a few months ago. I’ll never use it for anything.
- phyzome 3y ago
  Not actually bricked, I assume -- your laptop has not been "turned into a brick", just had the OS corrupted, right? You could presumably wipe and reinstall Windows to fix it. (Not saying that doesn't suck, just arguing with the terminology.)
  - halfjoking 3y ago
    You’re right formatting the drive would work. But reinstall Windows crashes, USB recovery drive only helps copy files from command line, system restore points all crash. “OS corruption” sounds like it can be repaired while keeping files, but this is worse than that.
    - JuanPosadas 3y ago
      > OS corruption” sounds like it can be repaired while keeping files If it corrupts your OS and it corrupts your files, that sucks, but it's not bricking unless it's impossible to install a working operating system.
    - agumonkey 3y ago
      So as a last resort you'd have to boot a live image (windows or linux) to extract docs and configs in order to reinstall from zero ?
- Am4TIfIsER0ppos 3y ago
  I fucking hate docker on linux but that issue is so much worse with a cherry of "Closed issues are locked after 30 days of inactivity". I can't tell if it was fixed or not.
danpalmer 3y ago
Docker is also a company that sells 3 of these as a product. What's interesting is that for those 3 there are often better versions. Docker Engine is not used in a number of popular examples – GCP for example uses their own engine if I remember correctly. There are other pluggable runtimes. The Docker desktop app isn't great, and is now expensive, compared to a number of cheaper or free or open source alternatives. And Docker Hub is basically just for free public publishing, as Docker registries are so commoditised. I've always felt that the best bit of Docker is the file format and the UX around that. But that's not something Docker-the-company has managed to monetise.
- vbezhenar 3y ago
  Docker engine uses containerd to run containers. Containerd was born from Docker company. Containerd is probably the most popular runtime for Kubernetes. GKE uses containerd as well. Docker hub is absolutely the most popular registry for open source software and configured as default address for kubernetes. Nothing of it is irreplaceable for sure. But Docker made a big contribution to container world, regardless.
- Sankozi 3y ago
  What are better alternatives to Docker desktop on Windows? I am using Rancher desktop and number of bugs and lack of features would make paying for Docker desktop worthwhile if I used it more than ~1 hour per week.
  - dusanh 3y ago
    Maybe https://podman-desktop.io/ https://podman-desktop.io/ ? I haven't used it myself though, so I can't vouch for it.
    - oofta-boofta 3y ago
      [dead]
  - crabbone 3y ago
    This is a weird question: why would you use anything like Docker Desktop to begin with? I didn't even know Docker Desktop existed until couple months ago. My wife works on MS Windows and she needed to run someone's project that was for some reason distributed in Docker images... She couldn't get Docker installed on Windows, but that's kind of expected as everything is kind of screwy there... so, I had to use Web search to figure out what is the way to do it (she did try to get Docker Desktop). I ended up configuring Hyper-V (solely because it comes bundled with the system) and installing Docker in some Arch VM I set up for that. I cannot claim that this is a "comfortable" setup, but given the overall bad UX of that OS and that Docker isn't designed to run on it from the start, I think it's an OK solution. I briefly tried opening the Docker Desktop GUI, and I just cannot understand why would anyone need that specific thing... it just seems to make everything worse at the baseline. You immediately miss the convenience of being able to feed the output it produces into grep / pager or to combine information extracted from one output with the input into another operation.
shawabawa3 3y ago
> First, the Dockerfile file format for declaratively describing a machine (operating system, installed packages, processes, etc). The Dockerfile format is not declarative. Declarative means you define the state you want Imperative means you define the commands to run Dockerfile is 100% imperative
- ajross 3y ago
  If you're going to make absolutist statements about nitpicky minutiae, you have to get it right. In point of fact the image side of a Dockerfile, where an image is a DAG of other images referenced by an immutable ID or pointer to hosted content, is "100%" declarative. It's only the "build" syntax that is ordered.
  - candiddevmike 3y ago
    OP specifically said "The Dockerfile format is not declarative." They made no mention of the image side, only the build syntax.
  - bheadmaster 3y ago
    In all the real-world cases I've seen, the base images in Dockerfiles are just tags, which are mutable (especially the :latest tag which changes with every release).
  - shawabawa3 3y ago
    We are only talking about the build syntax here ("the Dockerfile file format")
  - lolinder 3y ago
    If you're going to be pedantic about minutae, you have to get it right. The "image side of a Dockerfile" isn't a Dockerfile, it's an image, more specifically an image in the OCI Image Format [0]. A Dockerfile is just the most common syntax for controlling software that can create an OCI image (such as Docker and Podman). You could argue that the OCI Image Format is declarative, but that's not relevant to OP's comment about Dockerfiles. [0] https://github.com/opencontainers/image-spec https://github.com/opencontainers/image-spec
imachine1980_ 3y ago
we need more clean and short post like this Docker is 4 things (clear title) state of the art?/ information needed -First, the Dockerfile file format for declaratively describing a machine (operating system, installed packages, processes, etc). -Second, the Docker Engine which takes a Dockerfile and runs it on a Linux host natively, without a virtual machine. -Third, the Docker Desktop app which takes a Dockerfile and runs it on a Mac or Windows host, using a Linux virtual machine. -Fourth, the Docker Hub container repository which allows a community to share Dockerfiles for common configurations. problem that could arrive/why this is important Often, when people evaluate Docker or make statments about “Docker,” they’re referring only to the Docker Engine. conclusion But most of the time, this is not a useful view to take. Most of time, the practicality of Docker comes from a combination of all four of these things."
jsmith99 3y ago
> Second, the Docker Engine which takes a Dockerfile and runs it on a Linux host natively, without a virtual machine. Or on Windows natively, using native Windows containers, assuming the image you want to run is a Windows application and not a Linux one.
bsenftner 3y ago
And of these four things, a large number of 3rd party products and open source utilities do not recognize the difference between using Docker with and without Docker Desktop. Most only work without Docker Desktop, and do not even realize that the environment with Docker Desktop completely breaks their offering.
shrimp_emoji 3y ago
[flagged]
mcv 3y ago
For someone who still doesn't quite get Docker, this sort of brief enumeration is incredibly useful. Is there something similar for Kubernetes?
- JustinGarrison 3y ago
  Kubernetes is: 1) an API server and spec definition for infrastructure and applications 2) a distributed database to store API state 3) agents to apply the API definition into “real” systems
- robszumski 3y ago
  First, Kubernetes is a resource allocator/scheduler. Find a place for this workload given my constraints. If something goes wrong, find a new place. Second, Kubernetes is a dev-friendly app management tool. Start 5 copies of this app, restart if it fails, mount this config file, etc. Most Kube apps look roughly the same across teams and companies, so skills are transferrable. Third, the Kubernetes API is a standardization layer between compute/cloud capabilities. Fourth, the Kubernetes Container <foo> Interface (CxI) is a implementation layer to plug in to compute capabilities. You can swap Docker, CRI-O, etc with the Container Runtime Interface (CRI). Use cloud block storage with Container Storage Interface (CSI). Fifth, Kubernetes custom resources (CRDs) are a standardized extension point for building custom behavior into a cluster in a sane way.
trey-jones 3y ago
Docker Desktop is too narrow too include this way. You might as well call it Docker Runtime or something. Personally I would just include it as part of the Docker Engine, along with the CLI, and the Go SDK which can equally be used to spawn docker containers. So Docker is 3 things.
airza 3y ago
They are also Docker Compose, which is frankly one of the nicest pieces of software I’ve used in a long time.
- supercanuck 3y ago
  Docker Compose is contained in Docker Desktop.
  - paradox460 3y ago
    It can be run independently. I'm using colima, docker, and docker compose, and it just works
- bg24 3y ago
  Yes. And if you really needed to scale beyond 1 node, enable swarm mode.
- apozem 3y ago
  Love Docker Compose. At an old job, we used it to provide every developer with a local version of the frontend, backend and database, all in separate containers that only talked to each other. All of that with one command!
  - salawat 3y ago
    ...that none of them could figure out how to debug. >t. The guy who gets endlessly tired of having to unfsck the layers of abstraction into something mere mortal devs/testers can reason through about.
    - giobox 3y ago
      People have been making this facetious argument since Docker launched a decade ago, it's even more ridiculous to make it now. My job would very literally be harder and take much longer to accomplish things without the benefits of containers. Anyone who still feels this way about containers for software dev today needs to get off their grumpy stool and embrace the benefits.
willvarfar 3y ago
Meta point, but it's a very nice presentation for a personal blog. Nice choice of font, layout and background. Hopefully Matthias gets into blogging more. I miss the good old days of lots of programmers blogging.
hliyan 3y ago
Why not "Docker is an OS level virtualization (or containerization) product"? This is like saying "Tylenol/Panadol is a painkiller and a fever reducer" without ever mentioning that it is a branded offering of the generic drug Acetaminophen/Paracetamol. We need to start using generic terms for technologies, not product names first. E.g. "Reactive Web Components" could be React, Preact or a number of other libraries/frameworks.
- porridgeraisin 3y ago
  I feel the same about 90% of stuff I see in this field. As for remedying it, that ship has sailed. Most of CS, AI/ML are all plagued with marketing terms for everything. People either reinvent something from 40 years prior, or stack two existing things, name it something completely stupid, never forgetting "blazing fast" at the start, all instead of a humble combination - preferably concatenation - of the simple base concepts it comprises.
Tainnor 3y ago
Isn't it actually (at least) five things? 1. The Dockerfile specification 2. A tool to turn a Dockerfile into an OCI image (or actually, multiple tools, since we have "normal" docker and docker buildx) 3. A tool to run OCI images (I don't even know if this works for images not generated by docker) 4. Docker Desktop 5. Docker Hub
gjvc 3y ago
no mention of kernel namespaces, which actually enable this functionality. I wonder what proportion of people think that Docker enforces the separation between inside and outside a container.
TekMol 3y ago
Unfortunately it also is a daemon that constantly runs on your machine even when you don't use Docker at all. Which keeps all kind of mounts and virtual networks alive that you don't need and that interfere with other things you want to do. For example I was on a train in Germany recently and could not use the Wifi. Why? Turned out the docker daemon occupied the IP range the Train Wifi uses. While I was not using docker at all.
- wwtdtgotiatl 3y ago
  There's also the part where it starts punching holes in your firewall without even a peep about it to the user.
sigmonsays 3y ago
i feel like this author does not fully comprehend the topic (docker)... dockerfile is NOT declarative. "Docker Engine which takes a Dockerfile and runs it on a Linux host natively" no, not really, you have to build the dockerfile into a container. There is a lot of different steps between. This post is four things and i'll leave it to the reader to figure it out
jillesvangurp 3y ago
Docker is just one thing. Docker is a command that can build, fetch, and run docker images from a docker registry and orchestrates running those typically on a linux host or virtual machine. A docker image is a set of hashes that identify layers in a layered filesystem. A docker registry stores those layers and the docker looks up layers from the registry. The combined layers form a filesystem that is mounted when you run the docker image. A running docker image is called a docker container. To create a docker image with docker, you use a Dockerfile that specifies a sequence of steps that modify the layered file system, typically starting from a base image that is specified in the first line. The company Docker Inc. is a major contributor to the open source docker code base and also owns and runs a popular docker registry called Docker Hub, which is what the docker command uses as default place to look for docker images. While docker is popular, there are alternative tools that are able to run docker images. For example Kubernetes implements its own way to run docker images. Likewise, there are build tools that produce docker images without using the docker command or a Dockerfile. And the docker registry API is simple enough that you don't need docker to fetch layers either. Consequently, there are several popular tools in this space. That do similar things with varying degrees of compatibility. Many of these can run docker containers from Docker Hub.
- chupasaurus 3y ago
  Docker CLI without a daemon is useless hence it's far from just a command.
  - LeFantome 3y ago
    Use Podman then. Now its just a command again.
- chrisweekly 3y ago
  > "Docker is just one thing." I think you meant to say "Docker is more than just one thing.", right?
firesteelrain 3y ago
I feel like I still don't understand what a container actually is.. is it a filesystem? is it an operating system? is it in a class of its own?
- nrclark 3y ago
  This is a big over-simplification, but I think it's a good mental model: Think of a container as a fancy chroot. Imagine that: 1. You have a whole separate Linux installation in some random folder. 2. You ask your OS to launch some process, and to "trick" the process into thinking that "$YOUR_FOLDER" is actually "/". 3. You maybe also ask your OS to add some extra isolation (network, devices, /proc, etc). 4. The term "container" refers to the chroot, the isolation rules, and usually the process-tree running inside of it. 5. While a container is alive, you can also ask the OS to run some other programs that exist inside of the container's sandbox Docker is a tool that creates and manages containers. In Docker's view of the world: - Containers are made by extracting .tar.gz files into some folder and asking the OS to create a sandbox where that folder is a "fake" root directory. - Those .tar.gz files are called "images". - Docker can download images from the internet, or you can build your own by asking it to follow the steps contained in a Dockerfile.
  - firesteelrain 3y ago
    So a container is an easy way to deliver an entire software package with its own runtime environment?
    - nrclark 3y ago
      Sort of, yeah. An image is an easy way to deliver an entire software package. A container is the place where your image will run.
- lifechoseme123 3y ago
  The way I think of a container: It's an individual OS with a filesystem of its own, based on the "image" and what is pre-installed (such as an OS, plus, if you choose: some extras pre-installed based on your project need.). You can link your laptop or server (AKA your "host" computer) to it through Docker Volumes. And, you can link containers together through Docker Networks, for example. So, you can see how a single compartmentalized OS (a "container") can: 1. interact with another computer's file system and 2. interact with another computer on a network. And, each one can be quite customized. So, a container is an OS + filesystem* + network* * = can be connected to others to transfer data
jslakro 3y ago
Docker is an Engine and a Hub. The configuration file concept is common to any software which automatizes machine virtualization. The commercial emphasizes behind Desktop and the existence of alternatives like the CLI or Portainer, makes that part dispensable
oftenwrong 3y ago
Missing a mention of buildkit, which compiles various high-level build description languages (including Dockerfile) into a low-level build graph execution, which supports all of the bells and whistles of advanced build infrastructure, such as remote execution and remote caching. https://docs.docker.com/build/buildkit/ https://docs.docker.com/build/buildkit/ I am particularly interested in build systems, so I am biased, but I think this is one of the coolest things coming out of Docker. It is a bit painful to see so much fanfare at DockerCon about Docker Desktop stuff, and so few mentions of more foundational things like buildkit and rootless container support.
golergka 3y ago
As an aside, I love the design of this mini-blog format. And I really appreciate the author who says just one thing and doesn't have the need to generate walls of meaningless text to convey it.
pjmlp 3y ago
> Third, the Docker Desktop app which takes a Dockerfile and runs it on a Mac or Windows host, using a Linux virtual machine. Only if using Linux containers. Windows has native containers support.

I'd say it's four things: - Dockerfile. - Docker image. - Docker container. - Docker repository. the docker desktop and docker hub is an implementation of one of those, other concepts like overlay filesystem as well.

krick 3y ago
It's also a CLI, a daemon, a network abstraction, a company… It just doesn't make any sense to try to count how many things "docker" is. It makes sense to ask which "docker" do you mean when you talk about "docker". But since the author doesn't really talk about anything coherent here, it doesn't make sense to ask.

WirelessGigabit 3y ago

And Docker Hub is the default repository where images are fetched from when you do docker pull ubuntu Which doesn't feel right. I wish the hub URL was mandatory.

_peeley 3y ago

I remember when I was diving deep into Docker for the first time a few years ago, I would have really appreciated seeing something like this. I wrote something kind of similar in a blog post [0], but that was only a semi-confident note to self that took quite a bit of digging through READMEs and GitHub issues. All the different container runtimes/engines/interfaces are really enough to make your head spin. [0] https://blog.janissary.xyz/posts/docker-gripes https://blog.janissary.xyz/posts/docker-gripes , see `Conclusion` section

wuming2 3y ago

Most commonly used languages are available on all platforms. Together with the vast cornucopia of their libraries. So if I want to develop on a Mac or Windows, as is common, native versions are available for either of them. For who target Linux as deployment platform, as is common, Docker instead forces to run the Linux version of interpreters and libraries on a Mac or Windows. On top of a Linux mini VM. Could not be otherwise?

throw1234651234 3y ago

Has probably been a decade until I have seen a USEFUL 12-line article like this.

bhawks 3y ago

> First, the Dockerfile file format for declaratively describing a machine (operating system, installed packages, processes, etc). I have a hard time calling Dockerfile declarative when the RUN statement literally runs a sequence of user provided shell commands in a container. Is a shell script declarative or imperative? It is structured and mostly results in an easy to understand set of instructions to create a container image. But it is a set of instructions and you can shoot yourself in the foot (especially with reproducibility)

danielvaughn 3y ago
In my book, if the order of statements influenced the order operations, then it’s imperative. So I think Dockerfiles count.
sverhagen 3y ago
RUN is the escape hatch that everybody (understandably) abused. And because we do, it's maybe the first thing you think of when thinking of a Dockerfile. But in the context of the other Dockerfile keywords I can probably live with calling it declarative. I'm a Java guy, I'd definitely call Maven declarative, but it surely has some escape hatches too. And what about <fill in your example>...
- sdf4j 3y ago
  add COPY to the list of keywords we rather ignore so we can call Dockerfiles declarative.
  - dharmab 3y ago
    And ADD (which you should almost never use instead of COPY because it does extra stuff you don't need)
- diarrhea 3y ago
  Abuse, how? What does not abusing it look like? Not using it is not an option either; it would make for very boring containers.

Wingy 3y ago

I think it's important to recognize the difference between Dockerfiles and Docker images. Docker Engine builds Dockerfiles to Docker images, but you don't need a Dockerfile to run a pre-built image.

yjftsjthsd-h 3y ago
You can also make container images without using Dockerfiles (ex. using nix)
- lokar 3y ago
  Or tar
- metaltyphoon 3y ago
  Dotnet added tooling to its SDK to build a docker image without having docker installed.
jonhohle 3y ago
I came here to say the same thing. Images and their layers are loosely related to the Dockerfile format (each command is a layer), but Dockerfiles are as useful for execution as C Source files are. Likewise images can be sent and received without a Dockerfile just like an executable without its source.
justsomehnguy 3y ago
>Docker Engine builds Dockerfiles to Docker images Docker Engine uses a Dockerfile as an instruction to build a Docker Image
- malablaster 3y ago
  In a software context, “build” implicitly means to use as instruction. The clarification was unnecessary.
  - justsomehnguy 3y ago

phartenfeller 3y ago

With GitHub Container Repo, Podman, Colima, etc., the Dockerfile format is maybe the only one that will stick for a long time. I don't think Docker is going away, but I think it is such a great format that there is no need to reinvent it. Same for docker-compose.

ants_everywhere 3y ago
> Dockerfile format is maybe the only one that will stick for a long time Do you mean the image format? The Dockerfile as a recipe for building an image seems like it can be replaced pretty easily with a nicer interface whenever someone feels like building one. But the image format will probably continue to be supported for some time.
amluto 3y ago
The Dockerfile format is, in my opinion, crap. It’s extremely useful, and it’s fairly straightforward to kludge together a container build process using it, but: It’s very hard to get reproducible output. It’s even fairly hard to get output where the inputs are well controlled. It can’t do a clean crossbuild — you have to run the container to build it. As a side effect, you need all the tooling to install things into the container to be in the container. (Yes, there are workarounds. They’re ugly.) It leaves trash behind. You need to fight with it to even get /tmp to be temporary. It has no usable efficient way to supply large input files. You can bind-mount into a RUN, but getting permissions right when doing so is an uphill battle.
- lopkeny12ko 3y ago
  It is inherently not possible for Dockerfiles, as a format, to generate reproducible outputs/images. You can run whatever command you want in a Dockerfile. Docker engine itself has no way of knowing whether that command's behavior is reproducible--and in turn, has no way to guarantee reproducible images from a Dockerfile.
  - amluto 3y ago
    The format and engine could try a lot harder to make improved reproducibility the default. As a trivial example, network access for RUN should be opt-in, not opt-out. The fact that the easiest ways to pull data in involve things like RUN wget is a design error. A much better approach would be to have packages that install with as little script involvement as possible. Most Linux images are put together using rpm or deb packages and, other than pre/post-install scripts (which are not usually particularly necessary), package installation is fundamentally reproducible and does not require running the image. A good image building system IMO would mostly look more like: INSTALLPACKAGES foo bar baz And dependencies would get solved and packages installed, reproducibly.

whirlwin 3y ago

> Second, the Docker Engine which takes a Dockerfile and runs it on a Linux host natively, without a virtual machine. This is a grand oversimplification/misconception. The Dockerfile is just a description on how to build a container image. Running a container on an engine is a different story.

wlonkly 3y ago
I'm not even sure if it's an oversimplification or misconception. I think it might just be a plain old error, and the author meant to write "takes a Docker image".
- krick 3y ago
  Honestly, it doesn't seem to me that the author knows what he is is talking about anyway.
krick 3y ago
I mean, that post is a grand oversimplification to the point of being basically wrong on so many levels, that I'm not even sure why do you pick specifically that point to argue about. Even though you are totally right.
moolcool 3y ago
I think it's pedantic to call it a "grand oversimplification". It seems like a reasonable simplification to me. Like calling a .py file an application is reasonable IMO, even though it's a simplification because it's "just" instructions for an interpreter.
- baobabKoodaa 3y ago
  > It seems like a reasonable simplification to me. It's not reasonable at all. If someone is trying to learn Docker and they read this misleading article, they will think they can somehow run their Dockerfile as a container, and they will be wholly confused as to why it's not going to work out.

redhale 3y ago

5. Docker Inc., the company that sells and provides support for Docker Desktop and Docker Hub Also, Windows containers are a thing.

halfjoking 3y ago

Fifth thing: Bricker of Windows https://github.com/docker/for-win/issues/1549 https://github.com/docker/for-win/issues/1549 Still pissed my HP Windows laptop was bricked from it a few months ago. I’ll never use it for anything.

phyzome 3y ago
Not actually bricked, I assume -- your laptop has not been "turned into a brick", just had the OS corrupted, right? You could presumably wipe and reinstall Windows to fix it. (Not saying that doesn't suck, just arguing with the terminology.)
- halfjoking 3y ago
  You’re right formatting the drive would work. But reinstall Windows crashes, USB recovery drive only helps copy files from command line, system restore points all crash. “OS corruption” sounds like it can be repaired while keeping files, but this is worse than that.
  - JuanPosadas 3y ago
    > OS corruption” sounds like it can be repaired while keeping files If it corrupts your OS and it corrupts your files, that sucks, but it's not bricking unless it's impossible to install a working operating system.
  - agumonkey 3y ago
    So as a last resort you'd have to boot a live image (windows or linux) to extract docs and configs in order to reinstall from zero ?
Am4TIfIsER0ppos 3y ago
I fucking hate docker on linux but that issue is so much worse with a cherry of "Closed issues are locked after 30 days of inactivity". I can't tell if it was fixed or not.

danpalmer 3y ago

Docker is also a company that sells 3 of these as a product. What's interesting is that for those 3 there are often better versions. Docker Engine is not used in a number of popular examples – GCP for example uses their own engine if I remember correctly. There are other pluggable runtimes. The Docker desktop app isn't great, and is now expensive, compared to a number of cheaper or free or open source alternatives. And Docker Hub is basically just for free public publishing, as Docker registries are so commoditised. I've always felt that the best bit of Docker is the file format and the UX around that. But that's not something Docker-the-company has managed to monetise.

vbezhenar 3y ago
Docker engine uses containerd to run containers. Containerd was born from Docker company. Containerd is probably the most popular runtime for Kubernetes. GKE uses containerd as well. Docker hub is absolutely the most popular registry for open source software and configured as default address for kubernetes. Nothing of it is irreplaceable for sure. But Docker made a big contribution to container world, regardless.
Sankozi 3y ago
What are better alternatives to Docker desktop on Windows? I am using Rancher desktop and number of bugs and lack of features would make paying for Docker desktop worthwhile if I used it more than ~1 hour per week.
- dusanh 3y ago
  Maybe https://podman-desktop.io/ https://podman-desktop.io/ ? I haven't used it myself though, so I can't vouch for it.
  - oofta-boofta 3y ago
    [dead]
- crabbone 3y ago
  This is a weird question: why would you use anything like Docker Desktop to begin with? I didn't even know Docker Desktop existed until couple months ago. My wife works on MS Windows and she needed to run someone's project that was for some reason distributed in Docker images... She couldn't get Docker installed on Windows, but that's kind of expected as everything is kind of screwy there... so, I had to use Web search to figure out what is the way to do it (she did try to get Docker Desktop). I ended up configuring Hyper-V (solely because it comes bundled with the system) and installing Docker in some Arch VM I set up for that. I cannot claim that this is a "comfortable" setup, but given the overall bad UX of that OS and that Docker isn't designed to run on it from the start, I think it's an OK solution. I briefly tried opening the Docker Desktop GUI, and I just cannot understand why would anyone need that specific thing... it just seems to make everything worse at the baseline. You immediately miss the convenience of being able to feed the output it produces into grep / pager or to combine information extracted from one output with the input into another operation.

shawabawa3 3y ago

> First, the Dockerfile file format for declaratively describing a machine (operating system, installed packages, processes, etc). The Dockerfile format is not declarative. Declarative means you define the state you want Imperative means you define the commands to run Dockerfile is 100% imperative

ajross 3y ago
If you're going to make absolutist statements about nitpicky minutiae, you have to get it right. In point of fact the image side of a Dockerfile, where an image is a DAG of other images referenced by an immutable ID or pointer to hosted content, is "100%" declarative. It's only the "build" syntax that is ordered.
- candiddevmike 3y ago
  OP specifically said "The Dockerfile format is not declarative." They made no mention of the image side, only the build syntax.
- bheadmaster 3y ago
  In all the real-world cases I've seen, the base images in Dockerfiles are just tags, which are mutable (especially the :latest tag which changes with every release).
- shawabawa3 3y ago
  We are only talking about the build syntax here ("the Dockerfile file format")
- lolinder 3y ago
  If you're going to be pedantic about minutae, you have to get it right. The "image side of a Dockerfile" isn't a Dockerfile, it's an image, more specifically an image in the OCI Image Format [0]. A Dockerfile is just the most common syntax for controlling software that can create an OCI image (such as Docker and Podman). You could argue that the OCI Image Format is declarative, but that's not relevant to OP's comment about Dockerfiles. [0] https://github.com/opencontainers/image-spec https://github.com/opencontainers/image-spec

imachine1980_ 3y ago

we need more clean and short post like this Docker is 4 things (clear title) state of the art?/ information needed -First, the Dockerfile file format for declaratively describing a machine (operating system, installed packages, processes, etc). -Second, the Docker Engine which takes a Dockerfile and runs it on a Linux host natively, without a virtual machine. -Third, the Docker Desktop app which takes a Dockerfile and runs it on a Mac or Windows host, using a Linux virtual machine. -Fourth, the Docker Hub container repository which allows a community to share Dockerfiles for common configurations. problem that could arrive/why this is important Often, when people evaluate Docker or make statments about “Docker,” they’re referring only to the Docker Engine. conclusion But most of the time, this is not a useful view to take. Most of time, the practicality of Docker comes from a combination of all four of these things."

jsmith99 3y ago

> Second, the Docker Engine which takes a Dockerfile and runs it on a Linux host natively, without a virtual machine. Or on Windows natively, using native Windows containers, assuming the image you want to run is a Windows application and not a Linux one.

bsenftner 3y ago

And of these four things, a large number of 3rd party products and open source utilities do not recognize the difference between using Docker with and without Docker Desktop. Most only work without Docker Desktop, and do not even realize that the environment with Docker Desktop completely breaks their offering.

shrimp_emoji 3y ago

[flagged]

mcv 3y ago

For someone who still doesn't quite get Docker, this sort of brief enumeration is incredibly useful. Is there something similar for Kubernetes?

JustinGarrison 3y ago
Kubernetes is: 1) an API server and spec definition for infrastructure and applications 2) a distributed database to store API state 3) agents to apply the API definition into “real” systems
robszumski 3y ago
First, Kubernetes is a resource allocator/scheduler. Find a place for this workload given my constraints. If something goes wrong, find a new place. Second, Kubernetes is a dev-friendly app management tool. Start 5 copies of this app, restart if it fails, mount this config file, etc. Most Kube apps look roughly the same across teams and companies, so skills are transferrable. Third, the Kubernetes API is a standardization layer between compute/cloud capabilities. Fourth, the Kubernetes Container <foo> Interface (CxI) is a implementation layer to plug in to compute capabilities. You can swap Docker, CRI-O, etc with the Container Runtime Interface (CRI). Use cloud block storage with Container Storage Interface (CSI). Fifth, Kubernetes custom resources (CRDs) are a standardized extension point for building custom behavior into a cluster in a sane way.

trey-jones 3y ago

Docker Desktop is too narrow too include this way. You might as well call it Docker Runtime or something. Personally I would just include it as part of the Docker Engine, along with the CLI, and the Go SDK which can equally be used to spawn docker containers. So Docker is 3 things.

airza 3y ago

They are also Docker Compose, which is frankly one of the nicest pieces of software I’ve used in a long time.

supercanuck 3y ago
Docker Compose is contained in Docker Desktop.
- paradox460 3y ago
  It can be run independently. I'm using colima, docker, and docker compose, and it just works
bg24 3y ago
Yes. And if you really needed to scale beyond 1 node, enable swarm mode.
apozem 3y ago
Love Docker Compose. At an old job, we used it to provide every developer with a local version of the frontend, backend and database, all in separate containers that only talked to each other. All of that with one command!
- salawat 3y ago
  ...that none of them could figure out how to debug. >t. The guy who gets endlessly tired of having to unfsck the layers of abstraction into something mere mortal devs/testers can reason through about.
  - giobox 3y ago
    People have been making this facetious argument since Docker launched a decade ago, it's even more ridiculous to make it now. My job would very literally be harder and take much longer to accomplish things without the benefits of containers. Anyone who still feels this way about containers for software dev today needs to get off their grumpy stool and embrace the benefits.

willvarfar 3y ago

Meta point, but it's a very nice presentation for a personal blog. Nice choice of font, layout and background. Hopefully Matthias gets into blogging more. I miss the good old days of lots of programmers blogging.

hliyan 3y ago

Why not "Docker is an OS level virtualization (or containerization) product"? This is like saying "Tylenol/Panadol is a painkiller and a fever reducer" without ever mentioning that it is a branded offering of the generic drug Acetaminophen/Paracetamol. We need to start using generic terms for technologies, not product names first. E.g. "Reactive Web Components" could be React, Preact or a number of other libraries/frameworks.

porridgeraisin 3y ago
I feel the same about 90% of stuff I see in this field. As for remedying it, that ship has sailed. Most of CS, AI/ML are all plagued with marketing terms for everything. People either reinvent something from 40 years prior, or stack two existing things, name it something completely stupid, never forgetting "blazing fast" at the start, all instead of a humble combination - preferably concatenation - of the simple base concepts it comprises.

Tainnor 3y ago

Isn't it actually (at least) five things? 1. The Dockerfile specification 2. A tool to turn a Dockerfile into an OCI image (or actually, multiple tools, since we have "normal" docker and docker buildx) 3. A tool to run OCI images (I don't even know if this works for images not generated by docker) 4. Docker Desktop 5. Docker Hub

gjvc 3y ago

no mention of kernel namespaces, which actually enable this functionality. I wonder what proportion of people think that Docker enforces the separation between inside and outside a container.

TekMol 3y ago

Unfortunately it also is a daemon that constantly runs on your machine even when you don't use Docker at all. Which keeps all kind of mounts and virtual networks alive that you don't need and that interfere with other things you want to do. For example I was on a train in Germany recently and could not use the Wifi. Why? Turned out the docker daemon occupied the IP range the Train Wifi uses. While I was not using docker at all.

wwtdtgotiatl 3y ago
There's also the part where it starts punching holes in your firewall without even a peep about it to the user.

sigmonsays 3y ago

i feel like this author does not fully comprehend the topic (docker)... dockerfile is NOT declarative. "Docker Engine which takes a Dockerfile and runs it on a Linux host natively" no, not really, you have to build the dockerfile into a container. There is a lot of different steps between. This post is four things and i'll leave it to the reader to figure it out

jillesvangurp 3y ago

Docker is just one thing. Docker is a command that can build, fetch, and run docker images from a docker registry and orchestrates running those typically on a linux host or virtual machine. A docker image is a set of hashes that identify layers in a layered filesystem. A docker registry stores those layers and the docker looks up layers from the registry. The combined layers form a filesystem that is mounted when you run the docker image. A running docker image is called a docker container. To create a docker image with docker, you use a Dockerfile that specifies a sequence of steps that modify the layered file system, typically starting from a base image that is specified in the first line. The company Docker Inc. is a major contributor to the open source docker code base and also owns and runs a popular docker registry called Docker Hub, which is what the docker command uses as default place to look for docker images. While docker is popular, there are alternative tools that are able to run docker images. For example Kubernetes implements its own way to run docker images. Likewise, there are build tools that produce docker images without using the docker command or a Dockerfile. And the docker registry API is simple enough that you don't need docker to fetch layers either. Consequently, there are several popular tools in this space. That do similar things with varying degrees of compatibility. Many of these can run docker containers from Docker Hub.

chupasaurus 3y ago
Docker CLI without a daemon is useless hence it's far from just a command.
- LeFantome 3y ago
  Use Podman then. Now its just a command again.
chrisweekly 3y ago
> "Docker is just one thing." I think you meant to say "Docker is more than just one thing.", right?

firesteelrain 3y ago

I feel like I still don't understand what a container actually is.. is it a filesystem? is it an operating system? is it in a class of its own?

nrclark 3y ago
This is a big over-simplification, but I think it's a good mental model: Think of a container as a fancy chroot. Imagine that: 1. You have a whole separate Linux installation in some random folder. 2. You ask your OS to launch some process, and to "trick" the process into thinking that "$YOUR_FOLDER" is actually "/". 3. You maybe also ask your OS to add some extra isolation (network, devices, /proc, etc). 4. The term "container" refers to the chroot, the isolation rules, and usually the process-tree running inside of it. 5. While a container is alive, you can also ask the OS to run some other programs that exist inside of the container's sandbox Docker is a tool that creates and manages containers. In Docker's view of the world: - Containers are made by extracting .tar.gz files into some folder and asking the OS to create a sandbox where that folder is a "fake" root directory. - Those .tar.gz files are called "images". - Docker can download images from the internet, or you can build your own by asking it to follow the steps contained in a Dockerfile.
- firesteelrain 3y ago
  So a container is an easy way to deliver an entire software package with its own runtime environment?
  - nrclark 3y ago
    Sort of, yeah. An image is an easy way to deliver an entire software package. A container is the place where your image will run.
lifechoseme123 3y ago
The way I think of a container: It's an individual OS with a filesystem of its own, based on the "image" and what is pre-installed (such as an OS, plus, if you choose: some extras pre-installed based on your project need.). You can link your laptop or server (AKA your "host" computer) to it through Docker Volumes. And, you can link containers together through Docker Networks, for example. So, you can see how a single compartmentalized OS (a "container") can: 1. interact with another computer's file system and 2. interact with another computer on a network. And, each one can be quite customized. So, a container is an OS + filesystem* + network* * = can be connected to others to transfer data

jslakro 3y ago

Docker is an Engine and a Hub. The configuration file concept is common to any software which automatizes machine virtualization. The commercial emphasizes behind Desktop and the existence of alternatives like the CLI or Portainer, makes that part dispensable

oftenwrong 3y ago

Missing a mention of buildkit, which compiles various high-level build description languages (including Dockerfile) into a low-level build graph execution, which supports all of the bells and whistles of advanced build infrastructure, such as remote execution and remote caching. https://docs.docker.com/build/buildkit/ https://docs.docker.com/build/buildkit/ I am particularly interested in build systems, so I am biased, but I think this is one of the coolest things coming out of Docker. It is a bit painful to see so much fanfare at DockerCon about Docker Desktop stuff, and so few mentions of more foundational things like buildkit and rootless container support.

golergka 3y ago

As an aside, I love the design of this mini-blog format. And I really appreciate the author who says just one thing and doesn't have the need to generate walls of meaningless text to convey it.

pjmlp 3y ago

> Third, the Docker Desktop app which takes a Dockerfile and runs it on a Mac or Windows host, using a Linux virtual machine. Only if using Linux containers. Windows has native containers support.