4 ms·

Clunky overhead from Docker? Sorry, but you've got no idea what you're talking about. You can also run OSI images, often called docker images directly via sys

• hello0904 2y ago
  I have no idea what I am talking about? Docker is literally adding middleware between your Linux system and app. That doesn't necessarily mean there aren't Pro's to Docker, but one Con to Docker is - it's absolutely overhead and complexity that is not necessary. I think one of the most powerful features of Docker by the way is Docker Compose. This is the real superpower of Docker in my opinion. I can literally run multiple services and apps in one VPS / dedicated server and have it manage my network interface and ports for me? Uhmmm...yes please!!!! :)
  • ffsm8 2y ago
    O rly, pray tell, which middleware? Your most powerful feature is literally a hostfile that docker generates on container start that's saved at /etc/hosts + Iptables rules Edit: and if you don't want them, use Network-Mode: host and voila, none of that is generated
  • neilalexander 2y ago
    Docker's runtime overheads on Linux are tiny. It's pretty much all implemented using namespaces, cgroups and mounts which are native kernel constructs.
    • hello0904 2y ago
      Well designed, written and efficient...middleware. It's a wrapper around linux and a middle between my OS and my app! A spade is a spade. There are cons beyond performance. For example Docker complexity - you need to learn a new filetype, a new set of commands, a new architecture, new configurations, spend hours reading another set of documentation. Buy and read another 300 page O'Reily book to master and grasp something that again has Pro's and Con's. For me? It's not necessary and I even know some Docker Kung-Fu but choose not to use it. I do use Docker Desktop occasionally to run apps and services on my localhost - it's basically a Docker Compose UI, and I really enjoy it.
      • ownagefool 2y ago
        A wrapper CLI that produces the same outcome wouldn't really be considered middleware, which surely should affect runtime?
      • selfmodruntime 2y ago
        > It's a wrapper around linux and a middle between my OS and my app No. Docker doesn't "wrap" anything, and it certainly does not wrap Linux. Please reconsider looking at the documentation. It uses native kernel features. SystemD does a similar thing. > For example Docker complexity - you need to learn a new filetype, a new set of commands, a new architecture, new configurations, spend hours reading another set of documentation I can't say I agree.
      • icedchai 2y ago
        Docker is native Linux. Your app uses the same kernel as the host. Is "chroot" middleware? No. Neither is docker.
        • consteval 2y ago
          It does require a running daemon. Other solutions, like podman, do not. There is an overhead associated with docker.
          • icedchai 2y ago
            Yes, but containers do not incur overhead because of the daemon. It is there for management purposes. In other words, system calls / network access / etc are not going "through" the daemon.
  • PhilipRoman 2y ago
    >have it manage my network interface and ports for me ...and bypass the host firewall by default unless you explicitly bind stuff to localhost :-/ I don't particularly love or hate docker, but when I realized this, I decided to interact with it as little as possible for production environments. Such "convenient" defaults usually indicate that developers don't care about security or integrating with the rest of the system.
  • selfmodruntime 2y ago
    > Docker is literally adding middleware between your Linux system and app. Not really, no. Docker just uses functionality provided by the Linux kernel for its exact use case. It's not like a VM. > it's absolutely overhead and complexity that is not necessary. This is demonstratively wrong. Docker introduces less complexity compared to system native tools like Systemd or Bash. Dockerfiles will handle those for you. > I have no idea what I am talking about I wouldn't say that. You seem to have strong puritarian opinions tough.
• otabdeveloper4 2y ago
  > docker doesn't create an overhead by itself Yes it does, the Docker runtime (the daemon which runs under root) is horribly designed and insecure.
  • Timber-6539 2y ago
    Insecure in what way? Rootful docker is a mature product that comes with seccomp and standard apparmor policies ootb!
    • otabdeveloper4 2y ago
      It runs as root, requires sudo to use, turns off all system firewalls, and has no way of doing security updates for containers.
      • Timber-6539 2y ago
        > It runs as root A lot of system applications on a standard Linux machine run as root or run with rootful permissions. This problem is solved by sandboxing, confining permissions and further hardening. > requires sudo to use Yes. However, this is a security plus and not a disadvantage. > turns off all system firewalls This statement makes no sense. > has no way of doing security updates for containers. I don't know what you mean by this.
  • throwaway894345 2y ago
    There isn't a "Docker runtime", and the daemon is not a runtime any more than systemd is a runtime. They're both just managing processes. If you want to argue that Docker containers have an overhead, you could maybe argue that the Linux kernel security features they employ have an additional overhead, but that overhead is likely to be marginal compared to a less secure approach and moreover since you're Very Concerned About Security™ I'm sure you would prefer to pay the security cost.
    • otabdeveloper4 2y ago