8 ms·
Bocker: Docker implemented in around 100 lines of Bash (2015)
- zoobab 2y agoI am looking for a bash script that can pull docker images (via curl) and run them via chroot. I don't need a seperate network nor process isolation.
- amelius 2y agoDoes it require root access to the machine I have a user account on?
- schmichael 2y agoYes, from the README: > Bocker runs as root and among other things needs to make changes to your network interfaces, routing table, and firewall rules. I can make no guarantees that it won't trash your system. Linux makes it quite hard to run "containers" as an unprivileged user. Not impossible! https://github.com/rootless-containers/rootlesskit https://github.com/rootless-containers/rootlesskit is one approach and demonstrates much of the difficulty involved. Networking is perhaps the most problematic. Your choices are either setuid binaries (so basically less-root as opposed to root-less) or usermode networking. slirp4netns is the state of the art here as far as I know, but not without security and performance tradeoffs.
- mschuster91 2y agoThe fact how simple it is to re-implement a large part of Docker because all it fundamentally is a bit of glue code to the kernel is the biggest problem Docker-the-company faced and still faces. Where Docker adds real value is not (just) Docker Hub but Docker for Windows and Mac. The integrations offer a vastly superior experience than messing around with VirtualBox and Vagrant by hand (been there, done that) to achieve running Docker on one's development machine.
- seabrookmx 2y agoRancher desktop is also a viable option and free. Many including my work moved to it after Docker's new licensing kicked in. IMO the real magic of Docker was the Docker/OCI image format. It's a brilliant way to perform caching and distribute container images, and it's really what still differentiates the workflow from "full" VM's.
- jml78 2y agoMy main dev machine is Linux so I use Rancher Desktop but I also have a MacBook Pro m1 machine. Orbstack is so much better than rancher and docker desktop. I know they are a small company but hell if their product isn’t significantly more efficient and better.
- throwaway817472 2y agoCompletely agree. I moved from docker desktop to rancher after an update blew away my kubernetes cluster, and then from Rancher to Orbstack due to a number of bugs that were crashing the underlying VM. Orbstack has been rock solid (aside from one annoying networking issue), and it uses significantly less battery. They’ve done a fantastic job.
- jml78 2y agoOnly complaint is that my home network assigns IPv6 addresses and that fucks up external dns lookups for pods in Orbstack.
- fl0id 2y agoPodman-Desktop is also great b/c it now has gpu support on macOS (for the Linux container)
- moogly 2y agoI could not get LocalStack to run on Podman (w/ Docker emulation), on Fedora, so had to go back to Docker.
- 2y ago
- aryonoco 2y agoDocker for Windows and Mac are both bloated pieces of software, outperformed by Rancher Desktop and Orbstack. Docker's only real innovation was the OCI format, which it had to give away for it to become an industry standard, and now doesn't own.
- hu3 2y agoDocker on Windows can use WSL2 engine for near native performance.
- maxloh 2y agoBut Rancher Desktop does the same too (and is also open source).
- magic_hamster 2y agoDocker Desktop on Mac is a handicapped, underprivileged mess. Docker cli for Mac with Colima is still underprivileged, but at least you can skip the bs license and Docker's gui. On Windows you can at least use Docker on WSL which works great. Why use Docker Desktop is beyond me.
- skissane 2y ago> Why use Docker Desktop is beyond me. I lived through a failed attempt to migrate from Docker Desktop for Mac to an open source alternative (minikube+portainer, IIRC). A lot of test scripts developers relied on – to run parts of the integration test suite on their laptops for debugging – broke, because Docker Desktop for Mac went to a lot of effort to make macOS look like you were running Docker on Linux, whereas the open source replacement wasn't as seamless. Some of these test scripts contained Java code directly talking to the Docker daemon over its Unix domain socket, so need the same API implemented. Many other scripts made heavy use of the Docker CLI. After spending a lot of time on it, it was decided to just go back to Docker Desktop for Mac. The failed migration had resulted in highly paid engineers spending time pulling their hair out trying to get test scripts to work instead of actually fixing bugs and delivering new features. Now, that was 2+ years ago now, and maybe the open source alternatives have caught up since, or maybe we picked the wrong one or made some other mistake. But I'm not rushing to try it again.
- nucleardog 2y agoThe reason Docker Desktop for Mac looks like you're running Docker on Linux is because... you are. It's running docker in a linux VM for you. Similar issues in our environment, and I managed to swap everything over to Rancher Desktop fairly seamlessly as it does the exact same thing. It runs a Linux VM and if you select the "dockerd (moby)" container engine it runs a copy of docker inside of it. So you get a socket with the same docker API implemented... because it's running actual docker. docker compose and everything else work as expected. The reason we switched is that Rancher Desktop, along with providing a convenient way to run docker, also includes a full k3s install in that same VM. So we can work on unifying some of our stack/configs on kubernetes rather than docker for local and kubernetes for everywhere else. It also opens up using upstream helm charts and things when a developer wants to deploy and try something locally. It's also free. Open source and backed by SUSE, who also develops and maintains the k3s distribution among other stuff in this space.
- acedTrex 2y agoI just use colima on macos, its a far better experience. Much lighter weight
- airstrike 2y agoDocker for Mac is just unusable. They're not really adding any value there.
- SadTrombone 2y agoHave you tried out Orbstack?
- Bnjoroge 2y ago+1 on orbstack. near-perfect drop in
- dilyevsky 2y agoNah, they should have prioritized building some sort of PaaS solution like CloudRun, Render or Fly so they can sell that to enterprises for $$$. Instead they did half-baked docker swarm which never really worked reliably and then lost ground to k8s rapidly
- jen20 2y agoDidn’t they buy at least one of these? It was garbage, and no one cared.
- smt88 2y agoDocker was a spinoff of an internal tool used to build exactly the type of PaaS you're describing. It was like a better Heroku and I loved it, but they shut it down when they focused on commercializing Docker itself.
- exceptione 2y agoI think Docker is really lucky that devs still think container=Docker. Podman is in many aspects superior, while still being able to function as a drop in.
- djmips 2y agoA lot of popular wealthy systems are 'easy' to re-implement. I thought the value was in Docker images? Or is that not how Docker is used? The only way I've used it is to be able to import someone's virtual build setup so I could build something from years ago.
- dcreater 2y agoVery interesting. With how standard containerization has become, we sorely need an FOSS solution
- MrDrMcCoy 2y agoWhy not podman?
- osigurdson 2y agoAgree. Not sure about mac but on Windows, Podman + WSL works well. No need for podman desktop either, the cli vwrsion is fine.
- wmf 2y agoIf Docker isn't open enough for you, check out Podman (now with extra CNCF).
- deleted 2y ago[deleted]
- hackernewds 2y agohow is docker open in any way? https://i.imgur.com/2F0JmUw.png https://i.imgur.com/2F0JmUw.png
- diggan 2y agoIn this way: https://imgur.com/a/PIkm7Eb https://imgur.com/a/PIkm7Eb
- mardifoufs 2y agoHow exactly is docker (buildkit, compose, the runtime, the daemon, etc) not open source? Docker desktop isn't, but that's almost entirely unrelated to the containerization technology that it uses or that people refer to when they talk about docker.
- ndsipa_pomu 2y ago
- random3 2y agoI love these. Been a fan of minimal bash stuff. Here's a proof of concept for a intra-cluster load balancer in 40 lines of bash done during a hackathon I organized to promote distributed infra with Docker, Mesos, etc. about a decade ago https://github.com/cell-os/metal-cell/blob/master/discovery/bash-lb.sh https://github.com/cell-os/metal-cell/blob/master/discovery/... I likely lost it, but I had a redundand and distributed reverse SSH tunnel based colo-to-cloud transfer tool. Shell Fu and others have good collections of these https://www.shell-fu.org/ https://www.shell-fu.org/
- taskforcegemini 2y agoshell-fu.org is great, would like to see comments of other users though
- yeldarb 2y agoIs there any Docker alternative on Mac that can utilize the MPS device in a container? ML stuff is many times slower in a container on my Mac than running outside
- habitue 2y agoThe issue you're running into is that to run docker on mac, you have to run it in a vm. Docker is fundamentally a linux technology, so first emulate x86_64 linux, then run the container. That's going to be slow. There are native macos containers, but they arent very popular
- AbuAssar 2y agoDocker can run ARM64 linux kernel, no need to emulate x86
- majormajor 2y agoYou still pay the VM penalty, though it's a lot less bad than it used to be. And the Arm MacBooks are fast enough that IME they generally compare well against Intel Linux laptops even then now. But it sounds like first-class GPU access (not too surprisingly) isn't there yet.
- fl0id 2y agoPodman-Desktop can do it
- yalogin 2y agoIs the original docker just a script? Have they not added anything to the container story themselves?
- kondro 2y agoIsn’t this how Docker started?
- mythz 2y agoSurprised no one's mentioned lazydocker as a great alternative for Docker Desktop (on Linux/macOS/Windows) [1]. It's a fairly full-featured Terminal UI that has the benefit of running over ssh: [1] https://github.com/jesseduffield/lazydocker https://github.com/jesseduffield/lazydocker
- orphea 2y agoLiterally a few days ago: https://news.ycombinator.com/item?id=42214873 https://news.ycombinator.com/item?id=42214873
- acka 2y agoLazydocker sure looks interesting, but self-promotional ads - for products in an entirely different space - in an OSS project's README.md? Seriously? At least for me it is the first time I have come across anything like this. I'm wondering if advertising like this is even allowed under GitHub's TOS and AUP.
- WanderPanda 2y agoMakes me wonder why docker still didn't make it to the ubuntu/debian repositories. Would be such an easy net benefit
- ddtaylor 2y ago(a) Docker wants to bundle vendor libraries instead of using other packages and (b) Canonical uses LXD and MicroK8s instead.
- notpushkin 2y agoWhat do you mean? It's been there for years: https://packages.debian.org/docker.io https://packages.debian.org/docker.io It’s an old version, and I think it isn’t supported by Docker Inc (for the reasons mentioned in the sibling comment), but it’s there.
- WanderPanda 2y agoDamn good to know! Have been gaslit by the ever-changing docker install instructions. Of course it would be a lagging version, but I think the docker feature-set has converged years ago, why would I care any more about the docker version than e.g. about the version of grep?
- djbusby 2y agoThe buildx/build and docker-compose vs 'docker compose' are recent updates.
- Neywiny 2y agoI like when repos say "not implemented yet" or "to-do" or "working on" and the last commit was years ago. Makes me feel better about not going back to my to-dos I drop through my code. (Not meaning to throw shade on this author, just finding it comforting)
- byearthithatius 2y agoGreat point! It is not shade at all, you are trying to normalize this which I like. For unpaid, volunteer, or hobby code feeling a _need_ because its public can make coding less fun or prevent people from sharing code publicly they otherwise would.
- ramon156 2y agoI feel like most — if not all — projects are never done. Knowing when to stop is important
- Neywiny 2y agoYeah it's weird, I feel like a repo is untrustworthy if it wasn't committed to in the past year but sometimes a project is just done. Now I'm actuality there would likely be work on my end to update it for integration with modern tools/devices, but there's a repo from 12 years ago I've been considering using. Maybe it'll just work, maybe it'll be trash.
- Brian_K_White 2y agoI think it's good. I guess it's possible for something to be simply done, and you don't always have to have a bunch of next ideas, but I generally always have next ideas. If there is always some next ideas then by definition you must always have todos that never get done. It should actually be the normal state of every single project.
- thanatos519 2y agoTotall ok! As soon as the program does what I want, and my task is complete, I stop developing. Software is not my hobby.
- 2y ago
- aussieguy1234 2y agoWhile not good for daily driving, this gives you an idea on what docker is and how it works. On Linux, docker is basically fancy chroot.
- musicale 2y agoOn macOS/Windows/etc., docker is basically fancy chroot in a linux VM.
- hks0 2y agoI did something (slightly) similar via proot, called Bag [1], which I must have not described as a docker alternative: It has nothing to do with cgroups, and the cli deviates from that of docker's. The backstory: To bypass internet censorship and deep packet inspection, I had written a proxy chain solution masquerading itself as plain html traffic. I needed it constantly running everywhere I went, but I didn't want to port it to a native android app. I wanted to run it through termux and at the time termux had no jdk/jre. Proot could spawn a archlinux env and there indeed was a jdk available. The arch env within termux turned out to be generally more suitable for all tasks. Creating and destroying ephemeral envs with different setups and prooting into them to just run a single command is easily automated with a script; I named it bag.sh, a drastically smaller form of a shipping container. Funny bag.sh also has a roadmap/todo in there untouched for 5 years! It's written on mobile screen hence mostly formatted to 40 columns lines to fit on the display without scrolling. [1]: https://github.com/hkoosha/bag https://github.com/hkoosha/bag
- dataflow 2y agoFYI, I think you forgot some important quotes in your script. Try shellcheck? > mkdir -p $(dirname "$2")
- jlokier 2y agoThat'll handle whitespace in paths, but if you want it to handle all path characters, dirname and mkdir need "--" here too.
- noufalibrahim 2y agoI guess a lot of us had stories like this. I needed to package a bunch of things into a single environment where a VM was unsuitable. I cooked up something using chroot, deb-bootstrap and make an installer using makeself. It created a mini debian inside /opt which held the software and all the dependencies I needed (mysql etc.). Worked pretty well and the company I made this for used it till they got acquired in 2016 or so. More generally though, implementing a crude version of a larger application is one of the best ways of learning how things work inside it. I'm a big fan of the approach.
- sellmesoap 2y agoA brother from another mother: https://bastillebsd.org/ https://bastillebsd.org/ Bastille manages jails using shell with many of the same constructs you'd find in docker. I like it over other jail management software in BSD because it has so few dependencies.
- sunshine-o 2y agoAbsolutely, it adds a lot of value for a shell script that is about 100 LoC. By the way it took me a while to get why it was named Bastille. As La Bastille was a castle built to defend Paris from English attacks during the Hundred Years' War, and then turned into a prison.
- mst 2y agoI'm also quite impressed by cbsd - shttps://www.bsdstore.ru/en/about.html https://www.bsdstore.ru/en/about.html - though that's more of a 'maximum overkill' solution in spite of being a CLI/TUI driven tool. Currently I'm going through a phase of building and managing jails with just the stuff in FreeBSD base, but that's entirely intended to only be a phase - it'll last until I have the way all of it fits together burned into my brain well enough to be confident debugging it, and then I'll stop banging rocks together and go back to using higher level tools like a sensible person :D
- noctane 2y agoPracticality aside, there seems to be a lot we can learn from the implementation.
- oneeyedpigeon 2y agoIf the author happens to see this: the link to your homepage on GitHub is broken - drop the "www."
- darkwater 2y agoI wonder why Bocker makes the frontpage so often. Is Docker still that controversial even in 2024? Why people don't recognize that it actually brought something useful (mainly, software distribution and easy of "run everywhere") to the table?
- delusional 2y agoIt's possible it's not climbing the front page to slight docker, but rather that people are seeing that docker is something useful and want to know how it works. Bocker can be an entrypoint into the technologies.
- outofpaper 2y agoYes it's a wonderful little read. Besides without volumes and port forwarding few would ever deploy this to production. The reason people use docker over Podman and rolling their own is because of the ecosystem and ubiquity of docker.
- UK-Al05 2y agoIt's just a learning tool to see how docker works. Docker is just a combination of kernel tech that already exists. Namespaces, cgroups, and union file systems and probably few others.
- ajross 2y agoExactly. "Docker" is boring, everyone uses it, everyone knows it, no one really wants to rewrite it (on Linux) except for parochial infighting or religious license reasons. But Linux containers[1] are actually fascinating stuff, really powerful, and (even for the Docker experts) poorly understood. The point of Bocker isn't "see how easy it is to rewrite Docker" it's "See how simple and powerful the container ecosystem is!". [1] Also btrfs snapshots, which are used very cleverly in Bocker.
- mst 2y agoI like doing similar tricks with zfs snapshots for containers on linux and jails on fBSD. (this is not intended to start a filesystem argument, I'm doing it with zfs because I already know zfs and it's available on both of the OSen I care about; if you already know btrfs and are only running things that support it, clearly you should use that for the exact same reasons ;)
- throawayonthe 2y ago[dead]
- xyst 2y agoThis was written in 2015, I think we can get this down to 69 lines or less in brainfuck
- ffk 2y agoFun fact: docker started as bash, then moved to python before settling on golang. Also, in a 2013 docker meetup, someone wrote a docker clone in bash. People want to learn! Hopefully things like this help them.
- MathMonkeyMan 2y ago> Because most distributions do not ship a new enough version of util-linux you will probably need to grab the sources from here and compile it yourself. Careful. The default installation prefix is /usr/bin, and the install will happily clobber your mount command with one that requires a library that doesn't exist. Then next time you boot, the kernel will mount the file system read-only.
- yazzku 2y agoShould also be be /usr/local/bin.
- nedt 2y agoTwo years ago I gave a presentation on how docker works under the hood. After trying to understand docker, moby and containerd and how they interact I was so happy to find Bocker. Pretty much show how it can be done while showing enough of the magic moves that docker itself is actually doing. Bocker is cups&balls with clear plastic cups by Penn and Teller for docker.