4 ms·

Help me understand why docker adds any value in prod? When I tried it, I got quickly frustrated with the "expose a single port" to the local OS. Sure, I could g

Help me understand why docker adds any value in prod? When I tried it, I got quickly frustrated with the "expose a single port" to the local OS. Sure, I could go ham on it and move ports around but where is the scale in that? If we are limited to 1 docker/VM seems like we waste more than we gain. Same problem in physical servers. Not trolling here, seriously interested in where people see value in the real world.

nickstinemates 13y ago
I'd love to spend some time with you if you're seriously interested. You can expose more than a single port to the local OS, so it sounds like your experience is frought with misunderstanding, which can only be characterized as our fault :) Reach out - nick@docker.com
mikebabineau 13y ago
The "one docker container per VM" is a Beanstalk-imposed constraint, not a Docker constraint. I think it's helpful to frame Docker in terms of encapsulation. Imagine a basic Java app with multiple dependencies. Rather than build a lean app.jar and rely on the host providing dependency1.jar and dependency2.jar, many folks package it all into a single app_with_dependencies.jar. But what if your app is a web app with static content? Rather than depending on the host system to serve the static content separately, many folks package it all into a single app_with_content.war. But what if your app needs a specific version of Java? Rather than depending on the host system to have the exact Java you need, folks are starting to package the app into a Docker image that has their desired Java version. Each layer of encapsulation simplifies server provisioning and thereby improves app portability. Taken to an extreme, you can treat your hosts as homogenous and run any Docker container from any server.
steinnes 13y ago
The "expose a single port" default suggestions always annoyed me a bit, the fact is that each docker gets an IP on a virtual ethernet interface and with the right routes in place can be accessed by anyone on the same network -- so obviously more ports can be exposed :-)
- dmourati 13y ago
  Aha! This is called advanced networking, yes? http://docs.docker.io/use/networking/ http://docs.docker.io/use/networking/ They didn't have this when I looked last summer.
  - steinnes 13y ago
    It's been a few months since I managed to dig into Docker for some test projects at work, but docker0 was the name of the virtual bridge interface so probably the documentation you linked is what we're going on about :-) I only started playing with Docker last December, and I think this was supported from that point in time, so definitely it could be a recent addition. Currently I'm envisioning Docker playing a nice role in our CI and development infrastructure at work, where we can choose to start a new docker for any given project, and get a locally accessible IP back in a matter of seconds ... all from our soon-to-be-created CI+deployment web ui ;-)
tszming 13y ago
IMO, docker is less useful when you are on a cloud platform like AWS since you already can pack and ship your application as AMI, they even have a marketplace for this: https://aws.amazon.com/marketplace https://aws.amazon.com/marketplace. One of the exceptions I can think of why you really need to run docker inside ec2 is you want to build a PaaS or something like memcached as a service, since it is expensive to give every customer to own a dedicated instance. Honestly, I would prefer to run as many small/medium instances rather than a powerful instance but to host many dockers inside it, because if you put all the eggs in one basket and when then host machine is down, you are having a bigger problem; if you host a single docker on an ec2 instance, and as I said before, you can already solve this via AMI without the overheads/abstraction. Of course, it is still very useful to run docker on a physical machine when you don't want to setup KVM or mess up with OpenStack.
- dmourati 13y ago
  Cool. This analysis is similar to my thoughts. Still trying to get educated and reached out to the docker fellow below for more info. Big fan of packer.io + AMI / Virtualbox / GCE for this. See generally: http://www.infoq.com/articles/virtual-panel-immutable-infrastructure http://www.infoq.com/articles/virtual-panel-immutable-infras...
- robszumski 13y ago
  Sounds like you might be a perfect candidate for CoreOS. fleet allows for single-purpose containers to move around a cluster. It supports all of the platforms that you mentioned (AWS, Openstack, KVM and bare metal).
- benjaminwootton 13y ago
  Docker is massively more lightweight than shipping AMIs. - We build hundreds if not thousands of docker images a day after each CI commit. Thats not viable with virtual machines or AMIs. - Docker has the union file system, so pushes and pulls of Docker images after each CI build are tiny; - Docker is more platform independent whereas AMIs are very EC2 specific. No other cloud provider have anything as sophisiticated as AMI; - Rollbacks are instant with Docker; Docker can also be used in conjunction with autoscaling and resilience. We have 10+ containers on a box, but still replicate this 5 or 6 times and will possibly add EC2 AutoScaling in future. Cloud and Docker are complementary not an alternative in my opinion.
benjaminwootton 13y ago
One docker / VM is not a Docker restriction - more a restriction of this AWS offering. Was one port exposed a legacy restriction on Docker? It's not the case now - you can expose many ports to the OS, and then map them as you wish. This is actually a massive benefit. We might deploy 10 containers to one box all exposing SSH port on 22 and HTTP port on 80, but then at runtime choose which port the OS exposes and map 10 different ports onto 22/80 in the containers. The real value I find of Docker in production is the deployments - fast, repeatable, easy to rollback. Once they're on a box, it's much of a muchness once you've mapped the ports.
- dmourati 13y ago
  Please explain the port mapping in more detail. For example, let's say I want to run N containers on one host OS. Each of the N containers exposes port 80. How do you do the mapping?
  - benjaminwootton 13y ago
    So you have one image exposing port 80. You create say 3 instances of that image (i.e. 3 containers) with different port mappings 5001:80, 5002:80, 5003:80. These are just specified at the command line (docker run -p5001:80) Against the same containers you might also do 6001:22, 6002:22, 6003:22 to expose SSHD to different ports on the host. This allows you to defer the decision of which containers will be listening where to deployment or runtime, giving you lots of flexibility.
    - dmourati 13y ago
      Thank you. OK, how does a client outside of my docker host know to connect to 5001 to get to container1 port 80 and 6001 to get to container1 port 22? BTW, this was the scenario I mentioned initially as "I could go ham on it and move ports around." Thanks again for the reply, getting somewhere.
      - benjaminwootton 13y ago

nickstinemates 13y ago

I'd love to spend some time with you if you're seriously interested. You can expose more than a single port to the local OS, so it sounds like your experience is frought with misunderstanding, which can only be characterized as our fault :) Reach out - nick@docker.com

mikebabineau 13y ago

The "one docker container per VM" is a Beanstalk-imposed constraint, not a Docker constraint. I think it's helpful to frame Docker in terms of encapsulation. Imagine a basic Java app with multiple dependencies. Rather than build a lean app.jar and rely on the host providing dependency1.jar and dependency2.jar, many folks package it all into a single app_with_dependencies.jar. But what if your app is a web app with static content? Rather than depending on the host system to serve the static content separately, many folks package it all into a single app_with_content.war. But what if your app needs a specific version of Java? Rather than depending on the host system to have the exact Java you need, folks are starting to package the app into a Docker image that has their desired Java version. Each layer of encapsulation simplifies server provisioning and thereby improves app portability. Taken to an extreme, you can treat your hosts as homogenous and run any Docker container from any server.

steinnes 13y ago

The "expose a single port" default suggestions always annoyed me a bit, the fact is that each docker gets an IP on a virtual ethernet interface and with the right routes in place can be accessed by anyone on the same network -- so obviously more ports can be exposed :-)

dmourati 13y ago
Aha! This is called advanced networking, yes? http://docs.docker.io/use/networking/ http://docs.docker.io/use/networking/ They didn't have this when I looked last summer.
- steinnes 13y ago
  It's been a few months since I managed to dig into Docker for some test projects at work, but docker0 was the name of the virtual bridge interface so probably the documentation you linked is what we're going on about :-) I only started playing with Docker last December, and I think this was supported from that point in time, so definitely it could be a recent addition. Currently I'm envisioning Docker playing a nice role in our CI and development infrastructure at work, where we can choose to start a new docker for any given project, and get a locally accessible IP back in a matter of seconds ... all from our soon-to-be-created CI+deployment web ui ;-)

tszming 13y ago

IMO, docker is less useful when you are on a cloud platform like AWS since you already can pack and ship your application as AMI, they even have a marketplace for this: https://aws.amazon.com/marketplace https://aws.amazon.com/marketplace. One of the exceptions I can think of why you really need to run docker inside ec2 is you want to build a PaaS or something like memcached as a service, since it is expensive to give every customer to own a dedicated instance. Honestly, I would prefer to run as many small/medium instances rather than a powerful instance but to host many dockers inside it, because if you put all the eggs in one basket and when then host machine is down, you are having a bigger problem; if you host a single docker on an ec2 instance, and as I said before, you can already solve this via AMI without the overheads/abstraction. Of course, it is still very useful to run docker on a physical machine when you don't want to setup KVM or mess up with OpenStack.

dmourati 13y ago
Cool. This analysis is similar to my thoughts. Still trying to get educated and reached out to the docker fellow below for more info. Big fan of packer.io + AMI / Virtualbox / GCE for this. See generally: http://www.infoq.com/articles/virtual-panel-immutable-infrastructure http://www.infoq.com/articles/virtual-panel-immutable-infras...
robszumski 13y ago
Sounds like you might be a perfect candidate for CoreOS. fleet allows for single-purpose containers to move around a cluster. It supports all of the platforms that you mentioned (AWS, Openstack, KVM and bare metal).
benjaminwootton 13y ago
Docker is massively more lightweight than shipping AMIs. - We build hundreds if not thousands of docker images a day after each CI commit. Thats not viable with virtual machines or AMIs. - Docker has the union file system, so pushes and pulls of Docker images after each CI build are tiny; - Docker is more platform independent whereas AMIs are very EC2 specific. No other cloud provider have anything as sophisiticated as AMI; - Rollbacks are instant with Docker; Docker can also be used in conjunction with autoscaling and resilience. We have 10+ containers on a box, but still replicate this 5 or 6 times and will possibly add EC2 AutoScaling in future. Cloud and Docker are complementary not an alternative in my opinion.

benjaminwootton 13y ago

One docker / VM is not a Docker restriction - more a restriction of this AWS offering. Was one port exposed a legacy restriction on Docker? It's not the case now - you can expose many ports to the OS, and then map them as you wish. This is actually a massive benefit. We might deploy 10 containers to one box all exposing SSH port on 22 and HTTP port on 80, but then at runtime choose which port the OS exposes and map 10 different ports onto 22/80 in the containers. The real value I find of Docker in production is the deployments - fast, repeatable, easy to rollback. Once they're on a box, it's much of a muchness once you've mapped the ports.

dmourati 13y ago
Please explain the port mapping in more detail. For example, let's say I want to run N containers on one host OS. Each of the N containers exposes port 80. How do you do the mapping?
- benjaminwootton 13y ago
  So you have one image exposing port 80. You create say 3 instances of that image (i.e. 3 containers) with different port mappings 5001:80, 5002:80, 5003:80. These are just specified at the command line (docker run -p5001:80) Against the same containers you might also do 6001:22, 6002:22, 6003:22 to expose SSHD to different ports on the host. This allows you to defer the decision of which containers will be listening where to deployment or runtime, giving you lots of flexibility.
  - dmourati 13y ago
    Thank you. OK, how does a client outside of my docker host know to connect to 5001 to get to container1 port 80 and 6001 to get to container1 port 22? BTW, this was the scenario I mentioned initially as "I could go ham on it and move ports around." Thanks again for the reply, getting somewhere.
    - benjaminwootton 13y ago