3 ms·

> At sufficient scale, they are pretty much correct. You grab Y bare metal hosts and spin up X docker containers for X processes. Can you elaborate why they ar

> At sufficient scale, they are pretty much correct. You grab Y bare metal hosts and spin up X docker containers for X processes. Can you elaborate why they are correct with this view? What is inherently superior about 1 process per container? What is wrong with having two cooperating processes per container? And why should Docker containers only run on bare metal?

vidarh 12y ago
The overall idea is to apply the principle of least privilege. If each process run in its own set of namespaces, and only can only access exactly what it is meant to, then the container configuration is explicit documentation of dependencies, and you also reduce attack surfaces. As for running on bare metal, I don't think the implication is they always better, but that if your goal is huge scale minimizing the number of layers is better for efficiency (though not necessarily better for other things - e.g. you may want to group/sandbox some containers in VMs for increased security)
opendais 12y ago
> Can you elaborate why they are correct with this view? What is inherently superior about 1 process per container? At sufficient scale, horizontally scaling is complicated and involves implementing the things I avoid until I have no choice [Dynamic Service Discovery on a per-process basis, etc.]. I'm mostly deferring to stuff I've read about it since I haven't really worked at companies that are larger than $XX million a year. It generally is things like principle of least privilege, the fact you already have to bite the bullet on managing your service discovery through yet another tool, etc. Personally, I've never dealt with anything larger than 2-3 datacenter locations with a rack of equipment in each. > And why should Docker containers only run on bare metal? That you can just ignore. I really just meant don't do: bare metal -> Spin up Xen VM -> Spin up docker containers Any of these are valid imo: AWS -> Docker Containers Bare metal -> Docker Containers [Insert hosting option X] -> Docker Containers
superuser2 12y ago
> And why should Docker containers only run on bare metal? The "point" of Docker is to be a lightweight replacement for virtualization in some cases. Layering Docker on top of virtualization, while fine, adds layers rather than removing/replacing them.

vidarh 12y ago

The overall idea is to apply the principle of least privilege. If each process run in its own set of namespaces, and only can only access exactly what it is meant to, then the container configuration is explicit documentation of dependencies, and you also reduce attack surfaces. As for running on bare metal, I don't think the implication is they always better, but that if your goal is huge scale minimizing the number of layers is better for efficiency (though not necessarily better for other things - e.g. you may want to group/sandbox some containers in VMs for increased security)

opendais 12y ago

> Can you elaborate why they are correct with this view? What is inherently superior about 1 process per container? At sufficient scale, horizontally scaling is complicated and involves implementing the things I avoid until I have no choice [Dynamic Service Discovery on a per-process basis, etc.]. I'm mostly deferring to stuff I've read about it since I haven't really worked at companies that are larger than $XX million a year. It generally is things like principle of least privilege, the fact you already have to bite the bullet on managing your service discovery through yet another tool, etc. Personally, I've never dealt with anything larger than 2-3 datacenter locations with a rack of equipment in each. > And why should Docker containers only run on bare metal? That you can just ignore. I really just meant don't do: bare metal -> Spin up Xen VM -> Spin up docker containers Any of these are valid imo: AWS -> Docker Containers Bare metal -> Docker Containers [Insert hosting option X] -> Docker Containers

superuser2 12y ago

> And why should Docker containers only run on bare metal? The "point" of Docker is to be a lightweight replacement for virtualization in some cases. Layering Docker on top of virtualization, while fine, adds layers rather than removing/replacing them.