4 ms·

What value does Docker add if you are already running a VM? Are the laptops Linux, so Docker provides a lighter alternative to a full vm environment?

by mattip 12y ago

zrail 12y ago
The laptops are Macbook airs and were not running a VM at all. Instead, users had a script they could double click to launch the application in a terminal window. Now the laptops run the VirtualBox setup and always have the application running in the background. Docker adds value by letting us distribute a much smaller amount of data vs sending out an entire VM image. For the Windows server, we used to distribute upgrades by sending out an entire VirtualBox appliance image, which was usually around 3GB. Additionally, the operator would have to manually shuffle data between the old and new images. Now, we can ship out an saved Docker image (built with `docker save`) which cuts down on the amount of data transferred, and the final VM we shipped him knows how to upgrade the Docker container and shuffle the data automatically.
- vidarh 12y ago
  I'm curious about a couple of things: - Are you/have you tried using "FROM" and layering things in multiple images to reduce what you need to keep shipping? - Anything stopping you from using a private registry? I'm running one at it seems to work quite well (with the caveat that it's annoying to have to specify the registry all the time). - You talk about "shuffling the data". Does that mean you're not using volumes to keep the data separate from the container? If so, any particular reason?
  - zrail 12y ago
    1) We've talked about it but it's not a blocker so we haven't done it yet. Right now we're trying to reduce the number of layers we ship, since they seem to get big for no good reason. 2) We're using a private Docker Hub account to transfer images to the laptops. They have a script that the users can invoke that shuts down the container, updates, runs some initialization tasks (`db:migrate` + some other stuff) and then brings the container back up. 3) Yep, we're using mounted shared directories in both cases. Previously the laptops of course just stored everything on the local filesystem since they were running the app directly. I'm not 100% sure what the Windows server was doing, but I believe the operator had to move data from one share to another and run initialization tasks by hand.
    - vidarh 12y ago
      Thanks. Sounds like an interesting setup. I'm rolling out Docker in a couple of settings, but so far all "conventional" server settings.
bensn 12y ago
It simplifies the building and deployment process for the application. You can install the new version of the application in a Docker Container and just push the changes of Container to all your clients. You can do the same thing for changes in the infrastructure which is needed to run your application. Just deploy the changes.
jjd1103 12y ago
Docker also enforces immutability. With a VM there's always the temptation to manually fix any issue that arises, and if you don't have some bulletproof way to document that then you'll have issues when you go to recreate the environment on a new machine. Docker kind of forces you to solve the original problem via the dockerfile, which is what will spawn images for any future installs anyway.
- cpt1138 12y ago
  Could you explain this more? I think my confusions stems from where the config comes from. Regardless of whether I have a bit-for-bit image or a vm created from a bunch of script commands, the immutability disappears when I apply the config. So for my example If I have a role that specifies one instance of a a galera server. I have to config each one with the other servers in the pool. And each config will be dependent on the other server's config. So is Docker the first part (get the galera server instance running) and then there is some 2nd part that does the config so the instances in the cluster work together?
  - jjd1103 12y ago
    To your first question: for me it's a on-paper vs reality difference. On paper you're exactly right re "vm created from a bunch of script commands" will end in the same state. The reality is that once the VM is built there is the temptation/opportunity to make ad-hoc changes for any variety of reasons. Those ad-hoc changes sometimes make it back into the official build process, but sometimes they get forgotten in the heat of the moment. With docker you can't do this...to make the necessary change you are also changing the official build process. No opportunity for the two to deviate. Second question: Yes, that is my understanding (though not a use case I have atm).
- zwischenzug 12y ago
  Only true if you don't go to the network: http://zwischenzugs.wordpress.com/2014/07/16/phoenix-deployment-pain-and-win/ http://zwischenzugs.wordpress.com/2014/07/16/phoenix-deploym...
ewindisch 12y ago
What value does adding a user add if you're already running a VM? By default, all that user adds is directory-access-controls. Docker provides isolation between processes on the system it is running. Executing a root exploit from inside a Docker container is not impossible, but it's also harder than "simply" being a user. Application-level security can also be improved significantly if an application requires multiple processes to run on a host. Docker can be used to restrict processes from accessing the network, etc. Nothing that couldn't be done without Docker by a sufficiently dedicated ops team, I'll admit, but Docker greatly simplifies and standardizes these mechanisms. That's especially true if you've adopted DevOps culture where developers have come to own more of the systems security.

What value does Docker add if you are already running a VM? Are the laptops Linux, so Docker provides a lighter alternative to a full vm environment?

by mattip 12y ago

What value does Docker add if you are already running a VM? Are the laptops Linux, so Docker provides a lighter alternative to a full vm environment?

zrail 12y ago

The laptops are Macbook airs and were not running a VM at all. Instead, users had a script they could double click to launch the application in a terminal window. Now the laptops run the VirtualBox setup and always have the application running in the background. Docker adds value by letting us distribute a much smaller amount of data vs sending out an entire VM image. For the Windows server, we used to distribute upgrades by sending out an entire VirtualBox appliance image, which was usually around 3GB. Additionally, the operator would have to manually shuffle data between the old and new images. Now, we can ship out an saved Docker image (built with `docker save`) which cuts down on the amount of data transferred, and the final VM we shipped him knows how to upgrade the Docker container and shuffle the data automatically.

vidarh 12y ago
I'm curious about a couple of things: - Are you/have you tried using "FROM" and layering things in multiple images to reduce what you need to keep shipping? - Anything stopping you from using a private registry? I'm running one at it seems to work quite well (with the caveat that it's annoying to have to specify the registry all the time). - You talk about "shuffling the data". Does that mean you're not using volumes to keep the data separate from the container? If so, any particular reason?
- zrail 12y ago
  1) We've talked about it but it's not a blocker so we haven't done it yet. Right now we're trying to reduce the number of layers we ship, since they seem to get big for no good reason. 2) We're using a private Docker Hub account to transfer images to the laptops. They have a script that the users can invoke that shuts down the container, updates, runs some initialization tasks (`db:migrate` + some other stuff) and then brings the container back up. 3) Yep, we're using mounted shared directories in both cases. Previously the laptops of course just stored everything on the local filesystem since they were running the app directly. I'm not 100% sure what the Windows server was doing, but I believe the operator had to move data from one share to another and run initialization tasks by hand.
  - vidarh 12y ago
    Thanks. Sounds like an interesting setup. I'm rolling out Docker in a couple of settings, but so far all "conventional" server settings.

bensn 12y ago

It simplifies the building and deployment process for the application. You can install the new version of the application in a Docker Container and just push the changes of Container to all your clients. You can do the same thing for changes in the infrastructure which is needed to run your application. Just deploy the changes.

jjd1103 12y ago

Docker also enforces immutability. With a VM there's always the temptation to manually fix any issue that arises, and if you don't have some bulletproof way to document that then you'll have issues when you go to recreate the environment on a new machine. Docker kind of forces you to solve the original problem via the dockerfile, which is what will spawn images for any future installs anyway.

cpt1138 12y ago
Could you explain this more? I think my confusions stems from where the config comes from. Regardless of whether I have a bit-for-bit image or a vm created from a bunch of script commands, the immutability disappears when I apply the config. So for my example If I have a role that specifies one instance of a a galera server. I have to config each one with the other servers in the pool. And each config will be dependent on the other server's config. So is Docker the first part (get the galera server instance running) and then there is some 2nd part that does the config so the instances in the cluster work together?
- jjd1103 12y ago
  To your first question: for me it's a on-paper vs reality difference. On paper you're exactly right re "vm created from a bunch of script commands" will end in the same state. The reality is that once the VM is built there is the temptation/opportunity to make ad-hoc changes for any variety of reasons. Those ad-hoc changes sometimes make it back into the official build process, but sometimes they get forgotten in the heat of the moment. With docker you can't do this...to make the necessary change you are also changing the official build process. No opportunity for the two to deviate. Second question: Yes, that is my understanding (though not a use case I have atm).
zwischenzug 12y ago
Only true if you don't go to the network: http://zwischenzugs.wordpress.com/2014/07/16/phoenix-deployment-pain-and-win/ http://zwischenzugs.wordpress.com/2014/07/16/phoenix-deploym...

ewindisch 12y ago

What value does adding a user add if you're already running a VM? By default, all that user adds is directory-access-controls. Docker provides isolation between processes on the system it is running. Executing a root exploit from inside a Docker container is not impossible, but it's also harder than "simply" being a user. Application-level security can also be improved significantly if an application requires multiple processes to run on a host. Docker can be used to restrict processes from accessing the network, etc. Nothing that couldn't be done without Docker by a sufficiently dedicated ops team, I'll admit, but Docker greatly simplifies and standardizes these mechanisms. That's especially true if you've adopted DevOps culture where developers have come to own more of the systems security.