Learn Docker by building a Microservice
dwmkerr.com
dwmkerr.com
> If you are on Mac or Windows, consider using a Virtual Machine. I use Parallels on Mac OS X to run an Ubuntu machine for most development activities. Being able to take snapshots, break things and then revert back is very handy when experimenting.
The beta will make is super easy to use Docker on Mac & Windows without running a heavy Virtual Machine. Here's a little video about it @ https://blog.docker.com/2016/03/docker-for-mac-windows-beta/. Basically, it feels like running Docker natively, has upgrade features build it, so you can choose to always be on the latest release (super nice). I've been using it for a few months and it is awesome to just type "docker run" on my macbook and have it work seamlessly (vs using third party virtual machine software and env bits). The idea is that you can develop on Mac & Windows using the same images you will eventually deploy. It just works (although I'm biased).
Disclaimer: Work for Docker.
> Unfortunately, Docker for Windows will only run on new versions of Windows 10. This is because Docker for Windows uses Windows Hyper-V and while older Windows versions have Hyper-V, their Hyper-V implementations lack features critical for Docker for Windows to work. [0]
I know this isn't what you want to hear but that is the current status.
[0] https://forums.docker.com/t/install-client-on-windows-7/1340...
email: troygoode@gmail.com
One question I have though is how useful is Docker for deploying production applications?
Firstly, can plain Docker be used for the whole setup or is something like Kubernetes required to tie the containers together?
Secondly, is there a performance hit when you use multiple Docker containers on the same server? Or should it be a one-to-one relation i.e. one container per as server? If so, why not just use plain servers with Chef or Puppet for server management?
These questions are assuming that I'm using my own servers - something like DigitalOcean or AWS. I'm not a huge fan of managed container services; it feels like there's too much "magic" going on behind the scenes.
Except for isolation there's no particular need to run one container per server - while there is a bit of overhead to running in containers my experience is that its offset by being able to run multiple services which don't require a lot of resources alongside each other on one server.
It's similar to elastic beanstalk in that it gives you a great pre-configured AWS architecture. But it's more transparent and configurable.
It also comes with a nice Docker based development environment that mimics production for dev / prod parity.
We have hundreds of production clusters and some at really large scale (300+ containers) so I can confidently say that Docker in production is largely solved on AWS.
k8s - great but for >>10 machines and you need a devops to watch and configure it + every configuration example on site is broken in one way or another. skydns is working for dns. has it's own overlay network.
nomad - great, but doesn't manage dns or network + i didn't get how to save it to file, only upload to nomad. What if it fails? Where cluster config is stored? May be it should be used with Terraform, but i did't like it. Thou for it's purposes it working good. Has concept of long running tasks and can run VM's
helios - i don't remember exactly why but i didn't like it. Something with configuration management. No network or dns.
maestro-ng - this is as raw as it gets. Basically docker compose. I was using it for a while, but it hit it's limits pretty fast. No network or dns.
rancher - after seeing it in action i fell in love. Beautiful UI (you can even view logs and start shell from web ui, and it works great!). Has DNS, manages your overlay network. Store configuration in mysql (i use amazon's rds with MZ). It has it's own perfectly capable scheduler - Cattle. And it can run k8s and mesos if you want it to. I highly recommend OpenVPN package that will connect you to internal overlay network and you will be able to work with services walled from outside world.
Said that i personally use RancherOS on t2.micro instances without any problems.
If you want to use k8s, I strongly suggest that you entirely ignore their own documentation and instead use the excellent documentation from CoreOS.
We evaluated it for a while, but discarded for various reasons, particularly the fact that it doesn't support private container registries [1].
I'd say Helios suffers from being an internal Spotify project. They're not under pressure to support any use cases except their own. For example, Helios is tightly coupled with Zookeeper, and they have rejected the possibility of supporting anything else (e.g., etcd). Their prerogative, of course.
Rancher is an orchestrator built on Docker. It handles scheduling of containers and certain auxilary objects (load balancers, for example) within that universe. Rancher builds on the Docker Engine and can integrate with things like Mesos and Kubernetes, but doesn't require anything else to get up and running; it comes with its own container scheduler.
Deis is an entire PaaS, designed to handle end-to-end deployment and hosting of apps. It requires Kubernetes to run, which is notoriously complex (even on Google's Cloud) and probably not worth the effort if you have a small number (some people say >10) machines.
Kubernetes makes some good design decisions. For example, you can kill the master and the cluster will continue to work just fine, except no scheduling will happen. You get some operational simplicity through how Kubernetes dedicates an IP to each container, too. Several other systems (including Rancher) make the mistake of relying on DNS to abstract the locations of services from clients, but Kubernetes dedicates a single, permanent IP to each service, which is then routed it at the network level. (In case you're curious, DNS is a huge mistake because it's almost never used correctly [1], and there are numerous Rancher issues filed that all stem from this design flaw.)
I wouldn't consider Kubernetes for simple setups, even on GCE, where it's "managed". (Scarequotes because GCE starts a master for you from a prebuilt VM image, but everything else is up to you; the only real UI is the standard one the master runs.) For smaller setups, you might want to consider a simpler solution such as Docker Compose, Docker Swarm or (once it's mature enough) Nomad.
Rancher is nice, but IMHO not ready for prdoctuon; it's much too unstable for an 1.0 release. I set it up to test recently, and within a few minutes I had encountered several serious bugs and several design flaws, including the fact that Rancher's load balancer (which is just HAProxy) loses traffic whenever it's reconfigured.
AWS has the EC2 Container Service (ECS), which is essentially a proprietary Docker scheduler that AWS preinstalls on your VMs. The consensus seems to be that it's one of Amazon's worst products, which my own brief attempt at playing with it confirmed.
Sorry about the long-winded reply, it got out of hand. :-)
[1] http://nerds.airbnb.com/smartstack-service-discovery-cloud/
For those learning, make sure you look into removing unused images and containers otherwise you might run into some issues a little farther down the road (eventually our builds started failing).
You can run docker rm and docker rmi to remove specific containers and images respectively, but we also found passing the --rm flag with docker run helped a lot as it removes a container after it exits.
Happy learning!
# Remove un-tagged or un-named images
for im in $(docker images | awk '/<none>/ { print $3 }'); do docker rmi $im; done
# Remove stopped containers
docker rm $(docker ps -a -q) docker rmi $(docker images -q -f dangling=true
docker volume rm $(docker volume ls -q -f dangling=true)
Nitpicking a bit on security, but root in a container is still root on the host right?
Recently docker introduced a --userns-remap flag for the daemon which allows interested users to define a user that "root" in containers should be mapped to. And it will also create one automatically if the flag is invoked without specifying one explicitly.
It's not on by default because of backwards compatibility issues. For one thing, bind mounts as most users rely on them today would likely break completely. But the option is there.
Curious why you wouldn't want to run it in docker in production? Wouldn't running the same container in dev/prod be helpful?
Given that, it seems production ready.
My curiosity was more in whether there were performance (or other) bottlenecks which made it technically infeasible.
So basically, I'd start a docker database container, it'd ask for a password and then decrypt and start the container and the database. When I shut down the machine and leave the office, I can then be sure the data in the container isn't readily available if someone breaks in a take the computer.
For those following along, I've noticed a few errors/typos, and maybe others in the thread caught them...
* Container ports are exposed like so, HOST_PORT:CONTAINER_PORT, or YOUR_MACHINE:DOCKER_VM. If you already have a mysqld instance running, then try using 3308:3306
* The /search route needs a "next" parameter in users.js:
"app.get('/search', (req, res, next) => {"
Where is the Science in using stuff other people have put together (and then written a detailed instruction on how to use it)?
And a lot of people, myself included, disagree. Docker is a huge step backwards because it is covering up the major underlying issues of package management. It's a sledgehammer solution to a problem for which more composable, elegant solutions exist.
Docker is one way to manage deployment better REGARDLESS of the quality of your software.
Are talking about something like NIX?
How do you handle other type of installs such as python pip?
Also, could such a package manager be used to deploy to clusters?
I'm not being facetious, I'm trying to understand your rationale for using a PM over Docker for similar use cases.
I wasn't trying to say that anyone who doesn't use Docker is an idiot; if that's how it came across, I'm sorry.
What could have been:
# imgadm install image-uuid
# vmadm create -f vm.json[1] https://wiki.smartos.org/display/DOC/Managing+Images#Managin...
[2] https://wiki.smartos.org/display/DOC/Using+vmadm+to+manage+v...
Also, the database setup is only the first part, it then goes on to show container linking and etc.
The complex startup he then continues to hack on is superfluous on SmartOS, as SmartOS has the service management facility for that. For brand new services, one XML file and svcadm import later, the thing is ready to be turned into an image, never to have to be revisited again.
I do not understand why people take the harder way to do the same thing (if there is no clear advantage to doing it the harder way). He picked MySQL, a database which is infamous for data corruption and bugs where basic SQL functionality does not work; the substrate, Ubuntu, provides no fault management architecture, no end-to-end data integrity, no post mortem kernel debugging and dynamic tracing facilities, which will eventually result in incidents in the dead of the night. Then there is the choice of Docker, which is really not designed to run a fully functional virtual server, but a single process in a single image (although it can run something akin to a virtual server, with lots and lots of extra system engineering put in). Why choose Docker, when with zones on SmartOS one can have a fully isolated, fully functional UNIX virtual server, but running at the speed of bare metal, and all of that in a single invocation of vmadm -f vm_definition.json (or use the SDC software, which puts a GUI on top of it all)?
If something more reliable and easier is available, why insist on doing it the harder way with an unreliable substrate? There appears to be no logic here, and if there is any, it escapes me. Is it lack of awareness of SmartOS, FMA, SMF, ZFS, and zones, or something else?
So can with Docker. The author simply chose to use a pre-built image instead.
The complex startup he then continues to hack on is superfluous on SmartOS, as SmartOS has the service management facility for that. For brand new services, one XML file and svcadm import later, the thing is ready to be turned into an image, never to have to be revisited again.
In Docker that's called a Dockerfile. It does exactly what you describe. Again, the author simply didn't do that.
He picked MySQL [and] Ubuntu
It's an example, does it really matter? Maybe the author is simply more familiar with it.
Why choose Docker, when with zones on SmartOS one can have a fully isolated, fully functional UNIX virtual server, but running at the speed of bare metal
The fully functional containers you've described have been available for Linux for years before SmartOS was first released, first as OpenVZ and then as LXC. Docker's approach is not a technical limitation, it's a deployment philosophy. They don't want fully functional UNIX servers, they want disposable stateless containers that can killed off and cloned.
If something more reliable and easier is available, why insist on doing it the harder way with an unreliable substrate? There appears to be no logic here, and if there is any, it escapes me. Is it lack of awareness of SmartOS, FMA, SMF, ZFS, and zones, or something else?
I suggest you then read up on Docker and the motivations behind its creation and popularity before suggesting that everyone in the thread is illogical and ignorant, because - and I say this as someone who doesn't really like Docker - your advocacy for SmartOS has a vibe of the infomercial from Family Guy: https://www.youtube.com/watch?v=5ysMt_9JnyI
Actually it does not, as SMF is part of the fault management architecture, which is part of the Solaris self-healing technology: unlike the Docker file, SMF will watch over services and restart them if necessary, if configuration files are specified as dependencies and they change, SMF will call the service's refresh method. Docker is just a delivery mechanism, whereas SMF is part of something bigger and far more powerful. SMF ties into FMA, which actually watches over not just software, but hardware down to the individual chips in the memory slots (when not running on virtual hardware). Even on zones, SMF provides the benefit of uniform diagnostics. Docker isn't designed for any of that, which is why he had to hack on the microservice setup.
> fmadm
Usage: fmadm [-P prog] [-q] [cmd [args ... ]]
fmadm config - display fault manager configuration
fmadm faulty [-afgiprsv] [-u <uuid>] [-n <max_fault>] - display list of faulty resources
fmadm flush <fmri> ... - flush cached state for resource
fmadm load <path> - load specified fault manager module
fmadm repaired <fmri>|label> - notify fault manager that resource has been repaired
fmadm acquit <fmri> [<uuid>] | label [<uuid>] | <uuid> - acquit resource or acquit case
fmadm replaced <fmri>|label - notify fault manager that resource has been replaced
fmadm reset [-s serd] <module> - reset module or sub-component
fmadm rotate <logname> - rotate log file
fmadm unload <module> - unload specified fault manager module
> svcs -xv bacula
svc:/site/bacula:sd (Bacula storage daemon)
State: online since Sat Apr 23 06:54:00 2016
See: man -M /opt/abcd/share/man -s 1M bacula-sd
See: /var/svc/log/site-bacula:sd.log
Impact: None.
svc:/site/bacula:fd (Bacula file daemon configuration)
State: online since Sat Apr 23 06:54:00 2016
See: man -M /opt/abcd/share/man -s 1M bacula-fd
See: /var/svc/log/site-bacula:fd.log
Impact: None.
svc:/site/bacula:dir (Bacula host specific configuration)
State: online since Sat Apr 23 06:54:00 2016
See: man -M /opt/abcd/share/man -s 1M bacula-dir
See: /var/svc/log/site-bacula:dir.log
Impact: None.
Actually no, since the "containers" are zones in SmartOS, and I've been using zones since 2006, when they first came out in Solaris 10 update 2. This was before OpenVZ and LXC.
Zones gave me virtual UNIX servers. Solaris containers gave me caps on those servers. Both came in one package back in 2006. SmartOS, being a freeware open source Solaris derivative leverages all that technology, plus a whole bunch more which neither Solaris nor GNU/Linux nor Docker have. Designed for exactly what the author of the original article was trying to hack up together, minus all the hacking.
Let me tell you, you are not doing smartos any favors.
People don't give a shit about how great you think smartos is. "smartos can do this", "smartos can do that". blah blah blah.
Do you know what the difference is between the posted link and your comments? The stuff in the article actually works, while your "look how simple it is" comment, does not:
[root@srv2 ~]# uname -a
SunOS srv2 5.11 joyent_20160504T205801Z i86pc i386 i86pc
[root@srv2 ~]# imgadm install image-uuid
imgadm install: error (Usage): unexpected args (1): "image-uuid"
[root@srv2 ~]# vmadm create -f vm.json
File: vm.json does not exist.
Their first command is basically
$ docker run -it --rm ubuntu
root@37ffd019060f:/#
And then you go on to say
> With SmartOS, the database image can be preconfigured and published into the catalog
> one XML file and svcadm import later, the thing is ready to be turned into an image, never to have to be revisited again
> a single invocation of vmadm -f vm_definition.json
So all you have to do is preconfigure things (how?), publish them into the catalog (whatever that is) and write both an xml and a json file (contents unknown) to start your service.
If you actually cared about getting people interested in smartos, you would write a "learn-smartos-by-building-a-microservice" article and show how to actually use the fucking thing instead of ranting how terrible docker is.
The usage I provided is a SYNOPSIS, as in synopsis from a manual page. You will note that mine is a comment, not an entire blog article (I do not have a blog).
The intent behind my comment is to provide a pointer to further exploration; it is not a how to document, but rather a starting point for those who are actually willing and able to sit down and read some documentation, which is in the links I provided, and will provide the equivalent of what the author's article does, and dividends on top of that. (Less incidents in the dead of the night equals long term dividends.) My intent was that someone will read it and go off to explore it.
That is not to say that I do not agree with your point, as I myself am a firm believer in examples which work. However, one must at some point have the experience to distinguish between a synopsis and a guide. A lone comment on Hacker News is not the place for an entire how to guide.
> Which anyone with docker installed can run.
Yes, but as with anything, there will be long term consequences: while anyone can get it up and running easily, when it comes time to put it in production, and the thing busts because there is no lifecycle management, no change management, no configuration management (sorry: dumping a bunch of files into a Docker "image" definition doesn't even come close to lifecycle management, or capability maturity model level 2[1]), no post mortem debugging facilities, no end-to-end data integrity, and performance penalty for running inside of a fully virtualized VM, the problems will start.
For example, MySQL was also "easy to set up", but that didn't change the fact that the software does not work correctly[2] and that MySQL deployments later caused many organizations many problems. Just because something is easy to set up does not mean it is a good solution to deploy. Nowadays people are realizing that and migrating to PostgreSQL because that software does work correctly, but all that time, effort and money spent because of how "easy" MySQL was to get going could have been prevented in the first place. With Docker and how it is designed, and based on what I know, I can see the same types of problems which will inevitably lead to outages. And in the interest of disclosure, what is it to me? Well, argumentum ad populum is extremely spread these days, which means that lots of jobs would (and have) started springing up with Docker, which means I would be forced to work with what I know from experience is inferior technology. Since I see the problems of Docker, that means I would not be able to sleep through the night, and spend my nights in conference calls with clueless managers demanding that I fix it. I do not want that; I want to sleep through my nights, and work with slick and reliable technology like SmartOS, not a toy like Docker causing me problems down the road, and just because it was popular.
You are making an indirect argumentum ad populum, which is never a good thing.
> If you actually cared about getting people interested in smartos, you would write a "learn-smartos-by-building-a-microservice" article and show how to actually use the fucking thing instead of ranting how terrible docker is.
If you had bothered to read the documentation in the links, you would have a pretty good idea on "how the fucking thing works", and how to build a microservice; I am sorry if you think that clicking on the links and reading through the articles is too much overhead. How is it then, that reading through that Docker article isn't overhead, and you had no problem clicking at that?
[1] https://en.wikipedia.org/wiki/Capability_Maturity_Model#Leve...