Docker's Dirty Little Secret | Hacker News Reader

Docker's Dirty Little Secret

blog.altometrics.com

6 pointsdwighttk13 comments

There's nothing dirty or secret about this. The whole point of docker is to be lighter weight than VM, because you're sharing a kernel with the host. It's no surprise, then, that you can't run a container with an OS using a different kernel from the host.

Author here. Thanks for your comment. I figured this would be obvious to some.

Question: do you know of a good resource that describes docker in these terms, such that what I wrote about isn't surprising?

The official architecture page [1] doesn't illuminate this issue. To be fair, it isn't super relevant—so long as you run Linux, OS X, or Windows. When you run alternative OS's, though, it becomes pretty important.

[1] https://docs.docker.com/engine/understanding-docker/

All OSes that are not Linux are alternative OSes. Even Windows and OS X are running docker under virtualization one way or another (docker machine or the more recent virtualization shims).

No, Docker can run Windows containers natively, although this has not been officially released quite yet it is a preview.

On Linux, Docker uses cgroups to isolate resources. Cgroups is a feature of the Linux kernel. Cgroups are almost ten years old.

Docker on FreeBSD utilizes the Linux compatibility layer. It was introduced in 2015. It is officially experimental.

https://wiki.freebsd.org/Docker

To me, none of this is obvious and my limited understanding has taken several years and many hours of podcast listening and technical reading. I still don't know squat.

> Docker on FreeBSD utilizes the Linux compatibility layer. It was introduced in 2015. It is officially experimental.

Huh!? I remember running unmodified Linux binaries on FreeBSD (and other BSDs) in the late 90s. Maybe it was not suitable for most docker images and that started last year...

Per the link, Docker [the subject of the thread] is experimental on FreeBSD.

I agree. It's more along the lines of:

Terms and Conditions apply. Not available in all markets. Your mileage may very. Discount may not be combined with other offers. Limit five per customer. Participating stores only.

It's an amazing technology. It's a useful technology. It's still brittle and complicated and not a silver bullet. The impedance mismatch between the level of technical knowledge required to understand containers and their implementation and the availability and promotion of Docker as "just another app" will invariably create these problems.

Docker, the company, promotes Docker the product as easy to use. That's true for some definitions of "easy". It is true for fewer as Docker the product captures more mainstream users. To put it another way, the point of Docker, the product, is to be lighter weight than a VM. The complexities of sharing a kernel are implementation details. Ideally users would not encounter them unexpectedly. In fairness to Docker, the company, assuming comfort with technical complexity among BSD users is not a long reach.

This is of course also true of linux running on a different architecture such as power, you need specific images that are built for that architecture.

I wonder if the author noticed that none of his docker images were actually running on Mac OS...

TL;DR: Containers are containers, and not virtual machines. In other shocking news: Water is still wet.

The clickbait is real with this one. Nothing shocking or "secret" here that a 30 second skim of the documentation wouldn't reveal.

Author here. Apologies if this came across as clickbait. Would you point to said documentation? I haven't been able to find the parts that illuminate this issue, including on the official architecture page [1]. Thanks!

https://docs.docker.com/engine/understanding-docker/

Docker [the technology not the company] has reached a level of success where it is discussed and used by people who are not aware of the technical details of its implementation. It is entirely practical to use Docker without ever visiting Docker's official documentation.

Because Docker is an alternative to the virtual machines with which people tend to have more experience, it is normal for people to fill holes in their knowledge with facts about VM's. Much of the time, this works.

I don't think the title is great, but I think more than anything else it reflects frustration with the complexity of containers and normal disappointment with things that at first appear to be silver bullets.

The future is already here -- it's just not very evenly distributed. -- William Gibson

Reply on news.ycombinator.com