Hacker News Reader

Comment by jitl | Hacker News Reader

Astute. I was trying to use jails for development in kinda a proto-Docker setup, where my apps each ran in their own BSD jail. I struggled to put the pieces together to set up the jails, share a “base jail” with ZFS, forward ports, etc. I had scripts for messing with my pf rules to add port forwards, other scripts to update/apply config inside a jail... it was more frustrating to automate creating and destroying “immutable” jails, than maintaining a pet per app I developed... until I messed up an environment, and just abandoned the project!

I think we’ll see the same sort of thing happening with FaaS frameworks, or any of the layers building on top of Swarm/Kubernetes/Mesos.

View on HN

Yeah, if you want to use jails or any container-type technology on your own to use for application deployments, then you have to write a ton of scripts for creating, managing, and destroying them. I'd rather use someone's pre-existing set of scripts for that. And I am. It's called Docker.

To me, asking why people are using Docker instead of plain jails combined with a series of other technologies is like asking why people make buildings out of wooden planks instead of trees. The question seems a bit wrong, because Docker is just built on existing container technologies. And I'd rather save a few steps. Planks are the exact shape and size that I want to deal with when building an application anyway.

Really? I've found iocage to work very well and combined with Ansible's jail support creating new jails is pretty darn easy. In terms of networking I created another loopback interface and assign each jail its own IP at creation time. It's not particularly elegant but it simplifies ipfw rules.

I've automated doing some updates with jenkins+ansiblee+git, but overall maintaining them is a bit tough because ansible's pkgng support is lacking.

What you're describing is exactly the reason people use docker. No need to use ansible, or to manage interfaces if you don't want to, it just work out of the box, and you run just bash commands to configure it.

I'd argue no. Dockerfiles are riddled with gotchas and limitations. In this case using Anisble initally is more akin to using Packer to build an image. For ongoing maintenance it's because I maintain state in the jails.

In terms of managing interfaces, iocage does that for you. The IP address has to be assigned manually, but that would be trivial to automate. A couple of IPFW rules work just fine to NAT the loopback aliases for a dynamic set of jails.

You sound like that comment on the Dropbox HN annoucement page: https://news.ycombinator.com/item?id=9224

You've just added at least 2 more concepts to the thing you have to use: iocage and ansible. On top of the jails thing. That's the exact opposite of "easy to adopt". Especially since most people that use something like Docker already don't care or want to learn Docker, they just want the benefits of using containers.

That's a bit like saying that Docker is one more thing on top of LXC that you have to learn.

jails : iocage :: lxc : docker

ansible : iocage :: packer : docker

The workflow and terminology is somewhat different but that doesn't make it inherently more difficult to adopt. The "slick" DSL that Dockerfiles provide become quite limiting in short order especially as each line bloats the eventual Docker image quite significantly. Case in point, you can't set file ownership when you copy files into the image so that extra step adds that much more bloat.

> Case in point, you can't set file ownership when you copy files into the image so that extra step adds that much more bloat.

I think you could solve that problem easily with multi-stage Dockerfiles.

   FROM alpine:latest
   COPY . /app
   RUN chown/chmod
   FROM alpine:latest
   COPY --from=0 /app /app

That looks suspiciously like an additional layer beyond the copy step to me (either that or a terrifically non-intuitive syntax).

You only learn about docker...

Regarding your later edit about bloat, well, it seems most people don't really care about that.

You only learn about iocage… (although even with Docker you should have at least a little knowledge of how things work under the hood for when things invariably break).

I was curious about iocage, is it this thing? https://github.com/iocage/iocage

It's FreeBSD only, why are we even having this discussion? :)

Take a look at the post I originally replied to. It was commenting on docker versus the alternatives.

What do you mean, in reference to layers on kubernetes, mesos, etc?

Reply on news.ycombinator.com