Demystifying container runtimes
lwn.net
lwn.net
Bookmarked and thank you to the author!
Cgroups, namespaces, and beyond: what are containers made from? - Jérôme Petazzoni,
I'm still stuck at the 'I don't get it' phase, despite looking at Docker, and more recently Kubernetes, several times over the years, mainly because everyone around me evangelizes it so much.
Unfortunately, I don't even understand how to describe where I'm at with it. For instance, if I look at a WordPress[1], I'm lost. What's the platform? What user does it run on, I see that it is mostly only supported by Apache, but what if I wanted nginx? What if I don't want it to run on Alpine, but Ubuntu 17? etc, etc? Even comments like this:
"This image does not provide any additional PHP extensions or other libraries, even if they are required by popular plugins. There are an infinite number of possible plugins, and they potentially require any extension PHP supports. Including every PHP extension that exists would dramatically increase the image size."
Everywhere I look I always see the answer: "Well, just build your own".... but it's at that point I always give up, because I consistently fail to see the benefit of this rabbit-hole. This is especially an issue when security updates on WordPress, the webserver, or OS can change so quickly that it seems pointless to even want to make an image.
Clearly, there's something I'm missing.
Can anyone explain it to me like a 5 year old, who knows how to set up and maintain his own server? (I typically run through a cheat sheet of things to do).
I also fail to see the benefits of spinning up an image for development purposes, when I already use VirtualBox and Snapshots for said purpose.
(I'm sorry If I seem dense, and seem trollish...but I just don't see it, and the article didn't do a thing for me)
This is me until a few weeks ago. After all the hype, I think some bulb turned on in my head and I'm finally starting to understand the point of all these container shenanigans.
> For instance, if I look at a WordPress[1], I'm lost. [...] what if I wanted nginx? What if I don't want it to run on Alpine, but Ubuntu 17?
It might help not to think like a sysadmin for a second. You'd pull the wordpress container because you want to run Wordpress. Who cares what's underneath? It should feel to you as a blackbox that might as well be running on hamsters for all you care. And that's great for 99% of the cases, because wordpress is just a puzzle piece in a bigger picture and we developers shouldn't have to spend too much time thinking "ah, what were the required rewrite rules for wordpress again?" when there's more important stuff you should be spending your energy on.
If you really need to tweak the internals of the blackbox, yeah, write your own Dockerfile, but you'll find there's often no need.
I've been a sysadmin for years, and then a lone wolf developer, and never understood the point of Docker to manage my projects, now I find myself at the engineering helm of a company and need to juggle all the legacy pieces of software we have, and all the new stuff in the pipeline: MySQL, PHP 5 applications, PHP 7 sites, Elixir app, Node for SSR, Redis, Prometheus, Grafana, etc.
I jumped into the Ansible bandwagon immediately because configuring servers by hand is an irresponsible idea, but now I have to manage all these small blocks that have completely different runtime needs, and let me tell you, my goal for the first half of 2018 is to containerise everything and retain my sanity.
I don't know Kubernetes very much, seems to be the next hyped thing but still feels very complicated unless you're in the loving embrace of Google Cloud/AWS. I still believe in bare, cheap VPSes and in-house infrastructure. I'm still investigating Docker Swarm to orchestrate multiple containers across servers but it's hard to tell the real world performance for the hype.
Hope this helps!
Docker is a reimplementation of binary packages, except it pulls in whole operating system (as a chroot image) as a dependency instead of finer granularity and provides separate networking for each package, so every service running on a single server can be statically bound to 192.168.56.16:8888, even though the server never saw the 192.168.56.0/24 network. All that at the cost of quite opaque heavy magic with filesystems and network configuration.
Kubernetes is a reiteration of configuration management software, this time with Docker replacing RPMs and DEBs, and a failure detection mechanism that can install and start a failed package (service) on some other server in the network. More or less.
I did want to say that while I read through the article I was struck by how high quality the writing was. I'm so used to technical writing being relatively low-effort blog posts. This level of detail was a real breath of fresh air.
That's pretty par for the course, IMO, WRT LWN's articles. It's why I'm happy to continue throwing a few dollars their way every month.
There's value in this, of course, but it isn't really complicated.
the original thread is locked because it's old so i can't reply there, but recently saw your comment
https://news.ycombinator.com/item?id=15425678
> me: i need to generate avatars as a jpeg
> you: The jpeg requirement seems odd. Even if it has "jpg" in the url, you can serve up a standalone SVG (with a jpg extension in the url) as long as you send the right MIME type
i tried your suggestion and it worked - thanks a lot !