Hacker News Reader

Comment by ramraj07 | Hacker News Reader

The biggest issue with docker is the false sense of security it seems to give a lot of engineers into thinking they know infra when they really don't. I stay away from this because I don't understand it fundamentally, and now this proves it's better to not think these new technologies are your friend unless you actually know what you're doing (which apparently most don't).

View on HN

> the false sense of security it seems to give a lot of engineers into thinking they know infra when they really don't.

I don’t say this lightly: this is a big problem in our industry right now. DevOps means (to some) that developers now handle operations. The reality is that it’s difficult to juggle an operations mindset with a feature driven one.

Even if you focus on infra problems full time there is so much ground left uncovered, it would be impossible for anyone to juggle all of dev and all of infra at once, and this is compounded by the fact that ops is reductionist and dev is additive, which is an incredibly difficult problem for a person to reconcile and give full attention to one side. That’s why devops was supposed to be a division of labour; not just a dude/dudette who can configure nginx and write code.

Reminds me of this: https://www.weforum.org/agenda/2021/04/brains-prefer-adding-...

I'd argue an equally big problem here is this setting is that engineers have been taught to think in a perimeter security mindset.

No: good security is layered aka "defense-in-depth".

docker breaches the localhost VS external port security model (and others)

Staying away from it is still not the best strategy - at least learn and play with it to understand its strengths and weaknesses.

> it seems to give a lot of engineers into thinking they know infra when they really don't

Maybe, but technology changes over time - I don’t see many new projects choosing VMware over docker/OCI for new infrastructure deployment since you usually don’t need a full VM for applocations that just need isolation and easy static deployments.

I suppose my premise is that engineers often delude themselves into thinking that they know it well enough to implement docker when they dont. Id much rather prefer that the regular developers focus on the coding and leave those decisions to actual devops folks who can focus on getting this stuff right. But the simplicity of dockerfile lulls many into thinking if they run something with it it's production ready.

Doesn't that run counter to what devops actually should be? I know that in practice, this split is what happens at companies, but we should work to close that rift, not widen it.

Whatever devops is supposed to be, it shouldn't involve relying on a tool whose security characteristics the team does not fully understand. If requiring such knowledge results in widening a pre-existing rift, so be it.

That's true, and something that often gets lost in the acceleration of "devops culture". But, in my opinion, the consequence then should be to try to not use Docker at all, and look for alternatives (like Podman) instead of just taking control from the dev team.

> Staying away from it is still not the best strategy

There's a whole generation of sysadmins that use docker so that they can stay away from foundational knowledge. We interview experienced devops who do not know/understand how to build basic packages from source (e.g. they don't understand the ./configure, make, make install chain) and who only have basic knowledge of the underlying operating system.

To be honest, I know how to type `./configure`, `make` and `make install`. And I know more about Gnu Make than I would admit in a job interview (for fear of someone expecting me to work with Make).

But so far, life has been too short for me to waste my time on Gnu Autoconf. And I don't feel guilty about this, or like someone who doesn't know fundamentals.

Autoconf is by all accounts a horrible system. Gnu Make ain't much better.

So I can't fault people for trying to avoid this mess.

All software is fundamentally helping deal with abstractions as this.

Build systems in general can be ok, or even elegant and fun.

Autoconf is just really terrible.

Autoconf is one of those programs that solved real problems when it was created, in a way that was actually fairly reasonable at the time too. There's a reason it became so popular. But it's now 30 years later, and what was reasonable then is a liability now.

Sendmail is another great example of this phenomenon.

Oh, yes, Autoconf was somewhat defensible when it was created.

Just like PHP and COBOL solved real problems back in their heyday.

They are just not something anyone should be using nowadays.

(Btw, Facebook's Hack is a surprisingly pleasant language. Probably the best one they could have made, coming from PHP.)

> They are just not something anyone should be using nowadays.

I guess it depends, take Vim for example: been around since the early 90s, the developers are familiar with autoconf, and it seems to work well for them. Why fix something if it ain't broke?

Switching build systems is not necessarily an easy task. Also, as a user I always found cmake quite hard to deal with. Actually, as a user, I actually prefer autotools in spite of its shortcomings. I think there's still quite a bit to win here.

Either way, I personally wouldn't really call autoconf "terrible".

It's like the saying "the shortest path between two points is the one you know" - the simplest build system is the one that exposes the least complexity to you, which is usually the one that is already deployed and working to your satisfication.

Unless you want to make a change or fix a bug, that is.

Well, cmake ain't exactly my favourite piece of software either.

And, yes, switching an existing system is a different proposition from starting from scratch.

Though see what the Neovim people have been doing to remove some of the accumulated cruft from Vim, if you are interested.

I wholeheartedly agree, that I spend to much time of my live with GNU autoconf and make. But docker is on completely other level. After spending years and years of working with and around docker and speaking with others that do the same, I came to the conclusion that I will recommend docker only for one use-case in the future: Making easy examples to startup a system in one line.

> So I can't fault people for trying to avoid this mess.

Ex-Amazon here. Being deeply familiar with OS fundamentals and internals, "low level" tools, and so on is crucial.

A lot of candidates show to interviews with CVs filled with names of popular frameworks and fancy devops tools and often don't understand what really happens behind the curtain.

People are becoming less familiar with the basics and tend to reinvent the wheel. In many teams this does not get you hired.

I'm not saying you are wrong but this sounds like it is in part a hiring problem.

> Being deeply familiar with OS fundamentals and internals, "low level" tools, and so on is crucial.

...needs to be front and center on the job description then. Far too often these kinds of things are hidden on the initial job descriptions and it just wastes everyone's time. I get that HR/recruiters want to throw a big net but vague job descriptions are often part of the problem.

I cannot generalize for the whole company. When writing jobspecs in my team we never made lists of the "popular frameworks of the month".

We did exactly that last year.

Reply on news.ycombinator.com