Hacker News Reader

Comment by alecsmart1 | Hacker News Reader

I've been reading about Docker for a while. But am unable to wrap my head around it. I've gone through the samples and I only see it good for creating SaaS apps. Can someone please correct? What am I missing? What is the brouhaha all about?

View on HN

I wrote an application for sharing markdown text, which you can view only at http://markdownshare.com/

If you wanted to install it you'd need to fetch all the dependencies, configure them, setup a webserver, etc.

Or you could clone the repository then run:

   docker -t markdown/share build

And launch it as a container:

     docker -d -p 8080:80 markdown/share

That's neat, and shows how you can create/install applications and run them in an isolated fashion. e.g. Graphite, Wordpress, etc.

Having just gone through all of the tutorials and documentation, I can see this type of thing shaking up configuration management in enterprise environments quite significantly. The amount of headaches I have keeping several environments (Dev, Staging, Test, UAT, Pre-Prod, Prod) in sync - across any project I've worked on - would be far better maintained using this kind of container-based management.

Simplistically: if you deploy to Linux, Docker provides 90%+ of the benefits of virtualization without the performance penalty.

And without the security benefits of proper virtualisation, too. At least lxc since recently has the ability to run containers as a regular user, but I'll stick to KVM guests secured with MLS policies for now.

Why not combine the two and get the value of both? And, a reminder, you can still use LXC with Docker. It's fully supported.

Because the guests have their own SELinux policies. Docker containers don't come with policies, but if it would support running containers under a user account I could at least restrict each to their own category so that theoretically a chmod -R 777 / (inside a container) and access to the host wouldn't compromise other containers (unless the kernel is exploitable, in which case KVM would still win).

Maybe we're talking past each other here, but, Dan Walsh, author of SELinux, is working to bring SELinux natively to libcontainer / docker.

I'd love to talk more about your needs and how we can help. My email is always open - nick@docker.com

Here is an article my cofounder wrote giving some background and basic terminology: https://medium.com/devops-programming/7f5fd023158f

Reply on news.ycombinator.com