Hacker News Reader

Comment by rubiquity | Hacker News Reader

It looks interesting but seems like a very Docker-centric Packer[0] in that it has code to create ready to go with Docker images on various cloud providers and virtual machines.

The real hurdle and problems you'll be solving with Docker are when you have containers on separate hosts. Will Machine handle configuring firewalls, SSL, SSH keys and all that jazz across hosts so containers can reach each other? I've automated a lot of this myself but would love something that does it for you (other than the existing discovery service tools that often introduce problems of their own). From the post it seems like Machine will also handle this but I wonder how and how well.

[0] - https://packer.io/

View on HN

> It looks interesting but seems like a very Docker-centric Packer

I think you mean a Docker-centric Vagrant, no? Packer is for building images, Vagrant is for launching environments.

You can use Packer to build Docker images akin to `docker build`, except Packer will let you use a variety of provisioners to build your Docker image like Chef, Ansible, or just simple Bash scripts. It's `docker build` without the Dockerfiles. [1]

Docker Machine seems geared towards launching a resource that is ready to run Docker, whether it be a VM running locally or a remote instance in some cloud. It's a single-purpose Vagrant, to really stretch the analogy. :)

Once you have a resource that runs Docker, I think that's where Docker Compose [2] steps in. Docker Compose is more like the full Vagrant in that it spins up a full, functioning environment with running services and whatnot.

[1] https://www.packer.io/docs/builders/docker.html (See the last section, titled "Dockerfiles".)

[2] http://docs.docker.com/compose/

I've been using Machine for the past month and it's pretty good. It handles SSL certs for docker over IP address, which is an absolute PITA to manage manually. I hated creating new certificates for each machine, whereas machine does that for us. There's an open PR for adding PW protected CA key files, too.

Unfortunately, we use a custom SSH port which there isn't support for. It also adds a machine-specific public SSH key for connection.

The docker guys are great at accepting patches, so we can build this all if we need it.

(Docker employee and machine contributor here)

> The real hurdle and problems you'll be solving with Docker are when you have containers on separate hosts.

Agreed! There are a lot of problems to solve here, and when the recent motion in Docker networking / plugins model settles down a bit and a solution gets merged into Docker proper, it will make inter-container communication across hosts easier.

> Will Machine handle configuring firewalls, SSL, SSH keys and all that jazz across hosts so containers can reach each other? I've automated a lot of this myself but would love something that does it for you

We definitely want to make the lives of operators a lot easier. It's still early days for figuring out the scope other than "let's make a tool to get a lot of Docker daemons, in a very straightforward way", so we'd really love to have you get involved and give your feedback! It handles some SSH key / TLS cert management right now, but there's a huge surface area of things we need to consider carefully.

Reply on news.ycombinator.com