Hacker News Reader

And what is it that makes the *inside* of all (read: almost all) these nice and working Docker/container images tick?

Distributions using a "model of global shared libraries".

Except that it's usually completely wasted on a Docker container. You could as well just statically link everything (and people do that).

Uhh no?

If you have to run 5 different docker images each with their own “global shared library” set you clearly no longer have system wide globals. You have an island of deps potentially per program or possible a few islands for a few sets of programs.

Which, once again, completely defeats the entire purpose of the Linux global shared library model. It would have been much much much simpler for each program to have linked statically or to expect programs to include their dependencies (like Windows).

Containers should not exist. The fact that they exist is a design failure.

Static linking is acceptable when you can update a version of a library in one place and it will trigger rebuilds of all dependent software, ensuring things like security updates are delivered system-wide with confidence. The Windows every-app-is-an-island model makes you reliant on every app developer for updates to the entire dependency graph, which in practice means you have a hodge podge of vulnerable stuff.

Reply on news.ycombinator.com