Hacker News Reader

Comment by refactor_master | Hacker News Reader

> Docker is essentially a sandwich of disk images where you can shove absolutely anything, and then these images get executed by running whatever legacy software you’ve crammed in there, regardless of how horrific or inconsistent it might be, with zero behavioral controls.

Is this a problem with Docker, or a problem with people who use Docker? Without much controversy I feel this argument could be made about literally any abstract entity in society from `get_foo` to national institutions. Abstractions seem to be a necessary evil in corporative societies.

Also, the article is way too short and meatless to provoke any real thoughts, and comes across as "If you don't already know what Kubernetes is, just know that it's bad". I don't see how that's going to sway anyone's opinion on anything.

View on HN

It's a problem with Docker. It's a real lowest-common-denominator interface, worse-is-better triumphing all over again. Heck, the fundamental flaw is essentially the same as make. Just when most people have finally accepted that a structured dependency/project management system is a better way to build your software than running random shell commands, we recapitulate the whole thing one level higher.

But that's a pretty much entirely separate concern?

Docker is about creating an image that can then be run on any supporting Linux server. It's not aimed at dependency management, really. It's aimed at producing an artifact you can then test and deploy. Sure, in most languages dependency management is a core part of this process, but it doesn't have to be.

Most downloaded images are petty fundamental and only include things that can be installed via a systems package manager, e.g nginx to get a web server, or node to get a nodejs runtime etc.

This significantly improved the issue of things working only in certain environments, because each environment was actually running exactly the same way.

Then came k8s, which tried to solve the issue of deploying across clusters of machines, PaaS. That's not a trivial problem to solve, and consequently is still hard, even with it. But if you need to deploy countless services across hundreds of nodes... It's ultimately a great tool.

As k8s became more and more widespread, it made sense to also use it for smaller deployments, because it solves a pretty fundamental issue you still have to solve, and if everyone is using it ... It's easier to onboard new people

> This significantly improved the issue of things working only in certain environments, because each environment was actually running exactly the same way.

It doesn't though, because it's still just running some random unmanaged commands. If you download a Dockerfile that's a couple of years old and hasn't been maintained, it probably won't work. If you download the built image then it might work for a bit longer, but you won't be able to make any changes to it, and it will still break sooner or later due to e.g. certificate expiry, or being built for the wrong CPU architecture.

> Then came k8s, which tried to solve the issue of deploying across clusters of machines, PaaS. That's not a trivial problem to solve, and consequently is still hard, even with it. But if you need to deploy countless services across hundreds of nodes... It's ultimately a great tool.

Declarative deployment definitely has a lot of value. But k8s shoots itself in the foot by being Docker based, even as the world gradually moves onto better models (language-specific serverless deployments).

You seem to have a fundamental misunderstanding about what docker actually does, and how it's achieving it

> If you download a Dockerfile that's a couple of years old and hasn't been maintained, it probably won't work

The dockerfile is not the produced artifact, that's merely the most common way to build the artifact.

The artifact is the image. Which itself is only a zip file of a linux filesystem, basically. This will behave the same, no matter when you downloaded it.

And I might add: the goal you seem to have: to make an image runnable forevermore is not the goal of docker, again. But if you made a new image, you can then test the exact same deployment in another environment. You do not need to e.g. run apt update on prod and pray to the gods that nothing breaks. Instead you build the image, deploy to test, see that nothing breaks and then deploy to prod.

Also k8s isn't technically backed by the docker backend anymore. It hasn't for a pretty long time now. It's currently using containerd by default https://github.com/containerd/containerd

But supports other backends too

https://kubernetes.io/docs/setup/production-environment/cont...

> You seem to have a fundamental misunderstanding about what docker actually does, and how it's achieving it

On the contrary, I understand what it actually does (or tries to) for very well, you're hung up on what its proponents say it's meant to do (or perhaps retreat to in motte-and-bailey fashion).

> The artifact is the image. Which itself is only a zip file of a linux filesystem, basically. This will behave the same, no matter when you downloaded it.

But it won't. It's architecture-specific, it may rely on other interfaces that are ultimately moving targets, and you'll face things like certificate expiration. And modifying it in place is not sustainable, you need to be able to rebuild it.

> if you made a new image, you can then test the exact same deployment in another environment. You do not need to e.g. run apt update on prod and pray to the gods that nothing breaks. Instead you build the image, deploy to test, see that nothing breaks and then deploy to prod.

That's not nothing but it's something decent language deployment systems already had for years. Build your structured app image, it's a stable artifact, and you can deploy it any number of times and places.

> But supports other backends too

But they're all using that same model of unpack some random unmanaged bytes and try to run them as a Linux executable, right? Yes you can swap out the implementation, but the interface is fundamentally at the wrong level of abstraction.

I entered the tech industry with an ops role, which is why I had - from the perspective of most devs - a lot of experience with the kind of issues k8s solves.

In this context, your responses are very puzzling. I don't disagree with the core of your opinion - there are languages around that solve the issue of sourcing your language specific dependencies a lot better for it's ecosystem then docker ever could.

Some languages, such as erlang/elixir also come with highly advanced and stable clustering basically buildin, which solves running your own software on your own hardware in a distributed manner.

However, that's a completely different issue to what docker and k8s solves.

From devops centered enterprise: K8s basically replaced over provisioned hypervisors running countless VMs with running services in namespaces, no longer needing to over-commit RAM to multiple machines.

And Docker replaced the VMs we were building before that with OCI.

In a less advanced enterprise, OCI replaced the dreaded "patchday" update process with a unified deployment pipeline that simply rebuild the image every so often, giving you high confidence that the deployment will encounter less adhoc issues then youd have to solve before.

I'm saying this as from the perspective of a not particularly enthusiastic user of k8s.

I would suggest everyone to first just run single node with high availability fail over if necessary... But once you're signing SLA with high availability guarantees, deploying hundreds of services per day: doing anything but k8s is a bad idea. You're not doing that with the built-in tooling of e.g. Erlang/elixir either, because you're still missing all the other parts of your infrastructure.

> You're not doing that with the built-in tooling of e.g. Erlang/elixir either, because you're still missing all the other parts of your infrastructure.

If you're deploying on managed serverless infrastructure, you can; certainly you want to manage the other parts of the infrastructure and co-ordinate changes (with terraform or similar), but you do it all at a higher level than what K8s offers you. And if you're deploying on an internal cloud or bare metal, I still find K8s is the wrong abstraction level (at least if your language offers a better deployment model than Linux VMs); probably you want to draw a boundary more similar to what serverless infrastructure providers do, and maintain everything "below the line" as part of your infrastructure rather than your applications. Yes, that means you've got to manage patching your OS and language runtime and rolling out those updates in a safe way, but you'll always need to update the "platform" at some point - even on K8s you end up having to spin up new clusters and shuffle apps from one to another - and drawing the boundary between the platform and the application at the place where it was traditionally done fits with the grain of the tools much better most of the time.

It's not a problem with anything. Docker can be misused like anything else. It's a massive net win for security and maintainability because it completely eliminates barriers to updating software.

There are Distroless images! You can make a container with nothing but one executable in it. https://github.com/GoogleContainerTools/distroless has some helpers but you can just put your rust or go program into an image & ship it! For if you really want to go super far super hard against layer sandwiches.

Personally, I think you're making awful tradeoffs that radically hamper your team's ability to act operationally. That you are showing enormously low respect by handcuffing your team like so.

I hope you have lots of help for how to bring out debug containers to apply tooling that your images are incapable of providing themselves. I beg you to not, but for the uptight, the freaks, the paranoids and those who must go on griping about containers, it's really very easy to do! Anyhow.

What's extra funny and sick is that some of this article valorizes VMs. Which have far far more of a bucket of bits what-is-all-this-nonsense problem, that requires providing far more scripting, tailoring, configuration make. Unless you are running bootc or zerg or unikernel stuff, it feels like VM'ers are in in no moral position to look down on containers, my heavens!

This article has a couple little gems in it here & there. You call it short, but it's just short on understanding thought concern and perspective. It wrings the same blood from the stone again and again and again. Complexity bad, Kubernetes complex, this is garbage, again and again and again. Without really having much to say, just inferring, just trying to condescend you into belief. But there are a couple little good gems here & there (pro CORBA?! Wasm/wasi hype...)

Reply on news.ycombinator.com