Hacker News Reader

Comment by bigstrat2003 | Hacker News Reader

bigstrat2003

A single binary accomplishes most of those things just fine. Only thing it doesn't get you is isolation, but you can isolate things if you want even then (for example, FreeBSD jails are dead easy to set up).

View on HN

I use traefik so with docker compose/labels it's real easy to give things a reverse proxy with an auth gate and other middleware

There's lots of solutions, I also find compose hits the sweet spot for integration into my homelab

ok, so you're just using a container with a different name? You can put the single binary in a container and call it a jail if it makes you feel better.

Well yes, but that's the point entirely - you can easily put a binary into a docker container, or a jail, or on a VM. But when something is shipped as 5 different docker containers it is MUCH harder to extract it into something you can run without docker or in a different configuration (like sharing a postgres instance between multiple applications).

One distribution method is flexible and can be deployed however you want, the other prescribes solutions and makes any customization difficult.

Are you saying it's hard to edit a docker compose file? Being one service or 5 doesn't really make things more complex. I often point servers at my own postgres container instead of spinning up an extra one (so just remove that from the compose for example). That's kind of the entire point of compose, it's so flexible.

I'm confused. The original post said "why docker compose? a single binary dominates any docker compose", (I assumed dominates here means wins over because it wouldn't make sense otherwise?) someone replied giving the additional benefit of containerization, then someone replied to that saying you get all those benefit from single binaries, and if you want the system isolation you can use a freebsd jail, which is like saying "if you want the benefit of containers you can use containers"

Most applications do ship in a single container. whether it's a single binary inside, or a bunch of python or js files or shell scripts is a separate issue. If there is a dockerfile then you know how to build the container. a single binary is easier to build the container for yourself, assuming you also know the binary dependencies of that single binary. Like maybe ffmpeg or yt-dl cli on the path?

Applications that ship as a list of containers are a completely different problem. Those applications are either a victim of their own success, or have developers that come from a particular background.

I mean I've seen many single go binaries spin up docker before haha

I've never felt hindered by docker. It's pretty flexible. If I need even more flexibility I'm reaching for k8s, where I am still containerizing any single go binaries

Isolation is a pretty big deal to be glossed over.

Or bwrap on linux, which is probably good-enough for most services' isolation needs.

Reply on news.ycombinator.com