Author from the original article here.

>>> * Docker encourages fully disposable infrastructure => I'd consider that incorrect and/or misleading

Docker is meant to manage disposable (i.e. stateless) applications. They are expected to be killed/stopped/restarted at any time, no persistent state, no data.

An application is either disposable OR not disposable by its design, docker doesn't change that. (For instance, don't try to dockerize databases).

Docker gives you a quick, nice and easy way to package your applications with dependencies (as Docker image) AND deploy them. [This is valuable]

It's especially great for development and test environments because you can run many containers (i.e. applications) on a dev/test machine, without dependency/deployment hell. [This is very valuable]

>>> * Docker containers can be more secure then traditional environments => No. Just No.

Docker has nothing to do with security.

>>> * Docker provides for idempotent environments agnostic of hardware concerns etc

Docker gets to ignore the hardware. You do not.

You get to buy, setup and manage servers. Maintain a full environment that can run docker.

It can be an undertaking full of dangers, as told by this article and mine :D

>>> * Container management software (Kubernetes, etc.) makes Docker much more powerful/useful and is only going to get better

Docker allows to package and deploy an application. It doesn't do anything about infrastructure at all (i.e. machines, load balancers, DNS, discovery), which you still have to manage and it's a HARD problem.

The orchestration systems is supposed to help you manage all of that. As a result, it will be able to automatically kill/restart/move/add containers across a cluster and make the necessary [physical or virtual] infrastructure changes.

Container + Orchestration will be a [r]evolution to manage entire giant fleets of hosts and applications. [This will be infinitely valuable (allowing me to automate the work of 10 people, all freeing all my time to enjoy unlimited free drinks and foods)]

IMO: In the current state of affairs. Having docker without orchestration is like having cars without roads.

> For instance, don't try to dockerize databases

Host volume mappings. Problem solved.

I've been using them for over a year, with all kinds of different databases, postgres, mysql, mongodb, in dev, ci, and production, never had a problem. It gives you a nice separation of what is and what isn't part of the application state, and makes backups a breeze.

Right. This "don't Dockerize databases" thing is truly just bizarre. It almost in a way seems intentionally antagonistic to make Docker seem less capable than it is. After all, who wants to use something that only works for some applications? And the fact of the matter is that Docker is just a fancy way to run a process. Bind-mounted host directory volumes are one of the most fundamental features available for Docker. The truth of the matter is that Docker can be a complex beast. And what ends up happening is that often people only understand a small part of Docker features they're using. And then they complain about problems with Docker when what they really need to do is go read the documentation. Not all problems with Docker are like this, of course, but the vast majority of complaints that I see (and I see a lot of them from being part of the open source community for over three years now) come from people that don't fully understand the features of Docker they're trying to use. Getting Docker going is dead simple, and people fall into the trap of thinking that's all there is, when Docker is a damn deep technical subject.

Is this what you're referring to?

https://docs.docker.com/engine/tutorials/dockervolumes/

>Having docker without orchestration is like having cars without roads.

Docker's stated purpose is to be the "shipping container" abstraction for server-side code.

Shipping containers are not much more exciting than any other kind of box (VM, jail, whatever) in isolation. Things get more interesting when every port has container-optimized cranes and there are thousands of container ships competing for your business.

Thinking about it i seem to recall that for a while all the hoopla was about VMs that could migrate between hardware to both better utilize existing hardware resources, and allow for more uptime.

But then a while later all the buzz was containerization, with Docker as the poster boy. This, i suspect, in that rather than have the overhead of a VM and such, you could spin up a container instance over there, take it down over here, and achieve much the same result. This in particular if the content of your VM or container was talking to a storage backend anyways.

In my context it's because big data became a thing. Nobody wants to pay the virtualization IO overheads anymore.

That said, I've found myself swinging back towards preferring VMs - with docker-like infrastructure made available. The runv project (https://github.com/hyperhq/runv/) is an interesting and functional take on Docker-with-VMs since I spend way too much time wanting to do privileged things in containers.

> don't try to dockerize databases

Why ever not? There no less reason to do so in a container - and all the usual benefits still apply.

>>> * Docker encourages fully disposable infrastructure

I just want to tack on the upgrade rollback situation. A container looks a lot like a process from the host os point of view. You can bring up the new release and leave the old release running on the same machine without much difference in load. The load just shifts to the new container. With a VM approach, you kind of need both vm's for the whole upgrade window.

Depending on your orchestration, blue/green deployment is pretty straightforward.

There can't be two containers running that listen on the same port. The rolling upgrade will need to kill the first container to start the new one.

I may suppose that you talk about [CPU] load, because you are running computations/processing applications and not webservices.

Well, this is a problem that's been solved [0]. I've been using nginx-proxy for a couple of years now, in production, without any issues.

[0] https://github.com/jwilder/nginx-proxy

Don't use static ports. Pick a random one and update the load balancer (Haproxy, Traefik, Nginx) to point to the new one. If the rollout fails, you can always roll back by pointing back the old one.

FWIW, Kubernetes solves this out of the box.

> No. Just No. > Docker has nothing to do with security.

Docker can totally reduce the risk of in-container services being exploited. It has sane defaults, and makes it easy to distribute other restrictions with the application (seccomp profile, apparmor settings, etc).

I'm not sure if I qualify as a docker expert, but I feel like I need to comment on these...

Firstly, I think it is correct that docker encourages disposable infrastructure, because your docker setup basically must be able to recover from the loss of a container. I think it would not be sane to expect your containers to "just keep working".

Regarding security, I don't think Docker provides much other than the illusion of better security at the moment. At least on Linux containers don't add security that you can't get with traditional services.

I suppose if you use authenticated images you can at least be sure that you're running the code you think you are, but then again package managers have had signing for ages.

You're always going to have to test your software in the environment you will be deploying it in, because driver bugs and weird interactions still exist. Docker doesn't really let you ignore the hardware

I have no opinion of kubernetes and such at the moment.

What docker does grant is an easy method of "packaging" software... Pretty much anyone can just throw everything together in a big bundle and distribute that. For certain use-cases, this can give a development team much more speed, since setting up a workable environment is much faster. There is also a nontrivial amount of software that simply does not bother with OS packaging where containers can help you deploy it in a more controlled fashion.

'I think it would not be sane to expect your containers to "just keep working".'

Why?

As SysAdmin, I'm going slowly but surely to Docker. You have to follow good practice such as using devicemapper which is truly not by defaults even it CoreOS.

For sure for developer it's a big thing, for SysAdmin and people thinking about the datas it's more a pain in the ass.

Anyway, no way to go back. This is the future Jack.

On the last DockerConf you could ear ADP talking about their success with Docker, but obviously their there to promote Docker. ;)

* Docker encourages fully disposable infrastructure

Absolutely. You will get the most out of it like this. You can run pets, and treat containers VMs but I don't think you will get all the advantages.

* Docker containers can be more secure then traditional environments

Out of the box you get isolation from namespaces (not being able to see the host filesystem or network), resource limits via cgroups, a default seccomp profile that restricts some system calls that could be used in exploits, and more. You can set all these defaults yourself but the majorty of people do not. So there are definit benefits.

* Docker provides for indempotent environments agnostic of hardware concerns etc

Most applications do not talk directly to hardware, the default container does not directly present hardware interfaces, yes.

* Container management software (Kubernetes, etc.) makes Docker much more powerful/useful and is only going to get better

It does help to have software to manage programs across multiple computers, for scaling and redundancy, yes.