> For instance, don't try to dockerize databases

Host volume mappings. Problem solved.

I've been using them for over a year, with all kinds of different databases, postgres, mysql, mongodb, in dev, ci, and production, never had a problem. It gives you a nice separation of what is and what isn't part of the application state, and makes backups a breeze.

Right. This "don't Dockerize databases" thing is truly just bizarre. It almost in a way seems intentionally antagonistic to make Docker seem less capable than it is. After all, who wants to use something that only works for some applications? And the fact of the matter is that Docker is just a fancy way to run a process. Bind-mounted host directory volumes are one of the most fundamental features available for Docker. The truth of the matter is that Docker can be a complex beast. And what ends up happening is that often people only understand a small part of Docker features they're using. And then they complain about problems with Docker when what they really need to do is go read the documentation. Not all problems with Docker are like this, of course, but the vast majority of complaints that I see (and I see a lot of them from being part of the open source community for over three years now) come from people that don't fully understand the features of Docker they're trying to use. Getting Docker going is dead simple, and people fall into the trap of thinking that's all there is, when Docker is a damn deep technical subject.

Is this what you're referring to?

https://docs.docker.com/engine/tutorials/dockervolumes/

>Having docker without orchestration is like having cars without roads.

Docker's stated purpose is to be the "shipping container" abstraction for server-side code.

Shipping containers are not much more exciting than any other kind of box (VM, jail, whatever) in isolation. Things get more interesting when every port has container-optimized cranes and there are thousands of container ships competing for your business.

Thinking about it i seem to recall that for a while all the hoopla was about VMs that could migrate between hardware to both better utilize existing hardware resources, and allow for more uptime.

But then a while later all the buzz was containerization, with Docker as the poster boy. This, i suspect, in that rather than have the overhead of a VM and such, you could spin up a container instance over there, take it down over here, and achieve much the same result. This in particular if the content of your VM or container was talking to a storage backend anyways.

In my context it's because big data became a thing. Nobody wants to pay the virtualization IO overheads anymore.

That said, I've found myself swinging back towards preferring VMs - with docker-like infrastructure made available. The runv project (https://github.com/hyperhq/runv/) is an interesting and functional take on Docker-with-VMs since I spend way too much time wanting to do privileged things in containers.

> don't try to dockerize databases

Why ever not? There no less reason to do so in a container - and all the usual benefits still apply.

>>> * Docker encourages fully disposable infrastructure

I just want to tack on the upgrade rollback situation. A container looks a lot like a process from the host os point of view. You can bring up the new release and leave the old release running on the same machine without much difference in load. The load just shifts to the new container. With a VM approach, you kind of need both vm's for the whole upgrade window.

Depending on your orchestration, blue/green deployment is pretty straightforward.

There can't be two containers running that listen on the same port. The rolling upgrade will need to kill the first container to start the new one.

I may suppose that you talk about [CPU] load, because you are running computations/processing applications and not webservices.

Well, this is a problem that's been solved [0]. I've been using nginx-proxy for a couple of years now, in production, without any issues.

[0] https://github.com/jwilder/nginx-proxy

Don't use static ports. Pick a random one and update the load balancer (Haproxy, Traefik, Nginx) to point to the new one. If the rollout fails, you can always roll back by pointing back the old one.

FWIW, Kubernetes solves this out of the box.

> No. Just No. > Docker has nothing to do with security.

Docker can totally reduce the risk of in-container services being exploited. It has sane defaults, and makes it easy to distribute other restrictions with the application (seccomp profile, apparmor settings, etc).