It doesn’t really. Don’t confuse docker with a virtualization layer. Well made containers bring just the processes you’d be running anyway.

I run a few containers on my RPi and cannot tell a difference in performance.

I agree if the container brings any benefits. In this case there is nothing that a standard distro-packaged apache/nginx wouldn't do. There is no automation of build steps, lets-encrypt or similar.

Installing docker and running that daemon for just this is not the right way.

> Seriously. Adding a docker layer to a device as lightweight as a Raspberry Pi just seems like insanity.

Your definition of insanity is perplexing. Docker in this context is pretty trivial to setup and run, and it's used mainly to manage packaging and deployment. Do you happen to have any experience at all with Docker?

Yes, and it's doubly pointless here, because it isn't doing anything that couldn't be done better by the OS's own package manager. Better, probably, because you will get timely security updates.

> Yes, and it's doubly pointless here, because it isn't doing anything that couldn't be done better by the OS's own package manager.

No, not really. With Docker, packaging is a solved problem, and you also get for free a deployment history which you can roll back and forward at will. You also get introspection and blue/green deployments, and if you really want to you can also setup a cluster of nodes for free where you can run whole application stacks with a one-liner.

There is really no excuse to do things the hard way.

It still does have a non-zero cost, especially in the long run, when security vulnerabilities pop up. With distribution package management, on Ubuntu, you can rely on your Nginx being updated and restarted automatically while you sleep. With Docker, you need to subscribe to a security mailing list in order to know about the vulnerability in the first place, and then run some commands manually that re-create the container.

> It still does have a non-zero cost, especially in the long run, when security vulnerabilities pop up.

It really doesn't. Unless you were planning on doing a one-and-done deployment, it's trivial to update and redeploy Docker images. Even in my side projects I have CI/CD pipelines updating and redeploying Docker images daily.

> With distribution package management, on Ubuntu, you can rely on your Nginx being updated and restarted automatically while you sleep.

Whatever you can do with Ubuntu, you can do precisely the same with Docker when running a base image of Ubuntu.

> With Docker, you need to subscribe to a security mailing list in order to know about the vulnerability in the first place, and then run some commands manually that re-create the container.

No, you really don't. Just pull the latest base image, build your images by calling apt to update your dependencies, and you're done.

Whatever you can do with a bare metal/VM install, you can do with Docker.

There is nothing magical stopping you from doing the basic stuff with Docker.

patrakov is talking about updating the docker daemon/engine (that runs on the host), not the images that you run with docker.

Nope, I was talking about the images. More precisely, about knowing when to update them.

Docker is extremely light weight and I wouldn’t have any concerns about running it on an rpi