I feel similarly with Docker. But it's easier to explain to newer folks because it's only a single layer of abstraction above shell commands.

The issue with simple solutions is that the underlying problem still has the same complexity. This complexity rises up sooner or later and depending on your abstraction will be nice caught within it or make a complete mess.

I really wish something like singularity containers had taken over -- that was literally just shell commands.

Possibly https://buildah.io/ would be of interest.

I do use podman, not really stoked about buildah because it's still a bunch of buildah commands in a shell-driven DSL, which I suppose is better than a dockerfile. Singularity was literally a build file that was a shell script divided into sections that denoted phases.

Bit late now but you could probably make something like it using buildkit - https://github.com/moby/buildkit/blob/master/examples/buildk...

I can't say Docker is simpler than Nix.

I found Nix way easier, but the documentation is very... concise.

I call this. It isn't a single abstraction over shell. It is a single closure over shell. And that is surprisingly hard to explain.

Again, though, I am glad both are thriving. Competition of implementation is... not that compelling to me. Competition of approach, is amazing.

It's well documented that Docker and especially docker hub had a terrible impact on security.

Once you factor in the efforts required in the long term to mitigate a decade of bundling gigabytes of applications and libraries it's a huge "dev adventure"

More like developer Towers of Babel waiting to collapse on every build attempt. Docker is fine if it's used correctly but it does add a layer of complexity, it doesn't abstract it away..

The way I see it rampantly (ab)used is as a shortcut to get some software up and running by leveraging a public image and passing tech debt for some component of one's system onto the maintainer of the Docker image, then cobbling together multistage builds from those and microservice architectures to try and support this tech debt model. Sometimes it works, many times it breaks, often it turns into complete and utter nightmares to deal with.

"Amazing Andy got this fantastically complex system up and running in a week all by their self way under time and budget and it works. Now I just want to add this feature or modify this one thing and you're telling me that's going to take how long?" Yea, I've seen this more times than I care to admit.

“You mean Amazing Architect Andy who just left for Google?” :-(

That's at least partially why we have CV driven development be a thing in the industry. Either you jump on the NoSQL, AI, ML, blockchain, serverless, microservice, container, $FOO bandwagons, or you'll miss out on job opportunities and will have your CV stagnate.

That's not to say that those technologies don't have good use cases in particular circumstances, it's just that you as an IC probably don't have strong incentives to care about where the project will be in 5-10 years when you will have left for another company in 2-3. A lot of accidental complexity is an unavoidable reality when you have people who put their own careers ahead of most other concerns.

Just build your own images like you would otherwise install the software on bare metal. Base those images on official images, not community images.

YMMV.

Personally, you would have to pry my Bitnami images out of my cold dead hands.. there is just no way my team of 2 can do anywhere near as good.

Fair, there are a few high quality "vendors" that we also trust, and Bitnami is one of them. RandomJoe42/SomeImage is out, though.

> Just build your own images

This is like saying "just wear a mask": it's not enough.

You rely on what other people are doing now and what they've done in the past.

This is an ecosystem problem, not an an individual problem.

If you can do it in minutes on your machine, you can spend those minutes updating your Dockerfile to automate the steps instead. It's essentially the same thing.

Unless auth is concerned. There are loads of tools I run that I want to just be me. Not whatever user is configured in the image.

And learning how to manage that mapping was a heck of a time sink.

How you going to run those tools on CI? Or by your colleagues? These are all questions that need answering anyway, regardless of your usage of Docker.

I already authed as me on my machine. Annoying to also have to auth as me in the container.

Or have we reached the stage where folks have secrets management for containers fully orchestrated at a personal user level?