112

Lets forget the high-level architectural and philosophical arguments for a moment. While there may be some edge cases where multiple functions in a single container may make sense, there are very practical reasons why you may want to consider following "one function per container" as a rule of thumb: Scaling containers horizontally is much easier if the ...


56

Having slain a "two processes" container a few days ago, there are some pain points for me which caused me to use two container instead of a python script that started two processes: Docker is good at recognizing crashed containers. It can't do that when the main process looks fine, but some other process died a gruesome death. Sure, you can ...


32

When people talk about running a database in Docker, they do not mean to store the data in a container; they are talking about having a docker image with the DB software, and mounting the data as a volume (a bind volume, not a container volume). Volumes are an essential part in Docker, and are not something that is flakey or just tacked on. Docker is not ...


19

The recommendation comes from the goal and design of the Operating-system-level virtualization Containers have been designed to isolate a process for others by giving it its own userspace and filesystem. This is the logical evolution of chroot which was providing an isolated filesystem, the next step was isolating processes from the others to avoid memory ...


19

The very first thing to know about a container is: It is, first and foremost, a process. Once that is understood, one can start to understand how containers compare and contrast with virtual machines. Containers and VMs both share isolation from their hosts. The method of isolation is the critical difference. Container processes use extensions to the OS ...


17

I would keep the ECS container instances (I'm talking about the Docker hosts - I don't like AWS terminology here) and the deployment as two separate things. Get your ECS stack up and running. You can manage it through CloudFormation and Auto-scaling groups, that's fine. Just think of your cluster as a platform where you will deploy to, not something you ...


13

There are a few answers to that: Something needs to build those immutable images. It is certainly easier to use old-school-style procedural scripting to build something when starting from a known starting state but this can still get very unwieldy over time (e.g. Dockerfiles), especially when you end up wanting a big matrix of different images for things ...


13

Azure Container Instances (ACI) may be a good option as you suggest. These let you run a container directly on Azure, without having to manage a VM, with per-second billing for the time the container is used. Although one of the demos on that blog mentions Kubernetes, the idea of ACI is that you can create a container through the Azure CLI with az ...


13

No, it uses an internal "attach protocol" via the Docker daemon.


10

As in most cases, it's not all-or-nothing. The guidance of "one process per container" stems from the idea that containers should serve a distinct purpose. For example, a container should not be both a web application and a Redis server. There are cases where it makes sense to run multiple processes in a single container, as long as both processes support ...


10

Update: Docker just released support for Kubernetes as scheduler, which changes the situation and makes Kubernetes just an alternative scheduler to Docker Swarm. TL;DR: DON'T DO IT. Engineers always try to create these dog-pigs. Every unnecessary technology you bring will bring another whole set of faults. If you can pick one, then pick one and be happy ...


10

Does the Docker engine abstract away the OS such that this configuration will run both apps? No, it does not. Docker uses containerisation as a core technology, which relies on the concept of sharing a kernel between containers. If one Docker image relies on a Windows kernel and another relies on a Linux kernel, you cannot run those two images on the same ...


10

Well, the extra bells and whistles is called process isolation, a container gets its own namespace from the host kernel, that means the program in the container can't try to read kernel memory or eat more RAM than allowed. It also isolate network stacks, so two process can listen on port 8080 for exemple, you'll have to handle the routing at host level, ...


9

The same as any Linux load, consider no more processes in wait state than the number of CPU. The load on 1, 5 and 15 mins given by uptime should ideally be 1 less than number of cores. Containers are roughly isolated processes, leaving a core for orchestration avoid congestion. That doesn't mean only 7 containers on a 8 cores machine, it's a matter of ...


9

General ways to track why a process in Linux failed are good. One such way is to run a process using strace which will tell you the system calls process did and usually point to the reason for a failure. You can create a Dockerfile that looks something like this: FROM original_image RUN apt-get -y update && apt-get install -y strace # build with `...


9

While technologically, containers and virtual machines are very different, there is no apparent difference from the perspective of your software. It seems like the argument in your question is that data is special and will always be a unique snowflake, so your question basically boils down to what to do about it in terms of DevOps, CI and Automation. This ...


8

The word container refers to a lightweight virtualisation technology available on modern Linux kernels, this technology is very similar to FreeBSD jails. An older, non-container-able, Linux kernel is able to run processes concurrently. Some attributes of the system are private to process, like the process environment or the process memory: only the process ...


8

The onboarding experience should be almost as simple as telling your new developer to just clone the repo and run docker-compose up. Personally I wouldn't bother worrying about IDE integration because people might prefer to use different IDEs. Every project/application (if you have multiple) should be able to run separately and each project/application ...


7

Usually containers refers to something like docker containers which have popularized the name I quote there from docker definition: Using containers, everything required to make a piece of software run is packaged into isolated containers. Unlike VMs, containers do not bundle a full operating system - only libraries and settings required to make ...


7

If one uses a Dockerfile then a colleague could also understand what happened (documentation as code). If one runs a container, enters it, runs commits then it would be hard to understand what packages were installed. Especially after a couple of months.


7

Containerd is a daemon for running containers. The Docker blog has a nice write up explaining how this fits into Docker. While containerd is used in Docker, it can also be used as a daemon for other container solutions. Containerd requires runc in order to function. runc as defined by the project is a "CLI tool for spawning and running containers ...


6

Docker is a specific implementation of Linux containers, or if you want to be more precise Docker is a distribution of tools that includes runc which is an implementation of Linux containers. Other implementations include rkt, LXC, LXD, and (I think) Snappy from Ubuntu.


6

Who said that properties files and environment variables where mutually exclusive? There is a distinction to be made between "where do I store my app configuration?" And "where does my app source it's configuration? " The most likely outcome is that everyone probably should just keep doing what they are doing with configuration files as a storage mechanism ...


6

I wrote about this in depth but here's the summary: Preventing split brain (electing more than one master node) needs to be solved. Failure to do so can be catastrophic There are no production ready shared storage solutions to enable databases to be shutdown on one instance and brought up on another without losing all your data.


6

Yes, there absolutely is more to it than chroot to the point that they have little to nothing in common. A standardized script file format including semantics relating to the task a hand Images (including anonymous in-between images), caching, naming, downloading etc. including powerful management (docker image prune ...) Containers (including their own ...


6

I can think of only one case where overhead of running workers in separate containers is justified: if your setup uses docker swarm for clustered deployment. This way you will get all of the HA benefits. Otherwise I don't see a reason to complicate such tasks, especially if they must use strictly the same codebase (which leads me to believe that they share ...


6

It is not officially supported (as of Minikube 0.25.0, Kubernetes 1.9, January 2018). But there is Beta support for Windows server containers in Kubernetes. These articles contain more information: http://blog.kubernetes.io/2018/01/kubernetes-v19-beta-windows-support.html https://kubernetes.io/docs/getting-started-guides/windows


6

This is an area where you will need to talk directly to and potentially help educate your auditors. What you have to remember is they are responsible for ensuring that adequate controls are applied, not specifically that "Production Servers have Endpoint Protection"; Anti-virus and Anti-malware are among some of the most basic controls applied to technology....


6

Just a quick follow-up on pumba. Installation (for Ubuntu): $ curl -SL https://github.com/alexei-led/pumba/releases/download/0.7.2/pumba_linux_amd64 -O $ sudo mv pumba_linux_amd64 /usr/bin/pumba $ sudo chmod +x /usr/bin/pumba $ pumba --version It uses stress-ng under the hood, so same commands apply. Examples: $ pumba stress -d 1m container_name -d 1m - ...


5

Alright... you're not going to implement every tool or automation at the same time, as some of them have quite deep impact on your development processes (and I daresay, development culture). Take a step-by-step approach; research each individual tool. Figure out what it actually does, what it is useful for. Play around with them, install them locally, go ...


Only top voted, non community-wiki answers of a minimum length are eligible