Keith Smith - My Blog

My Thoughts on Docker

Tuesday, June 30, 2015 - by Keith A. Smith

Docker uses Linux LXC to encapsulate a fixed environment into which you have built some software that depends on a stable config and wants isolation from everything else. To the software it feels like it is alone on a machine, but actually it is alone in what Docker calls a container.

You can have 100s to 1000s of containers running on one machine. You can also group containers together to make larger projects. Obviously with the encapsulation, you can patch or upgrade the OS without any fear it will break something running in a container. Unlike VMware the encapsulation is not on the chip level with a hypervisor, but on the OS level. So those big servers you have, the ones that can easily run heaps of things, but you don't really want to have heaps of VMs? (which really just passes the update/patch/reboot buck, if you think about it), these can run heaps of Containers. In my opinion Docker reminds me of bsd 4.0 jails, developed in 2000 for a hosting company which predated Solaris zones.

Docker has many concerns, particularly around security, which in turn can be a gating or otherwise limiting factor in acceptance by several industries. This is the nature of open source - there are many options as every individual that disagrees with someone else spawns his own solution addressing what he views as the most important problems. In the end there are many container options, even just in the case of linux.

Companies that have embraced container-based virtualization more often have more than just one such technology in place. This year's openstack summit showed this strongly. I do see great potential with containers. One of the caveats i am facing right now when designing my potential future architecture, it is redundancy/availability. There is no live migration of containers. So you have to consider that. You would have redundant containers, but i can see where IP addressing can get a bit complicated when using keep-alive or ucarp. And this is because they wouldn't work at the container level, but at the docker host level. If you lose a container, the virtual IPs wouldn't be active on the other host. And docker uses its own network addressing for the containers. Therefore, essentially each docker host is a "router".
  Share Post   

View Comments Comments


Leave a Comment