Docker Blog

The best place is probably the brand new Docker blog: http://blog.docker.io

i think they are being very opaque about their plans and this is hurting their credibility. They built the ability the launch k8s clusters through the docker tool. There are almost no tweets or posts about Swarm instead, their blog is full of kubernetes posts (https://blog.docker.com/). Even their coolhacks section is about "kubeflow". Top rated session at Dockercon was kubernetes. i really hope they open up more and talk about their future plans and engage with the community.

They also announced the Docker Certified program [1] but with no technical details about what that involves beyond hand waving that "containers are tested, built with Docker recommended best practices, are scanned for vulnerabilities, and are reviewed before posting on Docker Store." Is there some set of automated tests my container has to pass? Can I run them today? More to the point, how much will it cost me? [1] https://blog.docker.com/2017/03/announcing-docker-certified/

Here is a follow up blog post with more details about containerd: https://blog.docker.com/2016/12/containerd-core-runtime-component/

Hi, member of the Infinit team here. We're very excited to be joining Docker! Their technology is great and the momentum behind them is really impressive. Feel free to ask questions, I'll be around a little this evening (based in Paris). Their post: https://blog.docker.com/2016/12/docker-acquires-infinit/

You're bring incredibly hostile over something very trivial. Docker wasn't 'recommended' for production until 1.0: https://blog.docker.com/2014/06/its-here-docker-1-0/

Looks like "opsworks" but not limited to AWS (and hopefully less frustrating). I guess this is coming from tutum who they bought recently and have been building basically the same thing. That's great, because so far I've mostly had great experiences with tutum. Here's the blogpost announcing it: http://blog.docker.com/2015/11/dockercon-eu-2015-docker-universal-cont… There seem to be some features like poking running containers from the UI: https://twitter.com/svsteenis/status/666568775672705024/photo/1?ref_sr…

Listening to what the Docker people write about security, they sure do sound like they are designed to be secure, even though they admit to a couple of potential shortcomings versus VMs. https://blog.docker.com/2013/08/containers-docker-how-secure-are-they/ concludes, "Docker containers are, by default, quite secure; especially if you take care of running your processes inside the containers as non-privileged users (i.e. non root)." They also recommend using SELinux with Docker to beef up security (see https://blog.docker.com/2014/07/new-dockercon-video-docker-security-re… As long as people are using containers as a security boundary it makes sense to pay attention to things like this one about the control socket.

Well, AFAIR (as far as i read), LXC are C and python and Docker is go-friendly, so recently they included libcontainer and slowly will remove the piggybacking on LXCs, i feel so, its optional with new release. http://blog.docker.com/2014/03/docker-0-9-introducing-execution-driver… So in that case, they will bring along more features too,that will surpass LXCs.Also its the matter of statefulness and statelessness. LXCs are stateful and dockers are stateless so this is a big win here for dockers. Libcontainer brings more dimensions to dockers. So if state is not a concern for you, LXCs are any day great ones to go for.

SSL configuration are a pain, especially across multiple sites. Even if you can afford a full dev team, case and point: https://blog.docker.com/

Thanks. Yeah, most of the misconceptions seem to come from folks without previous experience with self-managed virtualized setups. Those that have had that experience usually already understand the complexities involved. I'd also love to hear more stories about Docker vs the other virtualized setups. It generally seems to be a dramatic improvement in usability, performance, etc, but I'd love to hear more about the specifics from those who have made the switch. Here's a few production users: http://www.docker.com/resources/usecases/ http://blog.docker.com/2013/12/baidu-using-docker-for-its-paas/

This seems to be a fairly outdated article, despite the displayed date- it says the 'newest' version is 0.7, but we've been on 0.11 since 2 weeks ago: http://blog.docker.io/2014/05/docker-0-11-release-candidate-for-1-0/ It's some pretty amazing tech, and I love it with Vagrant for my local dev environment, and for full deploys. I'm not such a big fan of Dokku- it's a great 'heroku replacement' but one of the best strengths of docker, is you can just upload your code to a private repo(or use a trusted build on a private repo!) and pull that down and run to deploy. Dokku going through the buildpack process, while making it nice from a quick git push angle, sacrifices one of Docker's strongest features(consistency).

I can also recommend Docker + joyent/digital ocean with Openvpn. [0] Just paste a few commands, install tunnelblick and you are ready to go. [0] http://blog.docker.io/2013/09/docker-joyent-openvpn-bliss/

You can fork the registry code [1]. We work in a regulated industry (healthcare) and need excellent access controls and auditing/logging. Forking the registry and rolling our own is possible, but not something we want to spend time on. So we looked around for private registries. We went with Quay [2] and have been really happy. They're responsive, performant, and on top of enterprise-level requirements. [1] http://blog.docker.io/2013/07/how-to-use-your-own-registry/ [2] https://quay.io/

Docker is awesome, but specifically NOT ready for production. From Docker's website "we make a point of saying that we’re not production ready".http://blog.docker.io/2013/08/getting-to-docker-1-0/ While I love your enthusiasm, I worry that you'll mislead others into thinking that its a good idea to replicate your setup and run something important.

I've also struggled with the distinction, but I believe the commenter above was referring to LXC (and LXD's) "system containers". Full user namespacing has been in from very early on (day 1?) which is the "increased security" -- this is where I believed the difference between "system containers" for LXC and regular "application containers" was. runc was not always the runtime underneath Docker, and IIRC it has not always had support for proper user namespacing for as long as LXC has. Also, LXC has so many more features packed in I think it's a disservice to compare it to runc in the first place. It should go without saying but I would absolutely love for you to sprinkle some knowledge on me wherever I'm wrong about either of these. [EDIT] - Getting downvotes so figured maybe I said something egregious so I did some digging: - LXC had user namespaces @ v1.0 in 2013[0] - Docker got user namespaces @ 1.10 in 2016[1] This is the distinction I meant. [0]: https://stgraber.org/2014/01/01/lxc-1-0-security-features/ [1]: https://blog.docker.com/2016/02/docker-1-10/

I think most of the observations of that talk still stand. > System software became about managing large numbers of machines. Yes, but is academic research on these topics relevant? Most of the progress on infrastructure software has come from the attempts of internet companies to cope with their big data problems. The people who implemented these systems have all received their phds from academic CS institutions and they used bits and pieces of existing distributed systems research, but they did their innovative work in the context of commercial companies, not academic CS departments. > Good new languages were developed. And what are they? A quick look at https://tiobe.com/tiobe-index/ (for the lack of a better resource) corroborates the thesis that the bulk of software is developed using the same old boring languages. Yes, they have evolved, but not much. Golang is, well, not exactly innovative. Rust still has a long way to go to be called a mainstream language. > Things running in containers on in VMs need far less of an OS, and a lot less OS state. Unikernels exist but is there a compelling non-niche use case for them? Docker acquired Unikernel systems and that's what we got so far: https://blog.docker.com/2016/05/docker-unikernels-open-source/ These are all great examples confirming the thesis that producing good relevant systems research is hard. On the one hand we are piling up gross inefficiencies on top of decades old technology, so improving the current…

>Who is the author of aufs or overlayfs? Should these projects work with no recognition while VC funded companies with marketing funds swoop down and extract market value without giving anything back. How has Docker contributed back to all the projects it is critically dependent on? Here's an exert from a docker blog post from 2013[0] >>Under the hood Docker makes heavy use of AUFS by Junjiro R. Okajima as a copy-on-write storage mechanism. AUFS is an amazing piece of software and at this point it’s safe to say that it has safely copied billions of containers over the last few years, a great many of them in critical production environments. Unfortunately, AUFS is not part of the standard linux kernel and it’s unclear when it will be merged. This has prevented docker from being available on all Linux systems. Docker 0.7 solves this problem by introducing a storage driver API, and shipping with several drivers. Currently 3 drivers are available: AUFS, VFS (which uses simple directories and copy) and DEVICEMAPPER, developed in collaboration with Alex Larsson and the talented team at Red Hat, which uses an advanced variation of LVM snapshots to implement copy-on-write. An experimental BTRFS driver is also being developed, with even more coming soon: ZFS, Gluster, Ceph, etc. I think the real nature of your complaint is that you want the recognition to be in the form of cash. [0] https://blog.docker.com/2013/11/docker-0-7-docker-now-runs-on-any-linu…

Perhaps it would be like Ubuntu going back RHEL/CentOS vs. Fedora churn, or turning something like iOS into something like Android. Sometimes, projects need to leave things that are working alone instead of churn-for-churns' sake. This move needs more substantive explanation than "we're renaming and duplicating projects, creating the Paradox of Choice." It's already open source. Plus, being too open, other companies can just come in like with W3 and drive features and complexity that aren't always positive. Next, one Tragedy of the Commons problem with Android is companies aren't motivated to invest significantly into making the overall platform better because it helps the competition. Sure some do, but they usually make their fork of it slick and shiny on the outside but the upstream/inside doesn't always get the same love. Finally, a poor execution of an open platform makes the whole platform look bad to customers. It's not the end of the world if docker pivots oddly but I hope it goes well. https://blog.docker.com/2017/04/introducing-the-moby-project/

This is a very good tutorial! Love the end-to-end examples. Great teaching method as it gives an overview of what you want to achieve without looking at things in isolation. Wanted to add one bit of info and give a heads up about the Docker for Mac & Windows beta at https://beta.docker.com/. > If you are on Mac or Windows, consider using a Virtual Machine. I use Parallels on Mac OS X to run an Ubuntu machine for most development activities. Being able to take snapshots, break things and then revert back is very handy when experimenting. The beta will make is super easy to use Docker on Mac & Windows without running a heavy Virtual Machine. Here's a little video about it @ https://blog.docker.com/2016/03/docker-for-mac-windows-beta/. Basically, it feels like running Docker natively, has upgrade features build it, so you can choose to always be on the latest release (super nice). I've been using it for a few months and it is awesome to just type "docker run" on my macbook and have it work seamlessly (vs using third party virtual machine software and env bits). The idea is that you can develop on Mac & Windows using the same images you will eventually deploy. It just works (although I'm biased). Disclaimer: Work for Docker.

There are a great many factual errors in this article and I'm sure someone will write a proper response, but I thought someone should address the most glaring: - The repeated assertion that you can only use one process container is false. As an example, the most popular non-official base image (phusion/baseimage) provides a full system including SSHd and Cron - No integration points Docker provides an extensive event stream[0], as do their tools (such as Registry[1]) - "ps, ls, find [...] are useless here" This depends on your system setup; on a standard Debian setup, all container processes are visible to the actual system. ps, top, netstat, etc will all work just fine - "You can not easily and directly access your durable non-volatile data storage" One of the most basic concepts in Docker is that of a "volume"[2]; essentially a directory that bypasses Docker's abstraction layers, for performance and durability. Additionally, using your normal storage is absolutely trivial[3] - if Linux can see it, you can use it. - No authentication for images This one's true to a certain extent. While most images aren't currently signed (that's a relatively new feature[4]), it's disingenuous to say that there's no authentication at all. Docker enforces the use of HTTPS to talk to registries, and requires HTTP authentication for registry accounts. It's not signing, but it's something. Finally, just as it's a personal bugbear of mine, I would note that the userland proxy is a very…

So I actually remember running into the "Unable to locate package docker-engine" issue a while ago, and it seemed like an issue on Docker's end because for me, the issue actually only lasted about half a day before it started working again without any changes on my part. So I think in the end this was just a case of really unfortunate timing, because if it weren't for the Docker installation issue, the only real complaint left in this post would have been the fact that the official method of installing Docker was to curl a script and pipe into sh[1]. And the rest of the post would have been singing praises of how amazing Docker is to be able to take setting up a Rails app along with all its dependencies and turn it into such a simple, painless process. [1] Which is a perfectly valid criticism, by the way. They should really document the much saner method of installing through their official repos: https://blog.docker.com/2015/07/new-apt-and-yum-repos/

Through all the noise, this comment is exactly what I care about. For a new project, which tech's should I choose? If I were Docker, I would organize the ecosystem for the end user on a nice clean website that explicitly lists the specific layers and technology options, some of which are from Docker, and some of which are from third-parties. Yes, they'll give mention to competitors, but at least it creates clarity and puts some meat behind their claims of "Open". At present, I'm thinking of the following: * CONTAINER: Stick w/ Docker since until a competing standard like Rocket is mature, everyone has to support Docker, even CoreOS * CONTAINER MANAGEMENT: Use CoreOS. Per above, they have to support Docker until Rocket is fully baked. Then Rocket and CoreOS will probably have synergies you can't get with Docker / CoreOS. Also, from [1]: These three [Docker] orchestration services are targeted for general availability in Q2, 2015. I honestly don't know what the other layers and decisions are yet. Perspective and clarification is welcome. [1] http://blog.docker.com/2014/12/docker-announces-orchestration-for-mult…

Docker is a couple different things in one, so in that respect, it works in different ways. The main thing Docker does is run arbitrary commands with (or like) LXC, which is basically a way of running a program inside a chroot environment, plus providing a more low-level separation for various parts of the kernel. The end result is your host is kept insulated from the program being run. Here's a great HOWTO on setting up LXC: http://lxc.teegra.net/ And here's a great StackOverflow answer on what Docker/LXC does: http://stackoverflow.com/questions/16047306/how-is-docker-io-different… This page from Docker's blog discusses not only the security aspects of a container, but a comparison to traditional virtual machines: http://blog.docker.io/2013/08/containers-docker-how-secure-are-they/ And the best technical summary from Docker's documentation on what a container is: "Once you start a process in Docker from an Image, Docker fetches the image and its Parent Image, and repeats the process until it reaches the Base Image. Then the Union File System adds a read-write layer on top. That read-write layer, plus the information about its Parent Image and some additional information like its unique id, networking configuration, and resource limits is called a container." On top of that it adds a Registry, an Index, and a Remote API. So really, it has remote deployment features, it builds chroot environments, and it combines them and runs applications in…

Docker uses containerd. Here's an image straight from a blog post from last year: https://i1.wp.com/blog.docker.com/wp-content/uploads/2018/09/docker-en… https://blog.docker.com/2018/09/join-the-beta-for-docker-engine-18-09/

Especially given we used to have Meetups at the office every Thursday night, where at least 1 new Orchestration project was launched/demoed every week. The initial project the team worked on was called Beam. After about 6 months and no progress to show, the conversations referenced above happened and this is the result.. Kubernetes launched at the first DockerCon[1], early 2014. Swarm was launched[2] in beta in Dec 2014. So, roughly 1 year late to market, 6 months after initial K8 launch. 1: https://www.youtube.com/watch?v=YrxnVKZeqK8 2: https://blog.docker.com/2014/12/announcing-docker-machine-swarm-and-co…

And if you need additional security you can run the docker container inside another docker container. https://blog.docker.com/2013/09/docker-can-now-run-within-docker/ Repeat ad infinitum until you feel secure and ephemeral enough.

Docker was originally written to use LXC for containerization. It wasn't until right before 1.0 that Docker was written to use its own go based library for container handling. https://blog.docker.com/2014/03/docker-0-9-introducing-execution-drive…

>It's non discoverable. It's non intuitive. > I can't know what 'docker rm' does without reading the docs. Oh and there is 'docker rmi' is that for images? I think you're using the old CLI. A couple of years ago, they added new syntax and "encouraged" its use by default [1] (though IME people still use the original). This is definitely more discoverable and logical; the syntax would be `docker image rm` [2] or `docker container rm` [3], etc [1] https://blog.docker.com/2017/01/whats-new-in-docker-1-13/ [2] https://docs.docker.com/engine/reference/commandline/image_rm/ [3] https://docs.docker.com/engine/reference/commandline/container_rm/

Indeed, it's called HyperKit[0][1], and it's based straight off xhyve[2]. Also, there's docker-machine-driver-xhyve for people that prefer using docker-machine (like I do) instead of DfM. [0]: https://github.com/moby/hyperkit [1]: https://blog.docker.com/2016/05/docker-unikernels-open-source/ [2]: https://github.com/moby/hyperkit/tree/master/src/