Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> So I am looking for a cleaner container solution

You need to understand what containers are first. Containers are not one thing. They are an amalgam of different OS primitives designed to give you the maximum flexibility, control, and isolation for an application environment.

When you say Docker is "cluttering" your system with processes, you mean the daemon that is used to start and manage containers on your system. There are alternative container systems that don't use a daemon, and can run rootless, but they have some tradeoffs. They are also not nearly as portable or easy to use as Docker, as a whole.

Yes, it "occupies" IP space, by default. You can disable or reconfigure the networking aspect of container solutions, to either use a different subnet, or just use the host's native networking. But then you won't get network isolation for your containerized app, and you will probably complain that you can only run one process on a given port at a time, and without a firewall, people on the train will be attacking your containerized apps.

> So I am looking for a cleaner container solution.

There isn't such a thing as clean software. People like to generalize like this, but what it usually means when they say "clean" is "I want it to be magic, as simple as possible, do everything I could ever want, and to not have to think about it". Which is wanting to have your cake and eat it too. Either it does everything for you and it's complex, or you have to get your hands a little dirty and it's simple.

> One that feels more like a Linux tool that keeps the system intact

Point in case: you want it to maintain the system for you.. Docker does that. The end result is what you call "clutter".

> and only runs when it runs.

You want a rootless daemonless container frontend, like Podman. Good luck getting it to work... Don't @ me when you find out it's a lot of extra effort that doesn't give you anything better than Docker did.

Kata containers is for service providers. Nobody really needs that level of isolation on their laptops.



> and without a firewall, people on the train will be attacking your containerized apps.

I was surprised when I learned this but Docker by default bypasses UFW and potentially other firewalls relying on iptables.

https://blog.viktorpetersson.com/2014/11/03/the-dangers-of-u...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: