• nous@programming.dev
    link
    fedilink
    English
    arrow-up
    58
    arrow-down
    1
    ·
    1 day ago

    Um no. Containers are not just chroot. Chroot is a way to isolate or namespace the filesystem giving the process run inside access only to those files. Containers do this. But they also isolate the process id, network, and various other system resources.

    Additionally with runtimes like docker they bring in vastly better tooling around this. Making them much easier to work with. They are like chroot on steroids, not simply marketing fluff.

    • Markaos@lemmy.one
      link
      fedilink
      arrow-up
      12
      ·
      1 day ago

      The author acknowledges that, the blog post seems to be aimed at demystifying the concept of namespaces by showing that a “container runtime” that only does limited filesystem namespaces (using chroot) is enough to get some widely used containers running (of course without all the nice features and possibilities of the other types of namespaces)

  • Vendetta9076@sh.itjust.works
    link
    fedilink
    arrow-up
    33
    arrow-down
    4
    ·
    1 day ago

    First of all: no, and repeating this nonsense over and over doesn’t make it any more true.

    Second of all: I truly will never understand the hatred some people have for docker. If you prefer all bare metal install, then fine. But constantly shouting from the rooftops how useless and bad docker is seems a little silly.

    • lengau@midwest.social
      link
      fedilink
      arrow-up
      3
      ·
      8 hours ago

      Containers are great, but I find Docker’s way of making container images to be pretty bad, personally. Fortunately you can use other tools to create OCI images and then copy them into Docker, as the runtime is pretty nice for dev machines.

    • Atemu@lemmy.ml
      link
      fedilink
      arrow-up
      10
      arrow-down
      1
      ·
      edit-2
      16 hours ago

      Great way to show off you haven’t actually read any of the article past its title.

    • Solumbran@lemmy.world
      link
      fedilink
      arrow-up
      16
      arrow-down
      3
      ·
      1 day ago

      Containers are fine but docker is a pain in the ass that lazy people use when they don’t want to provide clean installation/packaging.

      How many times have I seen an equivalent of “we use a custom fork of an obsolete version of an unmaintained package, so if you want to compile it yourself good luck because we forgot how we even did it. Alternatively, you can install the docker version”…

  • 𝘋𝘪𝘳𝘬@lemmy.ml
    link
    fedilink
    arrow-up
    10
    arrow-down
    1
    ·
    1 day ago

    So they say I can run a dozen of different web applications on the same machine all on the same port internally and different port externally and have a reverse proxy forwarding the traffic to the correct port based on the hostname it was called with by simply using a bunch of chrooted environments?

    • nickwitha_k (he/him)@lemmy.sdf.org
      link
      fedilink
      arrow-up
      1
      ·
      18 hours ago

      Without the chroot, that’s how shared webhosting works but it can be hundreds or thousands of sites, depending on resource usage and server capacity.

    • IsoKiero@sopuli.xyz
      link
      fedilink
      English
      arrow-up
      8
      ·
      1 day ago

      Not that it’s really relevant for the discussion, but yes. You can do that, with or without chroot.

      That’s obviously not the point, but we’re already comparing oranges and apples with chroot and containers.

  • SavvyWolf@pawb.social
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    1
    ·
    1 day ago

    Honestly, since getting into NixOS, I’ve found that much more of an elegant system than Docker or whatever.

    • Atemu@lemmy.ml
      link
      fedilink
      arrow-up
      6
      ·
      17 hours ago

      You’re comparing apples to oranges. One is a declarative Linux system environment creation solution and the other a daemon that starts sub-system environments using Linux namespaces.

      You could in theory use NixOS to define a system environment that you’d run inside of a docker container. It’s a bit harder to get systemd running inside of Docker which NixOS heavily relies on but that’s beside the point. Easier integrations exist for LXD and systemd-nspawn which actually fulfil an equivalent purpose to Docker. The single component that is most comparable to Docker in a typical NixOS deployment would arguably be its init process (systemd), though its use extends far beyond setting up the namespace (the root namespace in this case).

      • SavvyWolf@pawb.social
        link
        fedilink
        English
        arrow-up
        3
        ·
        11 hours ago

        As I understand it, the problem that both Nix and Docker try to solve is “How do I bundle and run this application in such a way that its dependencies are explicitly specified and don’t interfere with anything installed on the host system”.

        They have different approaches, but I think that goal is the same?

        • Atemu@lemmy.ml
          link
          fedilink
          arrow-up
          1
          ·
          2 hours ago

          That’s Nix, not NixOS.

          I also wouldn’t be too sure on that “explicit” part for Docker. It’s somewhat isolated, sure, but everything but explicit: you can download arbitrary data from wherever you like.

          • SavvyWolf@pawb.social
            link
            fedilink
            English
            arrow-up
            3
            ·
            2 hours ago

            Unless it has changed recently, Docker is not intended to be a security layer as far as I know.