Docker has several issues that make it unsuitable for managing infrastructure over many years, including frequent breaking changes in new releases, difficulty cleaning up old images, and lack of kernel support. While containers provide benefits like isolation and reproducible environments, monitoring and debugging containers is challenging. Docker also adds security risks compared to traditional infrastructure stacks due to additional layers like registries and daemons.

1. Boycott Docker

2. Solomon Hykes
Founder, CTO Docker
Are you sure?

3. Keep Calm!

4. This talk is NOT
about blaming Docker…

5. …only it’s not suitable
for simple environment

7. Docker do and don't

8. Paolo Tonin
Sysadmin
Cloud Solution Architect @Ideato
Email: pt@ideato.it
@paolopstonin

9. Warning

10. Warning

16. Build
new applications
Application
performance
Maintain
infrastructure
over years
Quality code
Testing
Ensure application
availability
Compliance
Deploy new code
Dev OPS

17. Maintain infrastructure
over years
Focus on

18. Docker Issue #1
Breaking changes
1.6 => 1.7 => 1.8 => 1.9 => 1.10
=> 1.11 => 1.12 => 1.13 =>
17.03 CE

19. Docker Issue #2
Can’t clean old images
$ docker images -q -a |
xargs --no-run-if-empty
docker rmi

20. Docker Issue #2
Can’t clean old images
$ docker images -q -a |
xargs --no-run-if-empty
docker rmi

21. Docker Issue #2
Solution from 1.13 (2 months ago)
$ docker system prune -a

22. Docker Issue #3
Kernel support
Linux 3.x: Unstable storage drivers
The AUFS driver is unstable. It suffers
from critical bugs provoking kernel
panics and corrupting data
# hostnamectl
[cut...]
Operating System: CentOS Linux 7 (Core)
CPE OS Name: cpe:/o:centos:centos:7
Kernel: Linux 3.10.0-514.6.1.el7.x86_64

23. Docker Issue #3
Kernel support
Linux 4.x: The kernel officially
dropped AUFS support
You must migrate to
Overlay filesystem

24. Docker Issue #3
Kernel support
Linux 4.x: The kernel officially
dropped AUFS support
Ah uhm…to Overlay2
from Docker 1.12

25. Docker Issue #4
Share bare files images
Only via some Registry*
* DAB Experimental

26. Docker Issue #4
Share bare files images
$ rkt
—insecure-skip-verify
fetch docker://nginx

27. Docker Issue #4
Share bare files images
$ rkt fetch my_container.aci

28. Docker Issue #5
The release cycle
Release cycle constant in the
Docker ecosystem:

29. Docker Issue #5
The release cycle
Release cycle constant in the
Docker ecosystem:
1. Abandon whatever exists

30. Docker Issue #5
The release cycle
Release cycle constant in the
Docker ecosystem:
2. Make new stuff and release

31. 3. Ignore existing users
and retro compatibility

32. (Subtitle)

33. Managing one host is
straightforward

34. Managing a fleet is hard

36. Modern infrastructure

37. UNRESOLVED PROBLEMS
(A.K.A.)
Fix again old problems
already resolved in
traditional infrastructure

38. Share permission between
host and container

39. Share users between
host and container
Host
# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
web1:x:0:0:web1:/root:/bin/false
web2:x:0:0:web2:/root:/bin/false
web3:x:0:0:web3:/root:/bin/false

40. Share users between
host and container
Container
# docker run -d -p 80 nginx-php71-fpm
-v /etc/passwd:/etc/passwd ro
-v /etc/group:/etc/group:ro

41. Let’s solve two
common problems

42. 1. Injecting / share
contents

43. Injecting / share contents
(old approach)

44. Modern solution
A.K.A.
Add more complexity
than using traditional
provisioning tools

45. Sidecar Containers

46. Sidecar Containers

47. 2. Build multi-project
staging server!

48. Build multi-project
staging server!

49. Build multi-project
staging server!

50. It's worth?
Simpler than
traditionals VM with
provisioning tools?

51. Infrastructure glues

53. Docker does not need
any particular framework,
packaging system or
configuration language

54. Your application has to be
Docker locked-in. Other
container are just isolated
processes
Docker does not need
any particular framework,
packaging system or
configuration language

55. Containers Are Great:
less overhead, isolation,
reproducibility of environments
(1)

56. Containers Are Great:
less overhead, isolation,
reproducibility of environments
(1)
Debug HELL, available
interaction is containers
API or an interactive shell

57. Containers Are Great:
less overhead, isolation,
reproducibility of environments
(2)
But monitoring and
inspecting containers
is not easy

58. Using containers you gain
more security!

59. Using containers you gain
more security!
Docker stack has more
layers you need to secure
than a traditional stack
(app, registry, daemon …)

60. “Yes, you can host your database
in a Docker container!” (1)

61. “Yes, you can host your database
in a Docker container!” (1)
MySQL (and databases)
are not well integrated with
containers

62. “Yes, you can host your database
in a Docker container!” (2)

63. “Yes, you can host your database
in a Docker container!” (3)
But why?!? Only for allow
developers to change
version?!?

64. Ever tried to security
update
a container?

65. Ever tried to security
update
a container? (1)
Download a unsigned
binary, running it, and
hoping it does not
contain any backdoor

66. Ever tried to security
update
a container? (2)
Security is not just
isolation

67. Scaling?! No problem!
$ docker service scale myapp=50

68. Scaling?! No problem! (1)
$ docker service scale myapp=50
In the same VM or
Bare metal ?

69. Scaling?! No problem! (2)
$ docker service scale myapp=50
It is a crime to pay for
an entire hour just to
power-on an instance

70. Scaling?! No problem! (2)
$ docker service scale myapp=50

71. I like Docker for…

72. Binpacking
(for simple
and polyglot applications)

73. Binpacking

74. Isolate single process
into a single host

75. Host mode network

76. Developer environment

77. Docker generator

78. Docker generator

79. Docker generator
Pay attention about
performance*
* (Docker for Mac version)

80. Final words
1. Start small for existing projects
2. Greenfield or Microservices
3. Plan your strategy for:
-Static port mapping
-Per environment config
-Persistent data

82. Questions?!?