Hacker News new | ask | show | jobs
by chatmasta 4085 days ago
THE STORY OF THE CONTAINER GOLDRUSH

As seen by a verbose, presumptuous 22 year old.

OPEN SOURCE MOVEMENT lays foundation for containerization:

- linux kernel gains mainstream adoption, becomes standardized across distributions

- kernel matures to support containerization (i.e., namespacing critical OS operations)

- lxc project takes advantage of kernel support, builds tooling around namespace containerization

DOCKER (THEN DOTCLOUD) is first company to capitalize on power of containerization:

- dotcloud demonstrates clear use case for containers, encouraging developer adoption

- dotcloud releases internal infrastructure code ("moves up the value chain") for PaaS

- dotcloud develops project into docker, builds existing momentum into early adoption of docker.

AT THIS POINT other companies begin to emerge around Docker, e.g. CoreOS. Key facts:

- Docker is an abstraction around LXC, effectively a set of convenient scripts for controlling LXC

- Docker is building a platform via a package management system preloaded with their repos

- Platform is a threat to new entrants, e.g. CoreOS, because they risk becoming tenants

CoreOS realized the risk of the Docker platform, and also that Docker is unnecessary for many of its value-adds. Everything Docker can accomplish, raw linux containers can also accomplish. The problem is that scripting LXC is less convenient than using Docker, but Docker depends on LXC, therefore LXC featureset will always be ahead of Docker.

In the developer community, there is a growing acceptance of the fact that Docker is an abstraction over LXC. CoreOS is trying to standardize the abstraction as an implementation of the "app container spec" [0]. This spec puts Docker, Rocket, and lxc-tools on level playing ground.

Despite this apparent acceptance, the market continues to build tooling and platforms around Docker, instead of raw LXC containers. This announcement from Microsoft is just the latest example. If a new product wants to support containers, it needs to support Docker.

Docker is benefitting from network effects even though its product is not defensible from a technical standpoint. Docker is signing deals with competing enterprises like Microsoft, Google, and Amazon, because those companies are its customers.

The risk for Docker is that these big companies eventually cut Docker out of the equation. They may eventually choose to replace Docker with their own "app container runtime," with features only supported on their own platform.

Docker was one of the first companies to capitalize on advantages of containers, probably because they have a seriously talented group of engineers writing their code. But the market has now woken up to these advantages, and Docker is being chased by massive companies with massive resources. I hope they can fend them off and keep the upper hand in the relationship, but unfortunately I think it far more likely that Docker will eventually be cut out of the equation or acquired by one of them. This will result in a fragmentation of container technology as each company rushes to develop their own app runtime engine. Ultimately developers will suffer as platforms divide and silo, increasing developer friction and reducing cloud market competition as users consolidate around the single platform with the most momentum. Eventually, I suspect one company will control 80% of cloud computing.

[0] https://github.com/appc/spec/blob/master/SPEC.md

1 comments

You forgot the part where Solaris did containers first in 2005.

Others "realised" the value of this later and started improving upon the ideas contained within.

Although I'm sure many might argue that this is the natural conclusion of virtualization.

And where FreeBSD did jails in 2000 (or actually a bit earlier).

https://www.freebsd.org/releases/4.0R/notes.html

Yes, everyone refers to jails, but I think most people would agree that jails weren't really containers. They didn't provide true isolation for a set of applications. I guess you could argue they were the original prototype for them though.

Solaris containers are the first "lightweight virtualization" technology that I'm personally aware of that provided true isolation of one more processes from the host operating system and host processes.

Not sure if "lightweight" counts when talking about a mainframe, but when first encountering Solaris zones they seemed equivalent to LPAR's in the mainframe world.

http://en.wikipedia.org/wiki/VM_%28operating_system%29

There are a lot of things from the mainframe world that are being newly "discovered" that seem quite mundane to the greybeards...

http://en.wikipedia.org/wiki/IBM_System_z#Comparison_to_othe...

Yes, there are LPARs, but we were discussing software-based virtualisation. LPARs are more partitioning than virtualization which is very different from a multi-tenancy perspective.

The equivalent to LPARs in the Solaris world would be LDOMs on SPARC.

"Yes, everyone refers to jails, but I think most people would agree that jails weren't really containers. They didn't provide true isolation for a set of applications. I guess you could argue they were the original prototype for them though."

The first VPS provider (JohnCompanies, 2001) was based entirely on jail and it absolutely provided (even then) true isolation for a set of applications.

Every customer had their own unix root and their own rc.conf configured their own system and everyone ran their own sendmail/named/httpd/etc.

It is absolutely correct to refer to jails in this way, and that is why you see everyone doing it.

If you're talking about chroot jails, no, it was possible to "escape" jails they did not provide true isolation.

If you're talking about some other jail, possibly, but my understanding is they didn't actually provide true isolation. Certainly not a kernel-level of abstraction.

Good point. The idea of containerization has existed for a long time. A widespread implementation of it has not. The levels of abstraction are "idea of containerization" -> kernel implementation -> userspace tools. LXC, Solaris Containers, BSD jails all exist at kernel level of abstraction. Docker, Rocket, lxc-tools exist at userspace level of abstraction.

For any component at a given level of abstraction to gain widspread adoption, it needs to beat its competitors. Linux kernel needed to beat FreeBSD and Solaris. That's why I started the story with "linux kernel gains mainstream adoption." Consolidation at the kernel abstraction level is complete. Linux won. Now it's time for consolidation in the userspace abstraction level.

Solaris containers are no longer just a kernel level of abstraction though. As of Solaris 11.2 they're also capable of providing a near-system-level of abstraction via "Kernel Zones":

http://docs.oracle.com/cd/E36784_01/html/E37629/

These allow virtualization of multiple, independent instances of the operating system each with their own version of the kernel and processes. It is not the same as running multiple instances of VMWare, etc. since it is specifically designed to handle virtual Solaris instances:

https://blogs.oracle.com/zoneszone/entry/install_a_kernel_zo...

Windows NT had them since 2000: https://www.microsoft.com/msj/0399/jobkernelobj/jobkernelobj... They are called Job Objects in NT, as opposed to Namespaces or Zones in other kernels.
You forgot the part where FreeBSD 4.0 added jails in March 2000 [1].

You could argue that jails were inspired by chroot(), and that's correct, but that's hardly any isolation.

[1] http://phk.freebsd.dk/pubs/sane2000-jail.pdf

"You forgot the part where Solaris did containers first in 2005."

FreeBSD jail in 2000.