[geerlingguy]

Some of the points mentioned in the article are in my top hitlist (for decidedly smaller production infrastructure than Shopify): Image building, Logging, Secrets, and Filesystems.

But really, the most painful aspect of using Docker in production, at least in environments where you need multiple physical servers (or VMs) is overall orchestration of the containers, and networking between them.

Things are much better today than they were a year (or 6 months!) ago... but these are two parts of Docker configuration that take the longest to get right.

For orchestration: there are currently at least a dozen different ways to manage containers on multiple servers, and a few seem to be gaining more steam, but it feels much like the JS frameworks era, where there's a new orchestration tool every week: flynn, deis, coreos, mesos, serf, fleet, kubernetes, atomic, machine/swarm/compose, openstack, etc. How does one keep up with all these? Not to mention all the other tooling in software like Ansible, Chef, etc.

For networking: if you're running all your containers on one VM (as most developers do), it's not a big deal. But if you need containers on multiple servers, you not only have to deal with the servers' configuration, provisioning, and networking, but also the containers inside, and getting them to play nicely through the servers' networks. It's akin to running multiple VMs on one physical machine, but without using tools like VMWare or VirtualBox to manage the networking aspects.

Networking is challenging, but at least we have a lot of experience with VMs, which are conceptually similar. Orchestration may take more time to nail down and standardize.

[mbrock]

On these points, what are you comparing Docker to? Using bridged networking, you have pretty much the exact same situation with Docker as without. And just because you're running processes with Docker doesn't mean you have to keep up with dozens of tools for automatic clustering and whatnot. If you want to just start your processes manually, or with Ansible or Makefiles or whatever, you can do that.

[danesparza]

Agreed -- "Logging, Secrets, and Filesystems" would be interesting problems to solve in any architecture. Docker might shine a clearer light on any inconsistencies -- but wouldn't make these any easier or harder.

[kiyoto]

On the logging front, there is some options now: syslog, GELF and Fluentd.