Remix.run Logo
▲ shykes a day ago

Hi, I'm the creator of Docker and came across this post. It's always fun to see other engineers think about how you designed a system. I haven't been involved in developing Docker in many years, but it's a fun trip down memory lane.

I'm happy to answer any questions you may have.

▲pixelmonkey a day ago | parent | next [-]

I was in the audience when you gave the 5-minute docker lightning talk at PyCon US Santa Clara in 2013. I remember chatting with a friend/colleague about it (https://nvie.com/about/) and we both agreed it was the most interesting lightning talk that day.

What’s funny, though, is that since it was “just” a lightning talk, it didn’t even make it into the roundup of notes I sent to my team after PyCon. But a mere year later, Docker was how my team (and seemingly everyone else) ran projects locally.

Any interesting memories from that day in 2013? From your perspective, what happened in the year that followed that caused docker to be adopted so widely? Were there other key moments or turning points?

▲shykes a day ago | parent | next [-]

> Any interesting memories from that day in 2013?

That day is forever engraved in my memory... Off the top of my head:

I signed up for a lightning talk expecting an audience of 10-20 people, for a confidential demo of our unfinished project that we had so far only showed in 1-1 demos. Imagine my surprise when I learned Pycon does lightning talks on the main stage!

The previous speaker didn't show, so I started early. In the recording you can hear me joke that perhaps I should get his time allocation too - the MC was not amused.

I went over time and had to speedtalk through the end.. The MC once again was not amused and practically shoved me off stage :-D

We had a small sponsor booth at the even, where our small marketing team was prepared to pitch our product (DotCloud) but was thoroughly confused when a horde of people showed up after the talk, to ask about "Docker" - which as far as they knew was the founder's side project.

I drove down to Santa Clara on my newly acquired motorcycle - my very first trip on the freeway. I remember telling myself, "today is the day to take all the risks!"

▲gortok 14 hours ago | parent | next [-]

I was there as well, and while I was really impressed; I was also weirdly weirded out that this wasn’t a bigger deal to all the folks in attendance. And so that made me doubt that what I saw was that impressive, as surely other folks in the audience would know better than I would.

▲nzealand 11 hours ago | parent | prev | next [-]

Whenever I am anxious about a presentation, a motorcycle ride to the presentation usually puts everything in perspective.

▲vel0city 10 hours ago | parent [-]

I agree with this take, even not riding as much as I'd like these days.

I had a pretty much near death motorcycle accident I happened to mostly walk away from which really made me restructure my perspective on things I'm afraid of.

It also managed to make my then to be wife realize she really couldn't live without me when I sent her a photo of a mangled bike and the text "ouchies", so that accident really changed my life positively and radically.

Although I'm still sad it destroyed my OG Surface Pro. It was a maxed out launch model with the year of the dragon touch cover I bought at a Microsoft store at a mall that doesn't even exist anymore. Worn in a messenger bag on my back, and ended up like a crazy twisted piece of metal in the end.

So yeah. Motorcycles. They'll change your life.

▲indymike 10 hours ago | parent | prev | next [-]

I was there :-) My business partner at pycon observed that Docker looked like a complicated way to fix easy_install (at the time it looked like to official fix would be to adopt pip). I thought it had some potential :-) but definitely didn't expect it to take over the way it did.

▲w8vY7ER a day ago | parent | prev | next [-]

How much have you ridden since that day? Any new bikes?

▲elendilm 11 hours ago | parent | prev | next [-]

That literally was history in the making. Much respect.

▲buddhistdude 15 hours ago | parent | prev [-]

now imagine what the guy who invented AI must've thought on his first motorcycle ride back from work

▲Rediscover 14 hours ago | parent [-]

Referencing bicycles and Dr. Albert Hofmann?

▲raymond_goo a day ago | parent | prev | next [-]

The Video in Question: https://www.youtube.com/watch?v=wW9CAH9nSLs

▲ignurant 17 hours ago | parent | next [-]

This is wild to see. I remember how exciting this was when I eventually learned about this tech. To see it minimized to a five minute surprise intro like this and then shuffled off stage is amazing. Thanks for sharing the video in this context.

▲tkapin 20 hours ago | parent | prev [-]

Thanks for sharing this, a really interesting piece of history. It’s always nice to look back at the beginnings of great technology that powers the modern world. Also, thank you, Solomon!

▲zerkten 11 hours ago | parent | prev [-]

The recording of that lightning talk session is at https://pyvideo.org/pycon-us-2013/friday-evening-lightning-t.... I was there too and was among those who didn't get it immediately. I do recall more and some mentions of that talk during conversations through the remainder of PyCon though.

▲davnicwil a day ago | parent | prev | next [-]

I'm a big fan of docker and mainly just want to say thanks for bringing it about.

I remember my first time trying to use a container was about 2015 on a beach cafe's wifi in Bocas del Toro, Panama. You can imagine how it went...

After a brief hiatus though I was back to it and since then it's been a core part of many a local dev stack and even production stack (compose) I've set up. I recall the magic moment for me being when I first realised you could mount src to use all your local native dev tools while completely virtualising everything else, including and especially whatever combo of runtimes and dependencies you need.

It was just a lightbulb moment, like it entirely solves 'works on my machine', setting new people up on a project, it just seems like how software engineering ought to work and once you have experienced it it's difficult to go back.

I'm curious, as its creator are you still using it, or as someone who can clearly look ahead to experimental ways of doing things are you on to the next thing whatever that may be? If so, what is it? :-)

▲shykes a day ago | parent [-]

Thank you for sharing that!

Yes, I still use Docker. Although my way of using it has changed over time, like many others I assume.

My new project, Dagger, although it doesn't directly compete with Docker, does implement its own container runtime and orchestrator (for CI pipelines), and we recently added compatibility with Dockerfiles and Docker Compose files... So increasingly I find myself using Dagger instead of Docker, in the context of my CI pipelines.

On the other hand, I use docker compose on almost every personal project - like a minecraft server for my kids, home automation, AI hacks, etc. These days I just let my AI agent set it up for me, though :)

▲elliottmoos 19 hours ago | parent | next [-]

Love Dagger! Not sure how I missed the connection here until now.

“You’re overpaying for CI” (https://www.youtube.com/watch?v=tsH3eTo2GLI) from KubeCon 2024 seems especially pertinent these days with AI.

Was one of my favorite talks that year and really made Dagger click for me.

▲kpen11 13 hours ago | parent [-]

Thats me! I really enjoyed putting that one together and I'm thrilled that people are still talking about it :)

▲davnicwil a day ago | parent | prev | next [-]

I'll check out Dagger, sounds interesting.

Yeah I've really been enjoying using AI to write docker/compose config and related ad hoc scripts. It was all pretty understandable anyway, but now you can just set up whatever you can think of in literally minutes, even if you just want a particular configuration as a one off. It's a great era for devops!

▲jacques_chester a day ago | parent | prev | next [-]

> does implement its own container runtime

I take it vito talked you into adopting Garden? </injoke>

▲MomsAVoxell a day ago | parent | prev [-]

I’m curious if your background gave you experience with other operating systems, such as TandemOS?

▲FlyingSnake a day ago | parent | prev | next [-]

Thank you for inventing Docker, it truly changed the life of many developers.

I was there when dotCloud announced Docker in 2013 and it was truly pragmatic. I had previously burned my hands on LXC, Juju Charms and Vagrant to containerize the apps, but it was all a house of cards. I remember helping a friend ship his whole Vagrant Box to the interview panel for a job!

It’s incredible to think about how much boilerplate Docker removed right at it's launch. Thank you.

▲mexicocitinluez 17 hours ago | parent [-]

> it truly changed the life of many developers.

That's for sure, especially for local dev.

▲shykes 10 hours ago | parent | prev | next [-]

By the way, I just launched my new thing today :) They say lightning never strikes twice, but you never know!

I hope the plug is appropriate in this setting - apologies if not.

https://dagger.io/blog/dagger-10-beta/

▲daitangio 14 hours ago | parent | prev | next [-]

I'm a super fan of docker and I also want to say thanks for designing it.

I think docker is not weird, it is very linear.

Docker has the merit to take a bunch of tools and to create an organized view of it.

I want to point you to Misterio https://github.com/daitangio/misterio which is a very thin layer on top of docker compose.

It simplify my homelab and works like a charm, and it is a waaaaay easier to use than k8s.

Thank you again, and let me know if you plan a trip in Milan :) for a meeting

▲figmert a day ago | parent | prev | next [-]

I'm curious what made think of it in the first place? What was your thought process that made you think that these Linux primitives give the opportunity to make it a platform for distributing and deploying packaged applications and eliminating a lot of the issue around "it works my machine" argument?

You may have already answered this somewhere, so feel free to tell me what to search for or if you have a link to hand, that works too :)

▲bijmtir a day ago | parent [-]

Docker was basically a commercialisation of lxc and now we got nspawn going full circle.

▲shykes a day ago | parent | next [-]

This is incorrect.

Docker in its earlier incarnations was based on openvz, which predates lxc. The lxc project was initially a kernel development project: a collection of kernel patches to add container support. The userland tool was just a companion. When it became apparent that these patches would "win" the race to be upstreamed even though openvz was much more mature, we switched our tooling to lxc. The patches matured over time, but the userland tool (what we now know as "lxc") was finicky.

The original open-source release of Docker wrapped lxc for low-level container operations. But it was just too unreliable and we swapped it out for an in-house Go implementation called "libcontainer".

As for "commercializing": Docker was famously bad at commercializing anything, we open sourced so much (maybe too much) and still people complained that we were not open enough.

▲stingraycharles a day ago | parent | next [-]

“Docker was famously bad at commercializing anything, we open sourced so much (maybe too much) and still people complained that we were not open enough”

Developers are a tough market to please, especially when your business revolves around open source software.

Unless you have an option to do private cloud hosting (like all these databases and other platforms do), it’s incredibly difficult to monetize.

In the case of docker, I think it’s in the nature of the product that it’s difficult to monetize. Best you can do is enterprise support contracts, but those aren’t good enough to justify all that VC funding.

▲dralley a day ago | parent | next [-]

I don't think it's necessarily that difficult to monetize, they just ignored a lot of the needs of enterprise users (rootless, not punching holes in the firewall, not fighting with systemd, private registries) for long enough that other projects (e.g. Podman, Quay) filled the void.

▲shykes 20 hours ago | parent [-]

None of those things were obstacles to commercialization. None of them were common requests from enterprise customers except private registries, which Docker did build.

Podman has never been commercialized.

Docker's difficulties in commercializing were self-inflicted. Enterprise and open source teams were culturally siloed and as a result the enterprise products were not "native". There was a lack of focus and a "checkbox" approach to building product. There was no singular "dictator" who could enforce a coherent product design and vision, and it showed. etc.

▲sheepscreek 16 hours ago | parent [-]

I was a DotCloud user before Docker, and I remember keenly thinking - “oh, is that how they went from hosting only PHP to any language/stack?”

I always assumed it was the same internal tech, now productized. Then of course, it became THE tech, overtaking vagrant and anything else for local development and deployment. The latter was the true money shot. Server runs exactly what you test with locally.

▲justsomehnguy a day ago | parent | prev [-]

> Docker was famously bad at commercializing anything

That's because there was never a proper sysadmin on your team to slap some sense in your decisions.

You've got too opinionated[0], too tied on yourself[1] monster which required too much resources what you can handle alone.

And your market is not the developers but the companies where whose developers have a daytime jobs: https://news.ycombinator.com/item?id=34377674

BTW just for giggles opened hub.docker.com with Network Tools opened:

368 requests, 9.62MB, Finish: 4.50s.

For a thing which should be a static cached copy with everything bundled. Sure, it's a progress from the previous iterations when it could hang for 30 seconds before actually loading... but this is still ridiculous.

[0] https://news.ycombinator.com/item?id=46739153

[1] Eg: the syntax to point the image to a specific registry is something... bad. So bad I just abandoned running my own registry, it wasn't worth it.

PS there is still (AFAIK) no support for a transaction-like image building in Compose. So instead of something like this:

    TRANSACTION START
        RUNBATCH set -eux
        # TODO find a better userspace architecture detection method than querying the kernel
            arch="$(uname -m)"
            case "$arch" in \
                aarch64) gosuArch='arm64' ;
                x86_64) gosuArch='amd64' ;
                *) echo >&2 "error: unsupported architecture: '$arch'"; exit 1 ;
            esac
            curl -fL -o /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$gosuArch.asc"
            curl -fL -o /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$gosuArch"
            export GNUPGHOME="$(mktemp -d)"
            gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
            gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu
            rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc
            chmod +x /usr/local/bin/gosu
            gosu --version
            gosu nobody true
    TRANSACTION END
people need to write these one-liner abominations:

    RUN set -eux; \
    # TODO find a better userspace architecture detection method than querying the kernel
        arch="$(uname -m)"; \
        case "$arch" in \
            aarch64) gosuArch='arm64' ;; \
            x86_64) gosuArch='amd64' ;; \
            *) echo >&2 "error: unsupported architecture: '$arch'"; exit 1 ;; \
        esac; \
        curl -fL -o /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$gosuArch.asc"; \
        curl -fL -o /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$gosuArch"; \
        export GNUPGHOME="$(mktemp -d)"; \
        gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \
        gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
        rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \
        chmod +x /usr/local/bin/gosu; \
        gosu --version; \
        gosu nobody true
EDIT: to add on [1]: https://news.ycombinator.com/item?id=35312087
▲dns_snek 21 hours ago | parent | next [-]

> You've got too opinionated [0]

>>[0] 'Bridge' was and still is an established network term for joining two broadcast domains into one. Why the hell you decided to name your NAT'ed network layer a 'bridge'?

Like they told you 9 months ago, the terminology is exactly right. They're called "bridge" networks because they use Linux `bridge` devices to bridge `tap` adapters of all containers attached to the same Docker network.

There's nothing exotic about this terminology at all and complaining about it betrays your own lack of knowledge.

> PS there is still (AFAIK) no support for a transaction-like image building in Compose. So instead of something like this:

Do you mean Dockerfiles? RUN command has had heredoc support for 5 years now.

https://docs.docker.com/reference/dockerfile/#run

▲justsomehnguy 20 hours ago | parent [-]

> Like they told you 9 months ago, the terminology is exactly right

Oh, well. I guess you ride to your work on wheels, right? Because while you sit in the car/bus/train it's the wheels what actually rides on the road/track, right?

And if you bothered to look at that comment then why do you ignore what 'macvlan' - which is an actual bridge both in terms of a Linux device and the functionality - is not called 'bridge'?

Because you don't understand the problem. More so, you ignore the actual question there about the broadcast domains.

No, if even if you use a bridge internally when your container is on a isolated network which is invisible to anyone on your network and the container access the network behind your host through the NAT - this can't be called a bridge.

You see, if they just called it as it should, ig:

   bridge  => hostnatnetwork // or internalbridgenatnetwork or whatever else 
   macvlan => bridge
then they would be both named correctly and be the technically correct - and 99% of Docker users couldn't tell a difference - because they are not net or sys administrators.

But the last 1% is the people who actually makes the workspaces for these developers where they actually do run their fancy-shmancy containers. And for that 1% it surely pays naming this as they are.

And there is also that dumb decision to silently rewrite 127.0.0.1 to Google DNS without a question. Especially when 98% of Docker users are incapable to diagnose it by themselves.

So it's not only the naming of a network functions.

But hey, I'm just knowledge lacking guy without experience at all, just yesterday saw a computer a first time in my life, sure, sure.

> RUN command has had heredoc support for 5 years now

So ten years late? Adoption is off the limits, as you can see - that snippet is from the official Docker image.

And if I need to run multiple commands and not just one RUN statement? Like the people are asking for years? And you so knowledgeable person of course do know the reason for that, right?

▲zbentley 13 hours ago | parent | next [-]

I think there are some interesting points there, but your rude, arrogant, and aggrieved tone overwhelms them.

If you decide to edit your tone, I'm happy to discuss more here re: filesystem transactionality tradeoffs, since that's something I've struggled with in both directions WRT containers.

▲justsomehnguy 8 hours ago | parent [-]

I'm only responding in kind to GP - no less but not more.

I think you are the one who built an alternate layering system? On mobile, don't like to search rn.

If yes the basics are in the first comment- just not limited to the one RUN statement ofc. And if I do remember how the layers are made then making it transaction-like would be a great dedup saver eg for adding a static rarely changed artifacts - there could be essentially a ~one layer for how many you want images.

Implementation wouldn't be so difficult - you just stop committing until TRAN END; but the main is too provide a mental model for a not very experiencied dev how this supports his work and makes it more efficient on the storage and execution.

▲dns_snek 19 hours ago | parent | prev [-]

> And if you bothered to look at that comment then why do you ignore what 'macvlan' - which is an actual bridge both in terms of a Linux device and the functionality - is not called 'bridge'?

Because renaming things that map 1:1 onto the underlying concepts is a terrible idea that makes learning and communication harder by introducing ambiguity and indirection. "bridge" now means multiple things and not only is it needlessly obfuscated, it's wrong (explained later). I _hate_ projects that do this.

> Because you don't understand the problem. More so, you ignore the actual question there about the broadcast domains.

A Docker 'bridge' network driver creates a broadcast domain between containers attached to that network.

Rhetorical question, maybe it'll help you find a source of misunderstanding: Why do you expect it to join the broadcast domains of your containers and your LAN? And which LAN, exactly?

> No, if even if you use a bridge internally when your container is on a isolated network which is invisible to anyone on your network and the container access the network behind your host through the NAT - this can't be called a bridge.

Your misunderstanding seems to stem from the flawed assumption/expectation that every container is automatically attached to your LAN. Therefore you incorrectly expect and demand that term "bridge" accurately describe the logical connection between your container and your LAN.

Docker networks are entities independent of your LAN, they're isolated networks that primarily serve to connect containers amongst themselves.

A Docker 'bridge' network is not necessarily routed to LAN either so your suggestion of calling them "hostnatnetwork" is wrong. Auto-configuration of NAT between the internal bridge network and your LAN is just a convenience feature which you can disable, it's not an inherent property of bridge networks.

Disabling NAT for a specific brige network (com.docker.network.bridge.enable_ip_masquerade): https://docs.docker.com/engine/network/drivers/bridge/

Disabling auto-configuration of all firewall rules: https://docs.docker.com/engine/network/packet-filtering-fire...

> But hey, I'm just knowledge lacking guy without experience at all, just yesterday saw a computer a first time in my life, sure, sure.

No I didn't say that, I think you suffer from the curse of having a lot of previous experience in an adjacent area where you built a strong mental model of how things ought to work, but now you're trying to forcefully apply this same mental model onto Docker.

All of this networking terminology is consistent and applied correctly but for some reason it's not clicking with your previous knowledge and you're trying to fit a square peg through a round hole. Take a step back, investigate.

> So ten years late?

Don't shift the goalposts. You claimed it still doesn't exist.

▲grosswait 17 hours ago | parent | next [-]

> No I didn't say that, I think you suffer from the curse of having a lot of previous experience in an adjacent area where you built a strong mental model of how things ought to work, but now you're trying to forcefully apply this same mental model onto Docker. I think you just proved his point. Docker came onto the scene and hit roadblocks in enterprises where sysadmins lived. These architectural and terminology choices ran head on into well established domains. Yes, docker did change things, but I think his point is it would’ve had more success with paying customers if the authors of docker had a better understanding of established network administration and system administration concepts from the start (though these were the early devops days…). That lack of understanding caused adoption friction in enterprise space, and different choices could’ve prevented that without changing at all the paradigm of what docker is.

The docker mental model isn’t crazy different. Design choices made it unnecessarily less compatible with existing mental models. This probably contributed to the feeling of it being revolutionary, but impeded its adoption with paying customers.

▲dns_snek 16 hours ago | parent [-]

Can you be more concrete?

In my experience adoption was primarily driven by developers and sacrificing clarity would hurt adoption. This perfect familiarity was never achievable anyhow. Docker was a completely new paradigm in software development, similar to how modern cars aren't just horse carriages without the horse. It transformed everything from development, testing, deployment, updates.

Experienced sysadmins often tried to approach it with "VMs but with less overhead" mentality, which couldn't possibly work. Coworkers would ask me how they can install SSH daemons in containers to update packages and view logs, or they would refuse to adopt Dockerfiles, sometimes setting up the container manually and exporting the image. They would wonder how to install many different services in 1 container and handle crashes, etc. It was a huge shift.

> Design choices made it unnecessarily less compatible with existing mental models.

Again, I disagree. Whose mental model do you prioritize? How invested are you in making Docker work just like whatever elaborate system those enterprise admins used before?

Let's not forget that by creating new abstractions, you're penalizing users who already possess foundational knowledge of the primitives. If you do this then I'm probably going to get a whiff that you care more about enterprise sales than developer experience (duh) which is a huge red flag for me.

▲justsomehnguy 15 hours ago | parent | prev [-]

> Because renaming things that map 1:1 onto the underlying concepts is a terrible idea that makes

Sorry, but you do insist on naming 'docker' bridge a bridge because it's underlying tech is a bridge. Make up your mind.

> A Docker 'bridge' network driver creates a broadcast domain between containers attached to that network.

And noone absolutely ever cared about what it's a bridge down there. It could be using gronklew and maybe 20 people on the planet would care to learn what it is.

You are quite bent on it, but nobody cares how the containers talk between each other.

> Why do you expect it to join the broadcast domains of your containers and your LAN?

I expect a setting named 'bridge' in some $thing to actually implement a bridge.

Just like you pressing an AC button in your car expect a very specific thing to turn on/off and not 'Artifically flavoured windshield wipers served in a Container'.

Why do I want it is on me. Maybe I need it. Maybe I control my network and freely give out addresses to anything. Maybe I don't run on some cheap VPS somewere with only 1 IP I can't choose nor change. Bazillion of options. None matters because this is not about 'why do you want it'.

> And which LAN, exactly?

The path of a least automagik.

Only one ethernet interface? Then connect to that ethernet interface. Bitch in the logs what automagik was used and this can lead to the problems.

Many interfaces? Just shutdown (least pain for newbies) or start without attaching (harder to troubleshoot for newbies). Bitch in the logs in either case.

> Your misunderstanding seems to stem from the flawed assumption/expectation that every container is automatically attached to your LAN

'Your misunderstanding seems to stem what there are some people assume what they are driving in like c-a-a-r. When even 5y.o. knows it's the wheels what drives you around.'

> Docker networks are entities independent of your LAN, they're isolated networks that primarily serve to connect containers amongst themselves.

Yes, exactly. Don't call it 'bridge' ~20 years ago and we don't have this talk here.

> Auto-configuration of NAT between the internal bridge network and your LAN is just a convenience feature which you can disable, it's not an inherent property of bridge networks.

It's not even a property of a bridge network. For someone claming knowledge superiority this is a quite lame statement.

> links

Really.

> previous experience in an adjacent area where

Ah, yes, irrelevant 'adjacent area' of computer networks. I'm out of words.[0]

> All of this networking terminology is consistent and applied correctly

No. Go drive your wheels home.

> Don't shift the goalposts. You claimed it still doesn't exist.

I'm just mentioned RUN as an example. You decided what multiline is the goalpost.

And yes, if even the official Docker images doesn't use RUN heredocs then... there is something wrong with them. Like being implemented too late.

[0] but perfectly explains your previous 'flawed assumption'

▲dns_snek 13 hours ago | parent [-]

> And noone absolutely ever cared about what it's a bridge down there.

Just like nobody ever cared that the container isn't bridged to their LAN in the first place - in fact the isolation is a feature.

But you should care, it's only the most common building block of network isolation for containers/VMs on Linux.

---

I'm not going to get into it further. I tried to explain nicely but you seem hell bent on complaining and not learning anything new. At this point the appropriate response is: RTFM, it's all in there, their docs are great.

If you don't have a clue about how things work under the hood and if you have no interest in learning anything, then stop complaining about imaginary technical inaccuracies.

▲justsomehnguy 8 hours ago | parent [-]

It's quite amusing to see what you are skipping anything what expictly against you. RFTMing is a quite bold move but whatever makes you feel good today.

pat pat

▲mexicocitinluez 17 hours ago | parent | prev [-]

> BTW just for giggles opened hub.docker.com with Network Tools opened: 368 requests, 9.62MB, Finish: 4.50s.

lol What on god's green earth does this have to do with commercializing Docker? Do you really think better lighthouse scores on hub.docker.com was what was holding them back?

▲justsomehnguy 14 hours ago | parent [-]

Nah it's just a symptom - one of many.

> what was holding them back?

Did you miss 'up to 30 secs' in the previous comment? It's not about lighthouse scores. It's the whole feeling of a hodge-podged project which is run by people who are - maybe - passionate but ultimately lacking in the basics.

The ultimate buyers of their product was the system operators and the system owners - not the developers per se. They failed hard everything that space. Having a dog slow the main content site didn't added anything positive.

▲mexicocitinluez 13 hours ago | parent [-]

> The ultimate buyers of their product was the system operators and the system owners

Right, which is why bringing upva meaningless stat like how many assets their web site downloads feels like satire.

▲javier2 11 hours ago | parent | prev | next [-]

> As for "commercializing": Docker was famously bad at commercializing anything, we open sourced so much (maybe too much) and still people complained that we were not open enough.

yes, and no. Probably both. Docker would not become such a default standard if it wasnt for all the open sourcing.

▲ a day ago | parent | prev | next [-]
[deleted]
▲zoeysmithe a day ago | parent | prev | next [-]

In the end, how were you able to monetize Docker?

▲bijmtir a day ago | parent | prev [-]

[flagged]

▲shykes a day ago | parent [-]

Earlier incarnations of the project (2008-2011) were python based on openvz+aufs, with the very first prototypes (2007-08) wrapping vserver. We started the transition to lxc+aufs in 2011. Open-sourced the lxc wrapper in 2013. Replaced it with libcontainer in... 2014 I believe?

▲lostlogin a day ago | parent | prev | next [-]

The LXC way of getting an up per container is pretty great - I’m basic bitch with this sort of thing so I assume it’s less of an issue for the experts but really enjoyed the IP per container when I hit it.

▲SoftTalker a day ago | parent [-]

I always liked lxc for containers. I never understood Docker. Not that I really put a lot of time into trying. These days I don't use either one.

▲JoBrad 17 hours ago | parent [-]

What do you use instead of containers?

▲SoftTalker 14 hours ago | parent [-]

I just run programs in my OS. If I want to isolate them I give them their own account and home directory or maybe chroot.

▲lostlogin 2 hours ago | parent [-]

This is sometimes easier, but once you have a docker-compose of what you want, it’s hard to beat. You can have running server with all the services and network shares all sorted in minutes.

▲iJohnDoe a day ago | parent | prev [-]

I’m a huge fan of nspawn. Always wanted to use VMs instead of Docker and nspawn feels like a natural choice.

▲vaylian 20 hours ago | parent | next [-]

By nspawn you mean systemd-nspawn?[1]

[1] https://wiki.archlinux.org/title/Systemd-nspawn

▲miladyincontrol a day ago | parent | prev [-]

Its nice having the flexibility for both system containers and application containers. It does feel though that most people forget that nspawn does both, and that it only can do system containers.

▲iJohnDoe a day ago | parent [-]

Agreed, I briefly forgot it can do both. Thanks for the reminder.

I went down the rabbit hole of Incus and once I realized it requires the full network aspects to be configured, then I figured using KVM, QEMU, Libvirt was more practical. Then stumbled into nspawn and it was basically ready to go.

Although, I haven’t done enough research to know if Incus provides certain useful capabilities.

▲radlad a day ago | parent [-]

I'm a huge fan of Incus. VMs, LXC, and OCI containers all under the same Docker-like CLI interface. I run it on a local server and on a dedicated server in a local DC, and connect to both remotely using Nebula.

It includes project-level resource separation, advanced networking, clustering, snapshots, and more. Plus, Stéphane Graber is super responsive on the forums and issue tracker. I bounced off of Proxmox, and can't recommend Incus more for hypervisor-type scenarios.

▲nicolasjungers 20 hours ago | parent | next [-]

I run Incus, but I had to uncluster my home lab to allow to have zfs duplicated containers (as cold standby) on another physical instance. It may have changed now, but it was not possible to have two near identical container, one up one down, on the same cluster.

▲zenoprax a day ago | parent | prev [-]

Do you have any experience with multi-node operation with Incus? I like the simplicity of Proxmox for moving VMs and LXCs around but I haven't settled on a solution for OCI. K3S is an option but it's a big jump. I'm moving towards Fedora CoreOS VMs at the moment for live migration and security isolation.

▲TuxPowered a day ago | parent | prev | next [-]

Hi, question from a sysadmin / network engineer. Why localhost with port forwarding? Why not native mechanism like routing and mdns? I’ve gave Docker and other container managers which do networking the same way a try a few times and I always found the network unnecessarily complicated. Eventually I came across OrbStack which uses the aforementioned mechanisms. Every container gets an IP address in the local bridge and responds to mdsns queries. This plays especially well in “compose” scenario when services on containers can all use original port numbers. And containers can be accessed with hostnames, so there won’t be conflict between port numbers especially if I run multiple composed stacks.

▲boie0025 a day ago | parent [-]

I definitely enjoy learning other people's opinions on things I didn't realize I had an opinion on until I learned there was something to opine about.

To me the arbitrarily complex docker networking makes perfect sense. Especially in a compose setup. I want my containers to be able to talk to each other, but I don't want them on my local network or even accessible (sometimes) from the local machine. The various internal networks offer isolation of containers from the rest of the network stack. If I have a rails app in a docker compose configuration with PG, Redis, Elasticsearch, etc, in a development environment, most of the time I don't want the service/accessory containers anywhere near anything other than the app's container. And if I want several compose stacks to work together, I just put them on the same named network. I apologize if I misunderstood your point.

▲TuxPowered 9 hours ago | parent [-]

> The various internal networks offer isolation of containers from the rest of the network stack. If I have a rails app in a docker compose configuration with PG, Redis, Elasticsearch, etc, in a development environment, most of the time I don't want the service/accessory containers anywhere near anything other than the app's container.

Which can be achieved with normal routed networks with firewall on the “router” just fine, even on IPv4. Each container can have its own IP address, its own hostname and listen on a standard port, all reachable from containers and from the main OS of the workstation.

▲duggan 17 hours ago | parent | prev | next [-]

Since we're reminiscing, I was working for Engine Yard when Docker was released. I remember engineering and product leadership huddled around a desk wondering aloud whether we needed to do something about it.

In retrospect, of course, it was earth-shattering for the company, despite a valiant effort. The entire expertise of deploying long lived Linux servers and carefully shepherding them through change management with Chef became a relic to most developers. Totally changed the way applications were deployed.

Was an exciting time!

▲debarshri a day ago | parent | prev | next [-]

So you are responsible for my career and the reason i can put food on my table. Thank you.

People are underestimating now big of a tech shift it was back in the day.

▲gigatree a day ago | parent [-]

No that’s all you. He just made it easier.

▲shykes a day ago | parent [-]

Well said :)

▲nickjj 12 hours ago | parent | prev | next [-]

Hi Solomon,

Docker completely changed my life. When I started using it in 2014, I really appreciated how well it solved certain problems I had for web development.

It spawned a near endless stream of contract work and video courses for about 10 years, along with being introduced to the Docker captain's program early on. Met so many great people and had a chance to visit a few countries around the world through Docker.

It's one of those pieces of tech that has followed me around for half my career and will likely continue until the end. It's the best community I've ever been a part of.

▲snovymgodym 11 hours ago | parent | prev | next [-]

In my opinion, Docker is probably the defining computer technology of the 2010s.

I know that containerization on Unix-like systems didn't begin with Docker, but I definitely think Docker was the first accessible interface for it.

I think app containerization is something that has so many benefits and it's the obvious correct approach for its use cases once you wrap your head around it. This was already understood at big tech companies pre-Docker (e.g. Borg, Tupperware, user app sandboxing on iOS and Android), but I think it really took something like docker to make it mainstream.

As far as I'm concerned, you can probably consider yourself like the Ken Thompson or Dennis Ritchie of your era in terms of the impacts of your contribution.

▲ashkankiani 19 hours ago | parent | prev | next [-]

I appreciate what docker did in pushing a more accessible UX on top of containerization and getting people to think more about reproducible setups and sandboxing. Its popularity was definitely one of the catalysts in that direction.

I'm curious if when you were originally designing it, what tradeoffs you chose between, for example did you consider a non-daemonized design or was it daemonized from the beginning?

Having had some time now and also seeing how other people have riffed off of the idea and refined it, what would you have done differently? If you have a retrospective at some point already, I'd be interested to read it.

I have some accumulation of personal architectural guidelines that I built up from trial-and-error + reading others' experience and reflecting on how their design could've affected something I made. As a result, I really value those kinds of discussions about tradeoffs.

▲javier2 11 hours ago | parent | prev | next [-]

As a backend developer, I am hopelessly grateful for docker and containerization in general. The old days with stateful application servers were AWFUL.

▲999900000999 a day ago | parent | prev | next [-]

Thank you.

For one, did you get rich beyond all comprehension and did you start a band with your wealth?

Second, do you still program ?

I was lucky enough to get in this industry when Docker was new. Sure beats trying to figure out why X happens on machine A and doesn’t on machine B.

▲shykes a day ago | parent [-]

I did make a bunch of money with Docker, something I am eternally grateful for.

I did not start a band, but I did build a nice house, help my family etc.

I still program everyday, working on my second startup, https://dagger.io (please forgive the plug). We have a very active discord if you want to come say hi.

▲999900000999 a day ago | parent | next [-]

I work heavily with CI/CD. From a quick glance Dagger looks very promising and I might experiment with it this weekend.

I guess my follow up question is once you’re financially independent, what continues to motivate you?

Is it fun?

Do you feel like you’re creating tools that the industry needs.

I imagine if I ever get rich I’d work on music and small games.

Video games that you buy once and get to play forever, self host, etc. With a full open source commitment within 5 years or so. I’d probably create a game studio in a lower cost of living country though.

▲shykes a day ago | parent [-]

If you do try Dagger, please join our Discord and tell us how it goes! There's a very friendly and active community of CI/CD nerds, who will be happy to help.

We actually use the same Discord server for community and private team communications. So we are literally there all the time.

▲EdwardDiego a day ago | parent | prev | next [-]

Commenting to be able to find your CI/CD project when back at my desk.

▲j1elo 21 hours ago | parent [-]

You can favorite messages, then check them out from your profile page just like you check on your previously posted messages.

Hit on a message's permalink (which is the "X hours ago" link), and in there you'll find the action to Favorite it.

▲jnsie 13 hours ago | parent | next [-]

Oh my god. Thank you so much! I never knew this was possible and it's really helpful!

▲EdwardDiego 21 hours ago | parent | prev [-]

Thank you!

▲sharts a day ago | parent | prev | next [-]

How’s dagger’s k8s and/or rust story?

▲shykes a day ago | parent [-]

We are working on making Rust builds much faster, and easier to distribute on a cluster.

When self-hosting Dagger, you can run it on Kubernetes. Beyond that, we don't use Kubernetes at all ourselves.

▲ProllyInfamous 18 hours ago | parent | prev [-]

>I did make a bunch of money with Docker

Shortly before this (the weekend after you secured YC funding, IIRC), I['m almost certain I] met you in downtown Oakland at Saagar & Tiffany's /r/bayarea meetup [0] – won't go into further details, other than I was one of their co-conspirators =P

My point of writing this is dualfold:

1) Thank you for sharing your design – I literally just installed my first Docker module (last week) and am floored at all the problems Docker might help me solve (I am not employed in tech)

2) My recollections of you, this decade+ later, was of a humble young man (we're the same age) that didn't know what else to do with his newfound techfame (and money) than keep'on keepin'on.

After watching your Docker Debut video, I'm fairly certain it WAS you: we chatted about dirtbikes (and just what the hell you were going to do now that you "had money" – then such a foreign concept to us both)... if this wasn't you it still seems to echo in your mannerisms/tact/approach. May your humbleness and cleverness prevail!

[0] It might have been at Gustafson's NYE party (I was the guy remorselessly conjuringbitches; "Volcano"); we had a mutual friend at MalwareBytes?

▲brightball a day ago | parent | prev | next [-]

I remember going to a demo of Docker in South Carolina before it hit 1.0. Came back and wrote the “Docker is the Heroku Killer” article on my blog and it was the first thing I wrote that made the front page of HN.

▲tonyhart7 a day ago | parent [-]

but heroku and docker serve different purpose no ???

▲brightball 13 hours ago | parent | next [-]

In 2014, Heroku was the only game in town on the PaaS front. Nobody else was even close.

Java App Servers with their WAR file deployments across a cluster were the closest equivalent.

Docker was the enabler for alternatives.

▲akoboldfrying a day ago | parent | prev [-]

They aren't at all the same thing, but at a high level they both reduce the amount of fragile/tedious setup-specific futzing you need to do to get a few basic services up.

▲cuttothechase a day ago | parent | prev | next [-]

Docker ended up as a primary way of delivering, packaging applications etc., for the web and beyond.

What was your imagined use case when you first came up with it?

Did you think Docker as it is used in the industry right now is where you imagined it would be used?

Any use cases for it that the industry missed but you think would have made things even better?

▲StrangeWill 9 hours ago | parent | prev | next [-]

Oh man, the only big struggle I have with docker, is the abandonment of Docker Swarm.

I've struggled for years wanting something that wasn't K3S or K8S. Something good for small cluster management that had a lower level of entry, that I'd feel better handing off to other teams.

Docker Swarm seemed to fight the puzzle, but falls short based on things that needed to be fixed or finalized, that just never happened.

Any reason that whole pathway got abandoned? Other than just "Google uses Kubes so just everyone can use it"?

▲aquafox a day ago | parent | prev | next [-]

Given all the popularity and use cases you know today. Is there any fundamental design choice you would have done differently?

▲ryan29 a day ago | parent | prev | next [-]

What made you decide to use a URI as the namespace for images? I like it, but I think it's been very misunderstood which has caused people to dislike it.

▲shykes a day ago | parent [-]

I was inspired by Go's use of URI as a namespace for user packages, and short names for the standard library. I thought it was an elegant way to allow everyone to host anywhere, and dodge a lot of complicated namespacing issues.

One design principle that was very important to me, was portability and avoiding fragmentation. I wanted every image name to have the same meaning in every engine, so that when writing a Dockerfile, you could have confidence that it would actually behave the same on every docker installation. In this we disagreed with other platforms (like Red Hat) who sought to "embrace and extend" Docker by changing the meaning of short names. We always fought this to avoid fragmentation of the platform. This did not make sense from Red Hat's perspective, since they were the platform - who cared about fragmenting Docker? That led to some negativity which is probably what you're remembering.

At the same time early Docker users wanted the ability to host their own images without being forced to use our central registry. Using Go's system solved both problems at once.

▲ryan29 a day ago | parent | next [-]

Thank you for taking the time to reply. Yes, it was the short names and the way people were trying to run local mirrors that I remember.

I personally never use the short names and have really come to like your solution. I host my own registry and I can glance at a build or compose file and immediately know if I’m depending on any external resources that I shouldn’t be.

I originally disliked it, but it’s been my favorite namespace solution for a long time now.

▲jacques_chester a day ago | parent | prev | next [-]

Did it though? The amount of grief I've had because `foo/bar` gets silently expanded to `docker.io/foo/bar` is extensive.

▲Shorn a day ago | parent | prev [-]

Any regrets about the namespacing or things you’d do differently with it now looking back?

▲shykes a day ago | parent [-]

My only regret is that so many users had to run local docker registries on each node of their cluster, then write `FROM localhost:1234/myimage` in all their Dockerfiles - all to avoid unnecessary re-fetching of remote images. My goal was to make image distribution a native feature of the cluster, so that you wouldn't have to choose between portable Dockerfiles and proper image caching. But Kubernetes ended up dominating the cluster layer, and as far as design goes, we were not invited to that table. So as far as I know, the problem was never solved, at least universally for all Docker users.

▲QuantumNomad_ a day ago | parent | prev | next [-]

Thanks for making Docker :)

Prior to the creation of Docker, did you have experience with other containerization technologies like Solaris Zones and FreeBSD Jails?

Did you at some point, either prior to or after making Docker for Linux, consider building something like Docker on top of FreeBSD Jails?

As a user of both Linux and FreeBSD, running Docker containers and Jails on each of them respectively, it would be interesting to see what FreeBSD Jails could be with something like Docker built on top of it while also taking advantage of other features on FreeBSD like fully using ZFS snapshots, ZFS send/recv, ZFS clone, vnet, and so on. Such that spinning up a container would under the hood receive ZFS snapshots from the “Docker registry” equivalent server, and it might clone the snapshot locally before starting up a container instance so that multiple container instances would be using the same locally available ZFS snapshot that was received once from the “Docker registry” equivalent.

▲samayashar 14 hours ago | parent | prev | next [-]

I've been actively using Docker for most of my projects over the past few years and I sincerely thank you for brainstorming and getting it out in the market.

The sole idea of containerising an application, its utils and dependencies all into one container is a real big deal in early 2010s. The product has been so visionary that it has been re-pivoted as secure sandboxes which is most needed right now. Kudos!

▲zbentley 13 hours ago | parent [-]

The main primitives that underlie Docker were originally intended to facilitate security and isolation. Docker's innovation was combining filesystem-in-a-box with those security primitives, and delivering all those capabilities with highly intelligible UX. That's not meant to minimize; I think those are monumental (and monumentally impactful) achievements. But there was no "re-pivot" to secure sandbox isolation; that's what things like cgroups and namespaces were created for!

▲okanat a day ago | parent | prev | next [-]

Would you consider writing Docker/moby in a different language, if you were to create it scratch today?

▲shykes a day ago | parent [-]

Oh gosh, the choice of language is such a context-specific design decision. The first versions of what became Docker were written in Python. The choice of Go was a mix of nerdy excitement ("it's like the best of Python and C!"), and adoption strategy: back then devops tools were segmented by language runtime: ruby, python or Java mostly. Shipping a compiled binary allowed us to be adopted by all tribes.

None of these things can be transposed today, so I guess I can't answer...

For what it's worth, my current project (dagger) is written in Go.

▲justincormack a day ago | parent | next [-]

I interviewed Solomon about the Go history (plus some others) for this talk https://www.infoq.com/presentations/languages-cloud-native/

Actually there are some longer unedited versions I might release.

▲julianeon a day ago | parent | prev [-]

That's a good answer that effectively rebuts the article's claim that Go was a bad choice imo.

▲shykes a day ago | parent [-]

The article's point that Go is a bad fit for some of the low-level interactions with the kernel, is absolutely correct though. We had to do a lot of juggling to get it to work properly. But in the end it was fine. I would say it was the correct choice of language at the time, and it certainly contributed to Docker's early success.

Another explicit goal was to facilitate contribution. We thought Go syntax was "vanilla" enough to attract a broader set of contributors than a more niche, opinionated language like Erlang, Haskell, Clojure etc. I think that also worked out well - Docker was known for attracting many contributors, many of them making their very first open source contributions. We even ran special meetups to help people become contributors, that was fun.

▲bmurphy1976 15 hours ago | parent | next [-]

I think that's so true and it was one of the keys to success of the project. I contributed the very first simplistic implementation of referencing linked containers by name. I never would have bothered if the project was written in C or C++ (I'm more than capable, I just don't enjoy torturing myself). Go made it MUCH easier for a fly-by-night contributor such as myself to join the party.

▲DANmode a day ago | parent | prev [-]

This is the coolest set of contributions to HN this month, most likely.

Thank you.

▲memset a day ago | parent | prev | next [-]

I was a dotcloud customer around 2012. You might have responded to one of my many support emails.

▲shykes a day ago | parent | next [-]

Ha ha, thank you for your trusting us back then! Hopefully it was a good experience? Scaling reliably on AWS was not so simple back then...

▲memset a day ago | parent [-]

Haha, well, let’s say the experience motivated me to learn how to run nginx and uwsgi on my own :)

(And as a result that, with ansible, continues to be my preferred way to deploy while the rest of the world passed me by…)

▲aldousd666 a day ago | parent | prev [-]

Digital meet cute right here!

▲gradus_ad a day ago | parent | prev | next [-]

General question. When you were designing Docker, did you anticipate the success it would achieve?

▲shykes a day ago | parent [-]

To give a sense of time: Docker launched in 2013, but it was one of many iterations of the same project, which I had been working on continuously since 2008. Over those 5 years, virtually nobody cared or understood what the hell I was working on. I lived in France and had no connection to the tech industry.

So, not only did I not anticipate this kind of success, I did not even have a reference frame for what success might even look like. All I knew was, I had an itch that I had to scratch, and I had nothing better to do :)

▲xtracto a day ago | parent | next [-]

I remember in 2013 the first time someone showed me Docker [im in Mexico]. My first thought is that we already had Vagrant for setting up and running virtual machines through console.

I didnt get it at that time haha.

▲jamesfinlayson a day ago | parent [-]

I was still hearing that in 2015.

▲ecliptik a day ago | parent | prev | next [-]

In those years in the systems group I was working in at a fortune 500, we were very interested in this type of technology. Mostly using Solaris Zones and cgroups and trying to do this ourselves with limited results.

When Docker came out it solved so many issues we were having. Thank you for scratching that itch.

▲Waterluvian a day ago | parent | prev [-]

Was it always called Docker? Do you think the branding played a larger role in success than you would have expected?

▲ak217 a day ago | parent | next [-]

I believe Docker was always called Docker, but it grew directly out of the previous generation of the technology used by dotCloud (the company Solomon founded), which was using LXC with AUFS.

I think the breakthrough with Docker was bundling the AUFS-based image layer format with a centralized container image sharing registry. This was revolutionary at the time. But another huge element of success was Solomon and others evangelizing the technology relentlessly at meetups and conferences. I distinctly remember attending a demo in 2012 where the crowd was very excited to see the Docker workflow that we now take for granted, in large part because Solomon was so good at presenting it. At the time, I was working at a cloud PaaS company where we developed a similar technology on top of LXC and BTRFS (but no image registry). Docker really made me think hard about what we were doing, although I didn't end up making any moves.

https://jpetazzo.github.io/2017/02/24/from-dotcloud-to-docke...

▲shykes a day ago | parent [-]

You are correct :)

> the previous generation of the technology used by dotCloud [...], which was using LXC with AUFS

One small note, the earliest versions (2007-2011) were based on vserver then openvz, which predated lxc. Back then you had to patch the kernel to get container primitives. And since virtualization also required patches (eg. Xen), we had to carefully combine both sets of patches, which was poorly supported because nobody else was crazy enough to stack 2 kinds of virtualization!

▲hack1312 a day ago | parent | prev [-]

It used to be dotCloud iirc

▲memset a day ago | parent [-]

Dotcloud was a PaaS:

https://news.ycombinator.com/item?id=2032821

Then it pivoted to docker:

https://news.ycombinator.com/item?id=6634002

▲stroebs a day ago | parent | prev | next [-]

Were you around for the big Moby open sourcing? What went down from your perspective? If I recall, it was a fairly dramatic move that was not driven by the interests of Docker corp.

▲shykes a day ago | parent [-]

Yes, I was around for that. It was one of my skunkworks projects, as I had lost formal authority over engineering and product by then, and mostly used my "founder aura" to convince small pockets of people within the company to build cool things with me.

However Moby was a poor choice for a skunkworks project, it involved mostly communications and project management, which requires consistency and scale. Overall it was poorly executed because I failed to build enough support internally ("Solomon's at it again, let him do his thing"). Here I am trying to explain it on Twitter after the keynote, using a picture of a hand-drawn diagram, because nobody in marketing or product was assigned to help. https://x.com/solomonstre/status/855918630915133440

I think the goal of Moby was fundamentally correct: we were trying to replicate the Red Hat model, with well-scoped upstream components (linux -> runc, containerd..) integrated into a commercial product (Docker -> RHEL), with a faster-moving community project in between (Fedora -> Moby).

This was a way for us to clarify that Docker was a product, with a community of users, and Moby was an open source project, with a community of contributors. This clarity was very much needed, because different communities were projecting very different expectations on the brand "Docker", and these expectations conflicted with each other.

In a way, Moby aspired to be what CNCF ended up becoming - the "big tent" where the broader community meets to hammer out the general shape of the container stack. It seems obvious now that a single company can't be the sole authority over such a vast scope. But in the first years of Docker, we really did have that level of influence, because we literally invented the market, and brought the community together in meetups and an ever-growing Dockercon. It's only when Google and Red Hat pushed Kubernetes and CNCF, that our influence over the stack started to wane. Maybe it was for the better, I don't know if we would have been up to the task as designers and engineers. But at least there would have been a consistent design, with a Linus Torvalds figure willing and able to say "no" to stupid and redundant features. For a while I played that role - but then I was replaced by SIGs and committees.

▲skinfaxi a day ago | parent | prev | next [-]

Given how things have changed since your creation and the way things are going, are there any things you would have done differently?

▲shykes a day ago | parent [-]

There are many. But there is an alternative universe where I remained CEO instead of transitioning to CTO, and continued pursuing my product vision obsessively instead of compromising on it because of lack of self-confidence and a desire to be loved. I think I would have avoided a lot of the mistakes that the company made - but on the other hand, I would have made a fresh set of mistakes instead, so who knows what the outcome would have been!

▲skapadia 21 hours ago | parent [-]

Thanks. I needed to hear this. So many things in life can turn out differently if we can overcome our “lack of self-confidence and a desire to be loved”. It’s never too late!

▲enriquto 19 hours ago | parent | prev | next [-]

> I'm happy to answer any questions you may have.

Why doesn't docker respect unix filesystem permissions? I use docker on a shared server, i can delete docker images of other users. This is bonkers.

Is it a defect of a particular docker setup (following standard instructions on ubuntu), or it's an intrinsic feature of docker itself?

▲coldtea 19 hours ago | parent | next [-]

>Why doesn't docker respect unix filesystem permissions? I use docker on a shared server, i can delete docker images of other users. This is bonkers.

Same reason a Postgres root can delete tables of other users.

It could, but it would be a shim on top of Docker to respect them.

Docker is a service daemon running as root, and the images of other users are just entries created by the other users in its registry, not server files that have permissions of each user.

When you're creating a new docker image, you just send a command to that daemon process - you're not passing your user account credentials to create. As far as docker is concerned, it's just one more image it knows, not an image belonging to you specifically.

▲enriquto 18 hours ago | parent [-]

I understand the mechanism. I wanted to know the reasons for this choice.

Why choose to break user boundaries? Why can't docker images be files in the possession of each user?

▲coldtea 18 hours ago | parent | next [-]

They didn't chose to break user boundaries. They chose not to artificially recreate them.

In the shared daemon model, there are no user boundaries. Even if the files belonged to each user permissions-wise, the central daemon running as root would be able to edit all.

▲zbentley 12 hours ago | parent | prev [-]

I think there's two questions there:

Q: Why not have container builds and runs be invoking-user-specific by default? A: As the adjacent commenter pointed out, this would be an overlay on fundamentally rootful behavior. It would also remove a lot of "works on my machine, works anywhere", since different user accounts running/building containers could be restricted in different ways on different computers, so my "docker build" and your "docker build" might both work, but do different things or fail in different ways. Note that this isn't the same as saying "rootful dockerd is good"; it's not (usually)! That's why rootless docker (https://docs.docker.com/engine/security/rootless/) is recommended in many environments. But even in rootless, the run-user of the container and build are still uniform with the rootful behavior (albeit they require more participation from the daemon-owning user account WRT UID mapping/user namespaces/privileged actions), which I think is a good thing. Rootless docker, last I used it, behaved sensibly re: vs. user container images (kept per-user) and globally-cached layers (removable by anyone), but that may have been a specific configuration where I was using it.

Q: Why aren't docker images user-browsable files? A: I can't say for sure; I didn't build Docker, but I hear the guy who did is in the neighborhood :). I suspect it's a combination of caching (since build stanzas/Dockerfile lines are intended to be proxies for the content address of a layer, there's nothing to gain by making layer caches per-user), implementation convenience, and an influence from the Golang platform wherein (after the age of vendoring wound down) the developer tooling has many convenience layers that de-emphasize user visibility of build/download artifacts a la "go run". Docker goes further, though. And yes, I know that you can get at OCI images/layers as files. But most people don't.

▲drdec 19 hours ago | parent | prev | next [-]

The docker daemon runs as root by default which IMHO is a security issue on machines with multiple users. For those machines, consider a rootless docker set up where each user runs their own docker daemon. (This is a supported configuration.)

All of the above applies to Linux, ymmv on other OSes

▲kiney 19 hours ago | parent | prev [-]

having access to the docker daemon is equivalent to root

▲smcleod 19 hours ago | parent | prev | next [-]

Back in 2012 we used to give talks about how we ran all our CI builds in LXC containers, that came about because a bunch of us came from the BSD / Solaris world of jails and it just felt natural.

The folks at infracoders / DevOps meetups would think we were a bit "out there", then what do you know - 2013 rolls around and we quickly started to shift to Docker (too early some might say), but not long after shifting from LXC to Docker it seemed many others finally started to come round to containerisation.

Fast forward to 2026 and I've recently done some work with a client who is only just "getting into containers" (a Windows shop).

Thanks for your early work to bring better containerisation to Linux Solomon. It's funny to think we're 13 years from Dockers release. Time flies.

▲operator-name a day ago | parent | prev | next [-]

I’d love to hear more about some limitations/tradeoffs of docker that you made at the time that you regret in hindsight. Was there anything that you wish didn’t get baked into the “default norms” for containers, or areas that would benefit from more attention and redesigns?

I’ve been following dagger and it’s been really interesting to see the evolution of the design, and new set of abstractions. There’s also nix which has seen popularity, with their approach of building layered oci containers.

▲ollien 13 hours ago | parent | prev | next [-]

Not really a question, but just saying "hi!". You might not remember this, but in 2012 I was about 13 years old, interested in computers, and had no one to really talk to about them. By some miracle my father (who is in no way in tech!) found some connections to YC and organized for us to come out to California to see a bunch of companies. dotCloud was one such company, I still have the t-shirt! I remember chatting with you and you taught me how to use pip, it's a fond memory I look back on often.

▲shykes 7 hours ago | parent [-]

Oh that's so cool! And also making me feel very old :)

What are you up to these days?

▲ollien 6 hours ago | parent [-]

These days I work in infrastructure at Discord; lots of fun problems to solve in that space. I'm getting to work on a lot lower level than my job description would imply.

Hope things are going well with you at Dagger(?)!

▲shepherdjerred a day ago | parent | prev | next [-]

I hope one day I can say something like “I made Docker” :,)

▲DANmode a day ago | parent [-]

Not luck: pay attention to what the community needs, and be in a position to execute when you spot it.

▲OJFord 15 hours ago | parent [-]

On the contrary I think quite a lot of luck is usually behind the second part of that.

▲rdsubhas 21 hours ago | parent | prev | next [-]

Thank you for docker.

Went from the good old days of vagrant (xen/kvm) to lxc/lxd to docker, and docker truly clicked all the way from development to production.

But honestly, thanks to Docker hub even more. The CLI is only one part of the puzzle, the worldwide registry is an immense undertaking.

▲osener a day ago | parent | prev | next [-]

How did MirageOS end up powering parts of Docker stack?

▲shykes a day ago | parent [-]

We acquired a small team of Cambridge-based computer science & systems engineering wizards, called Unikernel. We then worked together to apply systems engineering to improving and expanding Docker in various ways.

The most successful project that we worked on together was "project Piñata" which later became Docker for Mac. It turns out bundling a Linux VM in a native Mac app, and integrating it into the host filesystem, networking stack etc requires lots of magic..

Now, most of the Unikernel team were very active OCaml developers, and created MirageOS among other ocaml projects. While working on Piñata, they simply reached for the tools they were most familiar with.

▲avsm a day ago | parent | next [-]

(Unikernel cofounder here)

When acquiring our company, Solomon took us to a remote farm in France for a week for an offsite, fed us fantastic food and wine, and the first prototype of that Docker for Mac VM was working by the end of the week! It took a few months to hack together the shell. There's a video of Solomon and the pinãta launch party on my blog ;-) https://anil.recoil.org/notes/cacm-docker-cover#getting-invo...

There was a whole other slice of work we did for project Piñata too in the form of datakit (https://github.com/moby/datakit) that was well ahead of its time. I was looking at this archived code again just last week while thinking about agentic git workflows!

▲shykes a day ago | parent [-]

Hi Anil! Welcome to the 2026 Docker reunion thread :)

How did I not know about this video until today!

Hope you're doing well.

▲avsm 21 hours ago | parent [-]

I am having a blast working on environmental science these days, and we’re long overdue a beer next in SF!

Am firing up Dagger to give it a try on our geospatial workflows for the first time just now; it’s got the same attention to CLI detail as Docker 1.0 did :-)

▲djs55 20 hours ago | parent | prev [-]

(Joining the reunion thread) I was just explaining to a new starter yesterday why Docker Desktop used the codename "pinata". Also I reckon some of the more advanced ideas from back then are still relevant today, probably even more now that everything is changing (or can be changed) with agents. Hope all is well!

▲avsm 19 hours ago | parent [-]

I'm glad to hear that DfD's repo is still the piñata!!! Congrats on the Docker sandbox launch as well, great to see it integrated now.

▲ebiederm 9 hours ago | parent | prev | next [-]

Did you ever reach out to the kernel folks while working on Docker?

My memory from that era when Docker was getting big was our biggest user completely ignored us. Which I thought was quite odd at the time.

▲shykes 8 hours ago | parent [-]

At some point I emailed Linus to ask for his advice but he never replied. That was a personal initiative though, not on behalf of Docker.

I did speak to Greg several times.

I think over the years there was natural overlap, people who contributed to Docker would also be kernel contributors. Especially when we spun out runc, containerd, which created a more vendor-neutral space for maintainers to focus on the bottom of the userland stack with minimum drama.

To the extent that Red Hat employees overlap with kernel folks, that made it more difficult to collaborate since Red Hat was overtly aggressive towards Docker, and generally made our engineers feel unwelcome on "Red Hat turf". I discovered that they had devolved into a toxic company with a facade of benevolence. This made me sad because Red Hat was an inspiration to me. One of those "don't meet your heroes" situations.

Not sure what you meant by the "ignoring" part.

▲ebiederm an hour ago | parent [-]

Since 2006 first as part of the Ottawa Linux Symposium and later as part of the Linux Plumbers Conference we had yearly in person meetings.

We had public discussions on the Linux Kernel mailing list and later on the containers list.

It was a collaborative effort from vserver, openvz, IBM, and Linux Networx, and google. I think those were all the original groups, my apologies if I have forgotten someone.

After Docker made a splash I occasionally asked other developers if they had any contacts at Docker. To the best of my knowledge we never received a bug report, or a feature request. No one from Docker ever showed up at any of our meetings.

I know at one point I wanted to let someone know that Docker they were holding the pieces wrong when it came to security.

Eventually I think one of the OpenVZ guys wound up working for Docker for a time. But that was quite late in the timeline.

I was passing through RedHat about the time of the spat you mention. My impression at the time was that Docker never worked well with anyone, and after some frustrations trying to cooperate the RedHat userspace folks decided it was easier to get a real standard without Docker.

At that point I had gotten the unprivileged user namespace support into RedHat's kernel and changed a lot of minds about it's utility.

I don't remember Docker ever picking up unprivileged user namespace support and as a result was a security disaster waiting to happen.

It felt to me like Docker treated the userspace API for containers like most folks treat the POSIX API. Fixed in stone. In fact there was a lot of wiggle room, and opportunity to shape things for anyone who was willing to dive deep into the technical details.

▲theanonymousone 21 hours ago | parent | prev | next [-]

Thanks for making so many lives easier!

Docker is probably the highest-profile software written in Go. Are you happy with that choice? Would you do it in Rust if it was available at the time, or Zug?

▲cogman10 13 hours ago | parent | prev | next [-]

The weirdest part of docker, to me, is that it was setup as a client/server system. Why was that? Podman for quite some time didn't support it.

Was it all for the `docker.sock`?

▲cole_dev a day ago | parent | prev | next [-]

Thanks for your innovation and helping developers! If Docker hasn't been your focus in recent years, what have you mainly been working on and what's been your favorite?

▲kwakubiney 20 hours ago | parent | prev | next [-]

Hi Solomon! Great product. How do you feel about the need for a central registry and not a p2p approach for distributing images? I always felt like p2p was the better and more scalable approach. Any reason why you decided on the centralized approach?

▲happyash1 13 hours ago | parent | prev | next [-]

You're actually the coding GOAT btw.

▲Fabricio20 a day ago | parent | prev | next [-]

Thanks for developing such a valuable tool!

▲DockerizeMe 15 hours ago | parent | prev | next [-]

Love docker, it changed the development ecosystems for the better.

In recent years I have shifted over to Podman, primarily because it defaults to rootless without a daemon.

Is that something you considered for docker early on , and if so why did you decide on running as root?

▲fnord77 a day ago | parent | prev | next [-]

How does it feel to have fundamentally changed how many/most enterprise software runs?

▲shykes a day ago | parent [-]

I feel grateful for having seen from the inside one of those rare "hypergrowth" moments, it's a terrifying and exhausting experience but I would do it all over again without hesitation.

I also feel lucky that people are still using my work, that it endures without me, and that it generates (mostly) positive reactions. There was a time where Docker had a lot of haters, which was hard on me. But with time I've noticed that the negativity gets mostly washed away, and what remains is positive interactions like the ones in this whole thread. So now Docker is this cool experience I share with lots of people around the world, and when we meet we get to talk about this shared interest. I love it.

▲callamdelaney 11 hours ago | parent | prev | next [-]

Why did you make compose silently rewrite firewalls?

▲potsandpans a day ago | parent | prev | next [-]

A while back you had this tweet which often gets cited, or at least _i_ personally think about it a lot.

> If WASM+WASI existed in 2008, we wouldn't have needed to created Docker. That's how important it is. Webassembly on the server is the future of computing. A standardized system interface was the missing link. Let's hope WASI is up to the task!

How are you feeling about WASI today?

▲Snacklive a day ago | parent | prev | next [-]

Not related to the topic but. Do you have any book recommendations? Not necessarily programming or system related, looking for great books ~

▲Vaslo 4 hours ago | parent | prev | next [-]

Nothing weird about it - extremely logical and it’s the gateway to so many great self hosted apps.

When it comes to the author calling Docker weird, after looking at some of their other postings, something about glass houses comes to mind.

▲pgray a day ago | parent | prev | next [-]

basically my whole career has revolved around being good with docker and other related tech, so thank you! started on 0.7 :D

▲ a day ago | parent | prev | next [-]
[deleted]
▲Tenemo a day ago | parent | prev | next [-]

Do you think e.g. students learning docker syntax at a uni is beneficial in 2026 or you think LLM-assisted programming means that Docker will become an abstraction under an abstraction and its setup will be mostly automated by LLMs? I find myself very rarely debugging or handwriting dockerfiles nowadays!

▲craftkiller a day ago | parent | next [-]

This is a strange question because you could learn Dockerfile syntax in a single night. There are only 18 directives, and the average Dockerfile uses like 6 of them. 90%+ of Dockerfiles is just "run this shell command" and "copy this file into the docker image". The only time it flirts with complexity is multi-stage Dockerfiles, but 90%+ of Dockerfiles are a single stage.

https://docs.docker.com/reference/dockerfile/

▲koolba a day ago | parent | next [-]

> The only time it flirts with complexity is multi-stage Dockerfiles, but 90%+ of Dockerfiles are a single stage.

And multi stage builds are just a directed graph short hand for having separate intermediate dockerfiles. There’s nothing special about them either.

If I had to pick one thing that is tricky for someone new to docker to understand, it’s how the filesystem state is cached using the previous state, the env, and the raw command text.

▲craftkiller 17 hours ago | parent [-]

Indeed, the one mistake I keep seeing new people make when writing Dockerfiles is writing them in a way that doesn't optimize for caching. For example, they'll copy their code into the container first and then start installing packages and dependencies. It's an easy mistake to make because the end result is still a functional Dockerfile, they're just wasting time and stressing the poor package servers unnecessarily.

▲subscribed 17 hours ago | parent | prev | next [-]

Or multi-container compose files with atypical networking, or troubleshooting daemon permission issues.

Docker is much more than memorising a handful of Dockerfile directives.

▲ 17 hours ago | parent | prev [-]
[deleted]
▲phlakaton a day ago | parent | prev | next [-]

I think the key thing for a university student is to get the big ideas down: what is a container exactly, how does it work, how does it differ from a VM, what assumptions does it make about what you're running (and how do you run something that doesn't fit that pattern), why do images exist in layers and how are layers implemented, what are the performance benefits/tradeoffs, etc. etc.

When I was learning Docker I can't tell you how many people would describe it to me by analogy to a standardized shipping container, and start going off about shipping container dimensions and supersized cargo ships and trucks and railcars... and finish by smiling beatifically, like they had just explained the whole thing in a masterstroke. Let's... uh... not do that. :-D

In a problem set, the student might learn a bit about dockerfiles or docker-compose.yml... but only, I think, so they can try building and running a container of their own!

▲Kwpolska 21 hours ago | parent | prev | next [-]

If you're going to fully delegate something so trivial as Dockerfiles to slopmachines, why go to university at all? You don't need to learn anything if you delegate everything to the slopmachine.

▲xyzzy_plugh a day ago | parent | prev [-]

I'm gonna be real with you. No one needs to know docker syntax. Most engineers just copy and paste chunks of Dockerfiles around anyways.

Docker syntax is one of those things that just immediately falls out of my head when I close the editor. I don't care about it at all.

Even better: there are many, many tools that build OCI images without using the Docker syntax. I haven't hand-written a Dockerfile in at least six years.

LLMs have not loved the needle here in my sphere, it was already bouncing off of the zero on the gauge.

edit: this isn't to say the syntax is good or bad (though there are several questionable parts of it) but extremely simple, and concise enough that you can just look up literally any command with great ease. It's surely a large part of its success, for better or for worse.

▲jimbokun a day ago | parent [-]

I find the Dockerfile syntax easier to use than any if the tools that generate it indirectly.

▲leosussan 14 hours ago | parent | prev | next [-]

Thank you for making it :)

▲jacques_chester a day ago | parent | prev | next [-]

I like to tell people the story of how I got a pre-release peek and frankly didn't understand what I was looking at. You emailed me in reply to a comment I made around that time[0].

Funny how little has changed except the names, I guess.

[0] https://news.ycombinator.com/item?id=5347255

▲layer8 a day ago | parent | prev | next [-]

If you were implementing an operating system (free from compatibility concerns), what would you do differently to better support lightweight containers?

▲fHr 13 hours ago | parent | prev | next [-]

Legend, thank you!

▲verdverm a day ago | parent | prev | next [-]

What learnings did you take from Docker when conceiving Dagger? Or is it more about unlocking BuildKit?

▲lstodd 17 hours ago | parent | prev | next [-]

Do you feel that docker was done for as of about ten years ago and something better should have replaced it?

▲stemonteduro 19 hours ago | parent | prev | next [-]

Seems like this thread has become an AMA lmao

▲irishcoffee a day ago | parent | prev | next [-]

Oh wow, hi! I think my biggest “gripe” with docker is that everyone grabs it as a hammer and views many problems as a nail. Am I way off base with that? What was your original vision for how docker might be used in the wild?

▲hahahoo 17 hours ago | parent | prev | next [-]

[flagged]

▲RomannBami 15 hours ago | parent | prev | next [-]

[flagged]

▲tannertech a day ago | parent | prev | next [-]

Thanks but I still run LXCs /s

You're a genius well done making containerization actually happen.

▲bijmtir a day ago | parent | prev | next [-]

[flagged]

▲hack1312 a day ago | parent [-]

what

▲bijmtir a day ago | parent [-]

Have a look at his submissions story. The political ones. Full in propaganda outlets. Check his other public political commentary. Some of his comments here. It is strange how someone capable of thinking can hold on to these ideas without being blackmailed (eg. Epestin) or a grifting politician.

▲bijmtir a day ago | parent [-]

Here is an example of supporting apartheid because “it was settled”:

https://news.ycombinator.com/item?id=47200328

▲pjmlp a day ago | parent | prev [-]

I am firmly convinced that had Rust been more mature at the time, the pivot from Python would have beem into Rust instead of Go.

Am I on the right track?

▲thephyber a day ago | parent | next [-]

Why?

Python and Go are both memory-managed languages. That is perhaps the hardest part of programming (outside of getting the code to do what is intended).

Go and Rust are both compiled, but Rust requires the developer to figure out all of the memory management before compilation, which slows down development to a crawl.

Almost no company will rationally choose Rust over Go if they know how the development speed tradeoff looks like.

▲pjmlp a day ago | parent [-]

Because Go is a badly designed language that only took off thanks to Docker, and as the article points out, a few C workarounds were anyway required to make it possible in first place.

I would have chosen C++, but given that isn't the new darling any longer as in the 1990's, that begs the question of the new kid in town that everyone is now rewriting everything into.

▲kccqzy 15 hours ago | parent [-]

In 2013 C++ was having a moment. The C++11 standard was a huge release with meaningful improvements. It was a great time to start a new project with C++.

▲Copenjin a day ago | parent | prev [-]

This obsession with Rust is very hard to understand

▲brabel a day ago | parent | next [-]

Yeah but the post criticized Go for a project like Docker, so it makes sense to ask what else could have been used. At the time there weren’t many system languages fit for the purpose.

▲pjmlp a day ago | parent | prev | next [-]

The obsession isn't with Rust, the obsession is with Go not being a good programming language and the only reason it took off was thanks to Docker.

So they would probably never rewrite from Python into C or C++, because not cool, too hard kind of motivation, otherwise they would not have picked Go.

So that begs the question, if the obession as you call it, was already a thing back then, would Rust have been the lucky candidate?

▲Copenjin 20 hours ago | parent | next [-]

It didn't really need Docker to "take off", I'm not even sure if it actually ever did the take off...

It's a language with its pros and cons, I like the simplicity, it's a good choice for services that just expose an API/GRPC/etc... and the performances are not that bad.

This "but rust is faster" obsession often comes from people that don't even know what they are talking about or are even able to consider if thinking about performance make sense for a specific use cases. Sometimes, or at least it did before LLMs, having something simple to modify was more important that chasing supposedly higher performance because the rust people keep blabbering about it.

> would Rust have been the lucky candidate?

Probably not, considering that the author give me a "simple solutions are best" vibe.

▲pjmlp 20 hours ago | parent [-]

That being the case, it would have stayed Python with some C bindings, instead of the cool new Google language still not yet 1.0.

▲jazzypants a day ago | parent | prev [-]

I generally agree with your comments, but do you really think that a language created by such luminaries as Ken Thompson and Rob Pike and endorsed by Google really needed Docker to "take off"?

▲pjmlp a day ago | parent [-]

Yes, see Plan 9, Alef, Inferno and Limbo, such luminaries as Ken Thompson and Rob Pike aren't always right.

As for endorsed by Google, see Dart and Flutter, Android Things, Fuchsia.

Now everything combined, plus Docker and Kubernetes, yes it was definitely a factor.

▲OJFord 15 hours ago | parent [-]

I would absolutely say Go took off thanks to kubernetes ecosystem & CNCF projects in general, but I've never particularly associated it with Docker myself.

▲pjmlp 12 hours ago | parent [-]

Kubernetes was Google's reaction to Docker, was originally written in Java, and only got rewritten into Go, after a Go advocate joined the team and pushed for a rewrite, there is a FOSDEM talk on its evolution.

▲thephyber a day ago | parent | prev [-]

It's not hard to understand. It's just not rational to anyone who actually calculates how performant it is (very fast, I agree) with how long it takes to write.

Once I realized how difficult it is to write complex code that actually satisfies the borrow checker, I was perfectly happy with writing somewhat slower code in Go or Python.

▲pjmlp a day ago | parent [-]

Anyone that has written enough systems software in various kinds of languages, using Rust isn't that bad, only when coming from scripting languages.

Anyway, I clarified on a sibling comment the reasoning behind my question.