[HN Gopher] Bocker: Docker implemented in around 100 lines of Ba...
___________________________________________________________________
Bocker: Docker implemented in around 100 lines of Bash (2015)
Author : begoon
Score : 299 points
Date : 2022-10-15 20:00 UTC (1 days ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| wanderlust123 wrote:
| Any good guides that go i to detail about building docker from
| scratch? How would one even begin to do something like this?
| charles_f wrote:
| Look at the code in bocker and understand what it's doing.
| That's a good guide
| knutwannheden wrote:
| I would have opted for Shocker ;-)
| idle76 wrote:
| Backer?
| meken wrote:
| Anyone know if there's a blog post which adds more discussion and
| context for understanding the bash script and how all the
| commands fit together?
| encryptluks2 wrote:
| Just because you can doesn't mean you should.
| wmf wrote:
| You shouldn't replace Docker with a shell script but you should
| understand (at some level) how Docker works. Unfortunately this
| code is pretty dense so it would probably take a while to
| untangle it.
| LaLaLand122 wrote:
| > You shouldn't replace Docker with a shell script
|
| True. You should replace it with podman!
| CoolCold wrote:
| I see such suggestions here and there, but after quick
| redditing I've got impression podman brings more chores
| being rootless and daemonless. I couldn't justify usage of
| it for myself.
| CoolCold wrote:
| Answering for myself:
|
| Had short discussion with couple of friends more familiar
| with podman vs docker, they highlighted the case when you
| need to give access to docker socket (say for building
| images) or for other needs to someone who is not in
| infrastructure admins (devops) team. As we know, having
| access to docker effectively meant root access on host,
| so such untrusted parties access implies severe risk of
| your host belongs to someone else now.
|
| For such cases, when you cannot guarantee the one who
| operates docker is the root on host anyways, podman
| starts to make sense.
|
| Quick demo and intro:
| https://m.youtube.com/watch?v=OVkj_W6Bynk
| n4bz0r wrote:
| Woah! Don't know if it can be used as a proper Docker replacement
| (probably not), but I sure do appreciate the project as an
| example of how to use all the tools to implement an isolated
| environment. And the fact that it actually works with Docker
| containers (well, why wouldn' it, but still) is just a cheery on
| top!
| rtlfe wrote:
| > Don't know if it can be used as a proper Docker replacement
|
| The readme says "I can make no guarantees that it won't trash
| your system", so yeah clearly not intended for real use.
| stjohnswarts wrote:
| that's why smart people always check this stuff out on spare
| machines and VMs.
|
| Right?
|
| ... right?
| counttheforks wrote:
| I typically run stuff inside of docker
| yjftsjthsd-h wrote:
| And now I'm curious whether this would work inside a
| container or not. I know dind is a thing, but I don't
| recall whether it needs special hacks that bocker lacks.
| chupasaurus wrote:
| It requires nearly full root access for the inner
| container runtime, thus it can trash your system.
| jen20 wrote:
| Most software says that in the license too (even commercial
| software!) so it's nice to see it front and center for once.
| anderspitman wrote:
| Should probably run it in a VM just to be safe
| kazinator wrote:
| Where does Docker guarantee that it won't trash your system?
|
| See here: https://www.docker.com/legal/docker-terms-service/
|
| Under EXCLUSION OF WARRANTIES and LIMITATION OF LIABILITY.
|
| Here, Bocker is also a replacement for Docker in exactly the
| same sense: Bocker's simple statement "I can't guarantee it
| won't trash your system" is a concise alterantive to a wall
| of legalese.
| bottled_poe wrote:
| But.. it's not a good alternative. This description is not
| as precise or as bounded as the "legalese" wording.
| makapuf wrote:
| Well, I didn't read the legalese but read this short
| sentence. That makes it 1000% better for me right now,
| you can't abstract away the message channel. Maybe the
| best would be to have a short 10-line summary then the
| legally bounding legalese. (Edit: nonsense spelling
| error)
| kristopolous wrote:
| To be fair one is for demonstration purposes and the other
| is intended to be used. They seek the same protections
| regardless. It's kind of like how a $1,000 water filtration
| system wants the same legal protection that a $15 Brita
| does or heck, I'd assume if you got scammed with a
| fraudulent water filter that used orgone energy and
| crystals, it too would also want those legal protections.
|
| You'd probably want to tread cautiously if someone doesn't
| use disclaimers - that's probably a more dangerous product.
| kazinator wrote:
| Sure, but in this case both Bocker and Docker just
| orchestrate features of Linux, which is where all the
| risks and complexity lies.
|
| To verify that Bocker adds no additional issues is a
| smaller job than verifying Docker in the same way.
|
| If there is some problem in the actual containerization,
| Bocker and Docker will be equally affected.
| okamiueru wrote:
| Isn't the argument presented here that just because two
| things have the same "no responsibility in event of
| failure"-clause does not mean likelihood of failure,
| robustness, battletesting, etc, are comparable? Or am I
| missing something
| puchatek wrote:
| A cheer for the cheery!
| awinter-py wrote:
| follow up blogpost 'reimplementing 100 lines of bash in 1 million
| lines of go as resume building exercise'
| DrewADesign wrote:
| Then a level 79 Unix beard reimplements it in 40 inscrutable
| lines of Perl in the shape of an ascii whale... But can't
| figure out how it works an hour later.
| awinter-py wrote:
| =for comment keep the ascii whale swimming do not
| modify this code =cut
| [deleted]
| dang wrote:
| Related:
|
| _Bocker - Docker implemented in around 100 lines of Bash (2015)_
| - https://news.ycombinator.com/item?id=22244706 - Feb 2020 (196
| comments)
|
| _Docker implemented in around 100 lines of bash_ -
| https://news.ycombinator.com/item?id=16453610 - Feb 2018 (9
| comments)
|
| _Show HN: Bocker - Docker implemented in 100 lines of bash_ -
| https://news.ycombinator.com/item?id=9925896 - July 2015 (87
| comments)
| elwebmaster wrote:
| What an utter bloat and waste of resources has Docker become.
| Bocker looks refreshing, most of the goodies that made docker
| popular and no more.
| systemvoltage wrote:
| What drives me insane about Docker is the user interface it
| exposes. There are atleast 3 or 4 ways to do something. API is
| terrible (ports - 127.0.0.1:5000:5000 is confusing as fuck
| design). Volumes is a total mess, networking is worse and as a
| veteran user of docker for over 4 years on a daily basis, I
| still get confused about _everything_ Docker is and is not. It
| is one tool that makes me feel like a moron.
|
| I know it is an amazing tool so not to bash too much. There is
| a reason why I use it all the time. But goddamn it:
| https://stackoverflow.com/questions/24319662/from-inside-of-...
| and goddamn it:
| https://stackoverflow.com/questions/22049212/docker-copying-...
|
| Docker needs a new command "sudo docker someone --invent
| new:docker-replacement:latest".
| nine_k wrote:
| While some parts of Docker are far from elegance, I find the
| isolation of containers from the host by default a beneficial
| feature, and part of the very point of containers.
|
| The syntax of port mapping is unfortunate and unergonomic,
| but I suppose it just follows the syntax of port forwarding
| in OpenSSH :-/
|
| For a number of improvements / different trade-offs, see
| Podman. But does it have a neat client for macOS, which many
| developers unfortunately run? (I don't.)
| esjeon wrote:
| > I find the isolation of containers from the host by
| default a beneficial feature, and part of the very point of
| containers.
|
| There are some valid usecases during development - run some
| services on the host, while running the rest in containers.
| Containers doesn't need to know if it's connecting to the
| host or other containers. Just pass a proper URL, and
| services must blindly connect to it.
| systemvoltage wrote:
| I think Docker is great, just needs a new interface.
| nine_k wrote:
| A bit like git :)
| mavu wrote:
| Love this. There is no other single project as overhyped and over
| used as Docker.
|
| This is a great way of making fun of it.
| tchaffee wrote:
| Simple doesn't mean overhyped or over used. Both 'ls' and 'cd'
| are simple to implement. The script is more of a tutorial than
| it is making fun of anything. You'd need to give better reasons
| for why Docker is overhyped than "look at this simple script
| which does some Docker-like stuff".
| nine_k wrote:
| If docker is overused, what would you suggest instead?
| codegeek wrote:
| For many cases, you don't need it. For example, deploying a
| Go binary. Some people have the habit of dockerizing
| everything at any cost and complexity.
| eru wrote:
| You can still stick a single binary in a container.
| (Putting a whole Linux in the container as well, that's
| probably overkill. And alas, it's also what docker does by
| default.)
| nine_k wrote:
| There are ready-made no-distro base images where you can
| stick a single binary and reap the benefits of isolation.
| ohiovr wrote:
| 8,800 stars!
| throwaway892238 wrote:
| Why do people care about github stars?
| ohiovr wrote:
| Because people have hobbies and wish other people are
| enjoying them. Or it does help people tell if code is helpful
| if more people are using it. Or its some guy with 8,800 throw
| away android phones.
| jossclimb wrote:
| Project more favorable in search results. That is at least
| one reason.
| osrec wrote:
| The same reason why people care about likes on Facebook or
| karma on HN.
|
| Internet points mean very little, until you get enough that
| you start floating to the top of popularity rankings, at
| which point they suddenly become indirectly monetizable.
| version_five wrote:
| Stars have some value in they at least let you see that
| (the potential for funny business aside) many people have
| looked at the repo and upvoted it for whatever reason. I'm
| sure there are buggy or otherwise sketchy repos with many
| stars, and various gems with few stars (I have some :p ),
| though overall it's a signal
|
| Incidentally karma on HN is similar to the extent that it
| lets you how active a participant someone is, and that
| they're not a troll or throwaway. Again, it can certainly
| be gamed, and throwaway accounts often add valuable
| comments, but its still a signal
| moomin wrote:
| I've been contacted more than once by recruiters who've
| been attracted by stars of my profile. It's always a little
| challenging to explain to them that my profile is just my
| hobbies.
| tester756 wrote:
| it kinda shows that people are interested in given project
| ajross wrote:
| Really this is more interesting as a great tutorial on the way
| Linux container tools work (and especially their fundamental
| simplicity -- the docs make them seem scary when they really
| aren't) more than it is as a docker replacement (docker is
| obviously much larger than this one script, but not really
| "large" as a software stack).
|
| But reading this makes clear that, yes, containers are just
| filesystem trees, network namespaces are just like internal
| networks maintained by straightforward commands underneath an "ip
| netns" command, etc...
|
| Great stuff.
| bgribble wrote:
| My team is being hit with really extreme pricing changes for
| Docker Desktop. I have never been clear on why we even wanted DD
| (I guess right now it's the easiest path to getting x86
| containers running on M1 Macs?). Alternatives like Podman or even
| a more extreme solution like this one are becoming more and more
| attractive.
| seanhunter wrote:
| On an M1 Mac I believe that rancher desktop (mentioned in a
| sibling thread) is the way to go if you are going the
| kubernetes route. Because I only have a really simple usecase
| and want something just like docker I've been using lima[1]
| which you can just install with homebrew and set up an alias
| and then pretend you're using docker. I have had some problems
| where in long-running processes with a lot of network usage in
| the container after a while I get some network timeouts. I'm
| not sure whether that's a problem with lima or qemu or what
| else might actually be causing it. But basically as a dev
| experience it works fine even on a pretty underpowered laptop
| (which is what I'm using it on in this case).
|
| [1] https://medium.com/nttlabs/containerd-and-lima-39e0b64d2a59
| kervantas wrote:
| I actually replaced Docker Desktop on my M1 Mac, because even
| after quitting the app (properly), the qemu VM kept runing, and
| running my battery. I like that I have more control over the
| processes with podman. `podman machine stop` and the vm is
| gone.
| 411111111111111 wrote:
| Check out rancher desktop, it's free and also available on
| apple silicone
|
| https://rancherdesktop.io/
| smoldesu wrote:
| Liz Rice's presentation on re-creating Docker in Go is also quite
| eye-opening: https://www.youtube.com/watch?v=Utf-A4rODH8
| version_five wrote:
| Yes agreed, as someone who had basically no understanding of
| what docker does, this was very helpful (I'm pretty sure I saw
| it because docker used it as an introduction to itself on their
| site)
| sakras wrote:
| This is amazing! Does GitHub allow emoji names? I'd love it to be
| called ocker
| nkrisc wrote:
| Why do you need an emoji for the letter 'B'?
| teaearlgraycold wrote:
| That emoji exists because of the blood type.
|
|
| There was a meme a while back where people would use all
| over the place. Not sure why it was funny but it was.
| ghostly_s wrote:
| If you have to explain it, it's not funny. Particularly
| when the knowyourmeme page seems to indicate it's most
| prominently used by racists.
| oaththrowaway wrote:
| I see no mention of the word racist on that page. Can you
| point it out?
| Arnavion wrote:
| I don't know if it's its "most prominent" usage, but it
| gets used to replace the two g's in the N-word.
| gpvos wrote:
| This is not a meme forum; the occasional meme is fine,
| but explanations are welcome.
| stjohnswarts wrote:
| I think it was popular because of reaking ad
| nkrisc wrote:
| That's not what I'm asking. I was asking why they need an
| emoji to write "Bocker"
| teaearlgraycold wrote:
| It's a meme
| NavinF wrote:
| https://knowyourmeme.com/memes/b-button-emoji-
| chubot wrote:
| It looks like it relies on BtrFS? Can anyone add support for
| OverlayFS 2? :) which I think is more deployed these days due to
| Docker itself
|
| I'd be curious to see how it looks
| loxias wrote:
| I, too, wanted something like that and wrote it, in bash. :)
| Can confirm it's just as easy to do as you'd expect, and works
| quite well.
| chubot wrote:
| Link?
| ajross wrote:
| With overlays, you'd need some kind of registry of all the
| images in the underlying filesystem. Btrfs subvolumes give that
| to you for free, essentially. No need for deciding where to put
| them, just give them a name.
| loxias wrote:
| Or you could treat the final image for the container as the
| read only base for the overlay. That's what I do. I "flatten"
| the image from buildkit, and untar it to a directory. Then
| make an overlay mount for the container and chroot inside. :)
| ajross wrote:
| Right, but the point is a btrfs snapshot does that for you.
| No need for a "flattening" step, just make a copy-on-write
| snapshot of your layer at whatever state it exists in and
| go. Delete the original later, etc... Doesn't matter.
| jamal-kumar wrote:
| It's like 100 lines of bash, I suggest just checking out the
| source code. Very easy to understand once you know the basics
| of containerization being basically just cgroups, namespaces,
| and filesystem level isolation. I link it to people who are
| trying to learn about what containerization actually does.
| amelius wrote:
| Does it also handle the GPU correctly?
| arjvik wrote:
| Does Docker? (not counting the Nvidia docker runtime)
| amelius wrote:
| Iirc, docker has a "--gpus" flag.
| chupasaurus wrote:
| The flag is there for compatibility with any underlying
| runtime that provides access to GPU.
| llanowarelves wrote:
| Yet more proof that this exact UX/DX from the interface is a
| major part of the value add.
|
| (Edit: and docker-compose)
|
| One day the FreeBSD devs will understand. The closest is Focker:
| https://github.com/sadaszewski/focker
| HL33tibCe7 wrote:
| Laughing my head off at that "important legal notice"
| mumblemumble wrote:
| Only a few lines later we have the first paragraph of the GNU
| GPL, which includes the sentence "Everyone is permitted to
| copy and distribute verbatim copies of this license document,
| but changing it is not allowed."
|
| IANAL, but I would guess that that implies that the author is
| in violation of the GPL for adding that restriction?
| renonce wrote:
| Adding such a restrction does not have to change GPL
| itself, it's just another sentence applied as part of the
| license by the author.
| mumblemumble wrote:
| The lines were added to the top of the license. Changes
| don't need to go into the middle of the file to count as
| a modification.
| totony wrote:
| The license doesn't apply to the copyright owner afaik
| mumblemumble wrote:
| I believe the GPL itself is also copyrighted, and its use
| is covered by terms.
| glogla wrote:
| I don't see it as funny - the author is probably mentally ill
| and suffering.
| jaytaylo wrote:
| https://raw.githubusercontent.com/sadaszewski/focker/master/.
| ..
| [deleted]
| closeparen wrote:
| It's consistently baffling to me how very long winded "docker
| run" invocations win out over config files.
| wmf wrote:
| That says a lot about you and nothing about Docker.
| yjftsjthsd-h wrote:
| Thus, docker-compose.yml files.
| llanowarelves wrote:
| When I originally made my comment, I had left out any
| mention of docker-compose. But the parent commenter
| reminded me.
|
| Focker also took a stab at a docker-compose-like
| implementation.
| sbarre wrote:
| Just a note that this repo's latest update was in 2015
| tyingq wrote:
| It's a short bash script calling out to things like btrfs,
| cgcreate, cgexec, nsenter, etc. All of which get updates
| regularly.
| sbarre wrote:
| Very true, but I still think it's worth pointing out that
| this emulates _Docker from 2015_ , while Docker today
| probably doesn't look the same anymore.
| [deleted]
| quocanh wrote:
| You're telling me it's so stable and mature that it hasn't
| needed an update in 7 years? Incredible.
| andirk wrote:
| It can mean that but the world is a wicked place and that
| means no security updates either. Maybe none are needed.
| gexla wrote:
| Right, because there could be a security vulnerability in
| any one of those 100 lines of the Bash script. ;)
| interactivecode wrote:
| People here usually flip out about security when there is
| a 1 line bash install script. The world is a scary place
| when you don't trust anyone
| raydiatian wrote:
| The world is an even scarier place when you trust the
| wrong person
| lookagain wrote:
| Every piece of software relies to some degree on other
| software. Similarly, every person relies to some degree
| on other people. As long as you don't find yourselves in
| a race to the bottom of the barrel, things should be
| okay.
| robertlagrant wrote:
| With all those prerequisites it's definitely possible. I can
| implement Docker witt one prereq in one line of Bash:
| docker "$@"
|
| You're welcome, internet.
| [deleted]
| kuschku wrote:
| Except, docker has the same prerequisites. That's kind of the
| point of this excercise, to show that docker is primarily glue
| between existing tools, not necessarily new technology.
| vbezhenar wrote:
| For me docker is three things:
|
| 1. Dockerfile concept.
|
| 2. Container image format (which is know known as OCI
| container).
|
| 3. Docker hub which is a repository of containers including
| high-quality ones.
|
| Every thing is essential and bringed innovation.
|
| Launching container is boring and not really interesting
| indeed.
| mattl wrote:
| How are the first two essential? If they're useful anyone
| could improve on them
| vbezhenar wrote:
| Dockerfile format is essential because it allows for a
| single code to build container. This code could be used
| by docker build, docker buildkit, podman, kaniko and
| other tools. It's not ideal but it's good enough.
|
| Container image format is essential because it allows for
| a shared ecosystem of containers. There are plenty of
| container registries and you can just pull any image,
| build your image using those other images, etc.
|
| Basically docker introduced some standards and everyone
| accepted those standards. And that's a good thing.
| They're far from ideal, but they're kind of shared among
| implementations and good enough I guess.
|
| Now with those standards you can innovate on
| implementations. Some people replaced docker with podman,
| having access to the same vast repository of containers.
| Some people replaced docker build with kaniko, which
| allows to build containers in a different way using the
| same source Dockerfile.
| raydiatian wrote:
| This a bazillion times. It's not great but it's good
| enough, next problem. If only JavaScript devs could take
| a lesson from this and
|
| stop making new frameworks
| robertlagrant wrote:
| Here's my reply to someone else saying this listing the
| relatively few frameworks over the decades:
| https://news.ycombinator.com/item?id=32995128
| raydiatian wrote:
| > Do you really consider this an endless stream of new JS
| frameworks popping up every day?
|
| "Everyday" in the case of js frameworks has always been
| hyperbolic to me, but I think something that perhaps
| isn't unfair is "once you've mastered a given framework,
| there's a new one you have to learn."
|
| It certainly seems to be more development than in other
| languages. Seems. Seems. Seems. I could be wrong about
| that though.
___________________________________________________________________
(page generated 2022-10-16 23:02 UTC)