[fChk]

Here we go again as promised in the quote below:

I'll do a couple of posts in this thread. The first would be a quick review of the OP highlighting the main issues I had reading it. The second will address @deanhills' questions and @LightDestory's answers to them. May be, later on, I'll open a more comprehensive thread on Linux containers and where Docker containers rank among them.

Before I begin, I must say that anyone -with some background on Docker containers- who's read @deanhills 4 questions will inevitably know that they all stem from a complete lack of understanding of what Docker is and how it works thus the best way to address them is, instead of answering them one by one -because the answer will be redundant in someways- is to just explain what Docker is and how it works in one go!

But here I'll just try to comment on the following dialogue:

Question 1:

1. Is it possible to dockerize/containerize an existing application?  I.e. can I create docker on a system that already has an application running with Debian, and then somehow move the application into a container?  Or is it better to start the container from scratch with a freshly installed OS?

My Comment:
This question failed to distinguish between 2 Docker's concepts: a Docker image and a Docker container. What we build/create is a Docker image from which a Docker container is created/instantiated when run. BUT!.. To be able to do all that we need to install Docker on our system -the same way we install any other Linux package.

Back to the question!.. Thus we don't move an application into a container but rather we build an application Docker(/OCI) image from scratch or we just download it from 'Docker registries' (another Docker concept referring to public repositories for Docker images.)

In short, it's possible to run any application inside containers (containerize/Dockerize) but you must first have their respective images, which you can either build/create or just download from online public registries (Like DockerHub.)

Answer:

Docker can be installed anytime, no need to have a freshly installed OS. Regarding your question about the application move... well... it works that way. If someone has an application running on the bare hardware you simply decide to move it inside docker. This transition can be easy or complex because it depends on the applicaiton you are talking about. But Docker can containerize almost anything, you just need to study the "Dockerfile" specification and if you want to set up stacks (MYSQL-NGINX-PHP-WP, for example) you can use "docker-compose" that let's you create everything with just a "docker-compose up" command and a provided docker-compose-yml file!
(...)

My Comment:
Messy answer that does nothing but adds to any newbie's confusion:
1> The first crossed part was because the wording 'move' without any hint to how that's achieved just re-enforce the newbie's impression that the app is somehow just dragged from one's system into a 'container'!!.. Thus it's misleading if not false out-right.
2> The introduction of concepts like 'Dockerfile' and docker-compose is simply wrong without even mentioning anything about the prerequisite notion of 'Docker images'!!

On this tutorial I didn't use any dockerfile because it was related to @Mashiro advice to do it from scratch to learn the components behind WP.

3> You can still build a Docker image doing what you did in the OP!.. I don't see the problem in that!

Question 2:

2. Can one have docker with containers PLUS other applications from the command line, or does one have to install docker from scratch on a fresh installation of an OS and then following that all applications need to be run in separate containers.  

My Comment:
For development purposes you install Docker engine like any other package on your system (like I said in Question-1's comment.) Once installed, you'll have a Docker daemon/service permanently running in the background. It's the one you interact with (via docker command) and doing all the Docker-related business on your system (of course the picture is more complex but I won't go into that here.) Thus no need for a fresh OS install.

In production, however, Docker containers are run in cloud environments or -in the RedHat World- inside Fedora CoreOS or RedHat CoreOS which are a very particular type of OSes (ie immutable) optimised for running Containers.

Docker is just an applicaition that runs other applicaiton. It is not a OS or other low-level tool. You can have docker and other application and they can co-exists. (...)

My Comment:
1-> It has some low-level parts interacting with the kernel, like the Docker/OCI runtime runc, which was based on the Docker Inc. implementation of lxc and which has been standardized since 2016.

(..) If you want to create a inter-connection between the application (containerized or host-installed) you can set up a virtual network on which docker can communicate. For example you can have WP and MYSQL on different containers but they can communicate, if WP goes down... your MYSQL is untouched and you only need to re-create WP.
On this tutorial I said that the container was not optimal because we were abusing of it. Installing every component of application-stack such as WP on the same container is not a good practice... but create different containers and make them communicate is not a 0-knowledge thing.

Nothing in this World is a 0-knowledge thing!.. Certainly not what you tried to convey in the OP while treating it like a 0-knowledge thing!

Question 3+4:

3. How safe and secure is Docker itself?  I get a feeling of it being a panel of sorts where containers are attached and detached.

4. What is the difference between a container and backup?  I get it that a container is a shell of sorts in which the software associated with the application has been captured as well, so when you transport the container the software doesn't need to be reinstalled again.  But for me it has the same feel as a backup plugin of WordPress, except Docker container is possibly more secure.

@LightDestory
You see that's what happens when we treat a subject like a '0-knowledge thing'!.. When everything is said and done and we start getting questions like 3 and 4 then we know that we did a poor job at presenting things!

anyway, I'll end this review at this point but before that I'll just say-to reassure @deanhills- that running application inside a container is a lot safer than running them natively. Try to view them as sandboxes.

For the container vs backup part!.. I get where you get that impression: it's in the portability aspect of containers which is real BUT what's portable is the Docker image NOT the Docker container. You can move a docker image from one place to another, you can zip it(/archive it) etc.. but not the container per-se. The container is an instance of that image that's loaded into its own isolated execution environment by runC using Linux kernel features; It's a process-tree thus it's like the ether: you can only start it, stop it, pause it, kill it.

That should be all!

[fChk]

I'll do a couple of posts in this thread. The first would be a quick review of the OP highlighting the main issues I had reading it. The second will address @deanhills' questions and @LightDestory's answers to them. May be later on, I'll open a more comprehensive thread on Linux containers and where Docker containers rank among them.

I should have wrote 'where Docker containers FIT among them', which I've meant to say there.


I do have some extra-time during this month and I was thinking of starting a series of posts on Linux containers but I was hoping to first finish off my ongoing 'How to Host(/mirror) your Own online KVM VPS Locally' before jumping in yet another series.. The end goal -of both series- being to make even the newbies SEE how a container is different from a VM from bottom up (ie at the host's processes level.)

The KVM VM's thread was stalled at the I/O virtualization level because I still need some information to write it down properly.. But, anyway, it seems that it will remain that way for awhile... In the meantime, I'll be starting the Linux containers series in the coming days.. So, please, stay tuned...