ama VS bocker

If you want to stick on one machine, you can always just use a single node Docker Swarm to get the fully automated zero downtime deploys you want with Docker Compose:

https://github.com/BretFisher/ama/discussions/146

Follow Bret here

Check out Bret Fishers courses and content - https://www.bretfisher.com/

This Awesome List is maintained by Bret Fisher (and coming soon, maintainers #3). This is a curated list of working tools and resources for using Swarm. It is not an official list, but a community effort to help people find the best tools and resources for Swarm in 2023 and beyond.

https://www.bretfisher.com/ - awesome guy, awesome discord (https://devops.fan). Awesome Talks

Composer is not meant to run in production. It is only meant for development or building images. Make sure to read Getting started with swarm mode and check this if you want to use run your build image on a proper environment. (recommended)

I don't know if I would call myself an expert, but worrying about security is a big concern of mine and my job. While there are some security benefits to running your app in a container, you're correct in thinking there are some things to keep in mind while writing your Dockerfiles and using Docker. Check out Bret Fisher's write up on security concerns using Docker. This is the second time that I've mentioned him. He's a Docker Captain and recognized by Docker as an expert. His advice is sound.

Only one host for production environment. What to use: docker-compose or single node swarm? · Issue #8 · BretFisher/ama (github.com)

A (joke?) one-liner I came up with while thinking about solutions to centralized container management across multiple SSH hosts. Shame on me.

The name is inspired by bocker [0], albeit this doesn't re-implement docker-compose in bash, I found it to be fitting enough.

I'd love to see someone come up with a smarter and/or shorter way to do this.

[0] https://github.com/p8952/bocker

When I did a talk about docker I also wanted to show a bit of what it does under the hood without going through all the layers and without too much details. This ~120 lines of shell script is really good in providing just an intro into what's needed for containers: https://github.com/p8952/bocker/blob/master/bocker

i tried it and like the concnpt, but until it can be launched via a systemd userspace service (without previously manually booting it) among other problems i will keep using docker (or bocker)

> But you couldn't reimplement podman in a few hundred lines of code.

You don't even need a few hundred: https://github.com/p8952/bocker

And then there's 'dokku' which IIRC, started as a bash version of Heroku.

> Not all ideas have the same quality.

They really do. I've heard all kinds of things in my career, but almost none I would want to dedicate a portion of my life building. Not because they are bad ideas or won't work, but because of the person with the idea or it just didn't interest me. Those people went on to be moderately successful (like hundreds of millions worth) but I'm glad I wasn't on that ride.

Bocker is in this same category...docker clone in bash that's helpful in seeing what's really happening underneath with nsenter, namespaces, network bridging, cgroups, etc.

https://github.com/p8952/bocker

Docker implemented in around 100 lines of bash: https://github.com/p8952/bocker

This is the most mindblowing example for enterprise security teams that think Docker is a new threat on a single tenant Linux host.

No, buddies, all this stuff is already there. If you were fine with your visibility before*, you're still fine. Go find a real problem while we play with our developer dopamine.

* NARRATOR: They shouldn't have been.

Bocker[1] does a reasonably good job of showing the value of Docker was mostly in Docker hub.

[1] https://github.com/p8952/bocker

There is a cool project I've seen called "bocker" (https://github.com/p8952/bocker) which is something of a proof of concept of implementing Docker with bash, which speaks a bit to how Docker is indeed in many ways an amalgam of lower level primitives (such as chroot as you mentioned). Pretty neat!