153

I never understood how to use Docker, what makes it so special? I would really like to use it on my Rapsberry Pi 3 Model B+ to ease the setup process of selfhosting different things.

I'm currently running these things without Docker:

  • Mumble server with a Discord bridge and a music bot
  • Maubot, a plugin-based Matrix bot
  • FTP server
  • Two Discord Music bots

All of these things are running as systemd services in the background. Should I change this? A lot of the things I'm hosting offer Docker images.

It would also be great if someone could give me a quick-start guide for Docker. Thanks in advance!

top 50 comments
sorted by: hot top controversial new old
[-] slazer2au@lemmy.world 59 points 9 months ago

IMHO with docker and containerization in general you are trading drive space for consistency and relative simplicity.

a hypothetical:
You set up your mumble server and it requires the leftpad 3.7 package to run. you install it and everything is fine.
Now you install your ftp server but it needs leftpad 5.5. what do you do? hope the function that mumble uses in 3.7 still exists in 5.5? run each app in its own venv?

Docker and containerization resolve this by running each app in its own mini virtual machine. A container running mumble and leftpad 3.7 can coexist on host that also has a container running a ftp server with leftpad 5.5.

Here is a good video on what hole docker and containerization looks to fill
https://www.youtube.com/watch?v=Nm1tfmZDqo8

[-] riskable@programming.dev 80 points 9 months ago

Docker containers aren't running in a virtual machine. They're running what amounts to a fancy chroot jail... It's just an isolated environment that takes advantage of several kernel security features to make software running inside the environment think everything is normal despite being locked down.

This is a very important distinction because it means that docker containers are very light weight compared to a VM. They use but a fraction of the resources a VM would and can be brought up and down in milliseconds since there's no hardware to emulate.

[-] notfromhere@lemmy.ml 3 points 9 months ago

FYI docker engine can use different runtimes and there is are lightweight vm runtimes like kata or firecracker. I hope one day docker will default with that technology as it would be better for the overall security of containers.

load more comments (7 replies)
[-] loudwhisper@infosec.pub 4 points 9 months ago

I would also add security, or at least accessible security. Containers provide a number of isolation features out-of-the-box or extremely easy to configure which other systems require way more effort to achieve, or can't achieve.

Ironically, after some conversation on the topic here on Lemmy I compiled a blog post about it.

[-] aksdb@lemmy.world 6 points 9 months ago

Tbf, systemd also makes it relatively easy to sandbox processes. But it's opt-in, while for containers it's opt-out.

[-] loudwhisper@infosec.pub 3 points 9 months ago

Yeah, and it also requires quite many options, some with harder-to-predict outcomes. For example RootDirectory can be used to effectively chroot the process, but that carries implications such as the application not having access to CA certificates anymore, which in general in containers is a solved problem.

load more comments (4 replies)
[-] danielquinn@lemmy.ca 46 points 9 months ago

There have been some great answers on this so far, but I want to highlight my favourite part of Docker: the disposability.

When you have a running Docker container, you can hop in, fuck about with files, break stuff as you try to figure something out, and then kill the container and all of the mess you've created is gone. Now tweak your config and spin up a fresh one exactly the way you need it.

You've been running a service for 6 months and there's a new upgrade. Delete your instance and just start up the new one. Worried that there might be some cruft left over from before? Don't be! Every new instance is a clean slate. Regular, reproducible deployments are the norm now.

As a developer it's even better: the thing you develop locally is identical to the thing that's built, tested, and deployed in CI.

I <3 Docker!

[-] electric_nan@lemmy.ml 5 points 9 months ago

What about your preferences/configs/files (when you spun up a fresh one)?

[-] DecentM@lemmy.ml 10 points 9 months ago

The most popular way of configuring containers are by using environment variables that live outside the container. But for apps that use files to store configuration, you can designate directories on your host that will be available inside the container (called "volumes" in Docker land). It's also possible to link multiple containers together, so you can have a database container running alongside the app.

[-] electric_nan@lemmy.ml 4 points 9 months ago

If you have all of that set up then, what benefit is there to blowing away your container and spinning up a 'fresh' one? I've never been able to wrap my head around docker, and I think this is a big part of it.

[-] DecentM@lemmy.ml 5 points 9 months ago

There's a lot more to an application than its configuration. It may require certain specific system libraries, need a certain way of starting up, or a whole host of other special things. With a container, the app dev can precreate a perfect environment for their program and save you LOADS of hassle trying to set it up.

The benefit of all this is that you can know exactly where application state is stored, know that you're running the app in it's right environment, and it becomes turbo easy to install updates, or roll back if needed.

Totally spin up a VM, install docker on it, and deploy 2-3 web apps. You'll notice that you use the same way of configuring them, starting and stopping them, and you might not want to look back ;)

load more comments (1 replies)
[-] BellyPurpledGerbil@sh.itjust.works 38 points 9 months ago* (last edited 9 months ago)

It's virtual machines but faster, more configurable with a considerably larger set of automation, and it consumes less computer resources than a traditional VM. Additionally, in software development it helps solve a problem summarized as "works on my machine." A lot of traditional server creation and management relied on systems that need to be set up perfectly identical every deployment to prevent dumb defects based on whose machine was used to write it on. With Docker, it's stupid easy to copy the automated configuration from "my machine" to "your machine." Now everyone, including the production systems, are running from "my machine." That's kind of a big deal, even if it could be done in other ways naturally on Linux operating systems. They don't have the ease of use or the same shareability.

What you're doing is perfectly expected. That's a great way of getting around using Docker. You aren't forced into using it. It's just easier for most people

[-] modeler@lemmy.world 11 points 9 months ago

This is exactly the answer.

I'd just expand on one thing: many systems have multiple apps that need to run at the same time. Each app has its own dependencies, sometimes requiring a specific version of a library.

In this situation, it's very easy for one app to need v1 of MyCleverLibrary (and fails with v2) and another needs v2 (and fails with v1). And then at the next OS update, the distro updates to v2.5 and breaks everything.

In this situation, before containers, you will be stuck, or have some difficult workrounds including different LD_LIBRARY_PATH settings that then break at the next update.

Using containers, each app has its own libraries at the correct and tested versions. These subtle interdependencies are eliminated and packages 'just work'.

[-] TDCN@feddit.dk 5 points 9 months ago

I can also add that if you want to run multiple programs that each have a web interface it's easy to direct each interface to the port you want instead of having to go through various config files that are different for each program or worst case having to change a hardcoded port in some software. With docker you have the same easy config options for each service you want to run. Same with storage paths. Various software stores their files at seemingly random places. With docker you just map a folder and all you files are stored there without any further configs.

[-] BellyPurpledGerbil@sh.itjust.works 5 points 9 months ago* (last edited 9 months ago)

I approve of this expanded answer. I may have been too ELI5 in my post.

If the OP has read this far, I'm not telling you to use docker, but you could consider it if you want to store all of your services and their configurations in a backup somewhere on your network so if you have to set up a new raspberry pi for any reason, now it's a simple sequence of docker commands (or one docker-compose command) to get back up and running. You won't need to remember how to reinstall all of the dependencies.

[-] matcha_addict@lemy.lol 33 points 9 months ago* (last edited 9 months ago)

This blog post explains it well:

https://cosmicbyt.es/posts/demistifying-containers-part-1/

Essentially, containers are means of creating environments in which you can run software, and those environments are:

  • isolated, which makes it a very controlled environment. Much harder to run into errors
  • reproducible: we have tools that reproduce the same container from an image file
  • easy to distribute: just have the container image.
  • little to no compromises on performance (at least on Linux)

It is essentially a way for you to run a program without having to worry how to set up the environment, why it didn't work as expected, what dependencies you're missing, etc.

[-] kevincox@lemmy.ml 33 points 9 months ago* (last edited 9 months ago)

I feel that a lot of people here are missing the point. Docker is popular for selfhosted services for a few main reasons:

  1. It is one package that can be used on any distribution (or even OS with a Linux VM).
  2. The package contains all dependencies required to run the software so it is pretty reliable.
  3. It provides some basic sandboxing against non-malicious services. Basically the service can't scribble all over your filesystem. It can only write to specific directories that you have given it access to (via volumes) other than by exploiting security vulnerabilities.
  4. The volume system also makes it very obvious what data is important and needs to be backed up or similar, you have a short list.

Docker also has lots of downsides. I would generally say that if your distribution packages software I would prefer the distribution's package over the docker image. A good distribution package will also solve all of these problems. The main issue you will see with distribution packages is a longer delay before new versions are made available.

What Docker completely dominates was previous cross-distribution packaging options which typically took one of the previous strategies.

  1. Self-contained compiled tarball. Run the program inside as your user. It probably puts its data in the extracted directory, maybe. How do you upgrade? Extract and copy a data directory? Self-update? Code is mutable and mixed with data, gross.
  2. Install script. Probably runs as root. Makes who-knows what changes to your system. Where is the data, is the service running? Will it auto-start on boot. Hope that install script supports your distro.
  3. Source tarball. Figure out the dependencies. Hope they don't conflict with the versions your distro has. Set up users and setup scripts yourself. Hope the build doesn't take too long.
load more comments (4 replies)
[-] excitingburp@lemmy.world 24 points 9 months ago* (last edited 9 months ago)

For your use case, consider it to be a packaging format (like AppImage, Flatpak, Deb, RPM, etc.) that includes all the dependencies (including services, not just libraries) for the app in question.

Should I change this?

If it's not broken don't fix it.

Use Podman (my preferred - the SystemD approach is awesome), containerd, or Incus. Docker is a graveyard of half-finished pet projects that have no reason for existing. Podman has a Docker-compatible socket, so 100% of Docker tooling will work with it.

[-] ComradeKhoumrag@infosec.pub 6 points 9 months ago

I can add, podman was ignored in previous years at my day job because there were some reliability issues either with GPU access or networking I forget, however these issues have been resolved and we're reimplementing it pretty much effortlessly

[-] MashedTech@lemmy.world 5 points 9 months ago

Yep, we're reconsidering it at work as well. it's grown pretty nicely

[-] marcos@lemmy.world 18 points 9 months ago

Try to run something that requires php7 and something else that requires php8 on the same web server; or python 2 and python 3.

You actually can, but it's not pretty.

(The thing about a declarative setup isn't much of a difference, you can do it for any popular Linux distro.)

load more comments (2 replies)
[-] brewery@lemmy.world 17 points 9 months ago

I have a reason I don't think is covered. A few programs I have come across that I want to try recommend docker and some only provide instructions for docker. They can spend less time trying to help you with dependencies and installations knowing they've included everything you need in the docker file. I don't have a background in Linux or programming so unless they tell you exactly how to install something, I can struggle. Their installation page is then just the docker compose file with a note on the environment variables you can change.

[-] Fedegenerate@lemmynsfw.com 15 points 9 months ago* (last edited 9 months ago)

When I asked this question

So there are many reasons, and this is something I nowadays almost always do. But keep in mind that some of us have used Docker for our applications at work for over half a decade now. Some of these points might be relevant to you, others might seem or be unimportant.

  • The first and most important thing you gain is a declarative way to describe the environment (OS, dependencies, environment variables, configuration).
  • Then there is the packaging format. Containers are a way to package an application with its dependencies, and distribute it easily through the docker hub (or other registries). Redeploying is a matter of running a script and specifying the image and the tag (never use latest) of the image. You will never ask yourself again "What did I need to do to install this again? Run some random install.sh script off a github URL?".
  • Networking with docker is a bit hit and miss, but the big thing about it is that you can have whatever software running on any port inside the container, and expose it on another port on the host. Eg two apps run on port :8080 natively, and one of them will fail to start due to the port being taken. You can keep them running on their preferred ports, but expose one on 18080 and another on 19080 instead.
  • You keep your host simple and empty of installed software and packages. Less of a problem with apps that come packaged as native executables, but there are languages out there which will require you to install a runtime to be able to start the app. Think .NET, Java but there is also Python out there which requires you to install it on the host and have the versions be compatible (there are virtual environments for that but im going into too much detail already).

I am also new to self hosting, check my bio and post history for a giggle at how new I am, but I have taken advantage of all these points. I do use "latest" though, looking forward to seeing how that burns me later on.

But to add one more:- my system is robust, in that I can really break my containers (and I do), and to recover is a couple clicks in Portainer. Then I can try again, no harm done.

[-] fury@lemmy.world 4 points 9 months ago

The thing with using the "latest" tag is you might get lucky and nothing bad happens (the apps are pretty stable, fault tolerant, and/or backward compatible), but you also might get unlucky and a container update does break something (think a 1.x going to 2.x one day). Without pinning the container to a specific version, you might have an outage suddenly due to that container becoming incompatible with one of your other applications. I've seen this happen a number of times. One example is a frontend (UI) container that updates to no longer be compatible with older versions of the backend and crashes as a result.

If all your apps are pretty much standalone and you trust them to update properly every time a new version of the container is downloaded, then you may never run into the problems that make people say "never use latest". But just keep an eye out for something like that to happen at some point. You'll save yourself some time if you have records of what versions are running when everything's working, and take regular backups of all their data.

load more comments (2 replies)
[-] redcalcium@lemmy.institute 14 points 9 months ago

One of the the main reasons why docker and kubernetes take off is they standardized the deployment process. Say, you have 20 services running on your servers. It's much easier to maintain those 20 services as a set of yaml files that follow certain standard than 20 config files each with different format. If you only have a couple of services, the advantage is probably not apparent. But as you add more and more services, you'll start to appreciate it.

[-] doeknius_gloek@discuss.tchncs.de 5 points 9 months ago

Yep, I couldn't run half of the services in my homelab if they weren't containerized. Running random, complex installation scripts and maintaining multiple services installed side-by-side would be a nightmare.

[-] groet@feddit.de 13 points 9 months ago

The thing that confused me when first learning about docker was, that everybody compares it to a virtual machine. It's not. Containers dont virtualize anything. They take a (single) process from the host OS and separate that into its own environment. All system calls, memory access, file writes etc are still handled by the same os (same kernel). However the process is separated both on the file system and process level. It can't see other processes outside of the container and it also doesn't see the real filesystem. It sees a filesystem provided by the container. This also means it sees different file and user permissions. When you run a alpine Linux docker container on an Ubuntu system, the container only containes the (few) files for alpine but no Linux kernel no desktop environment. A process inside that container only sees the alpine files and not the Ubuntu files. It also means all containers see a filesystem independent of each other and can use libraries and dependencies of different versions (they are only files after all).

For administration it makes running complex services easy. You define how to setup that service (what base Linux distro to use, what packages to install, what commands to run, and how to start the process). You can then be save to assume the setup of that service did not interfere with the setup of any other service. "Service 1 needs a certain system wide config changed? Service 2 needs that config in the default state? And both need a different version of the same library?" In containers you can have all at the same time because they each see a different version of the same config and library.

And all this is provided by the kernel itself. All docker does is provide an "easy" way to create and manage containers but could could do all of that using chroot, runc and a few other.

As a note, containers usually don't come with systemd as they don't need an init system. You would run the service directly inside the container and then use systemd outside the container to make sure the container is started/restarted, or just docker as it can already do that.

I found a great article demystifying containers recently

[-] kevincox@lemmy.ml 6 points 9 months ago

While you are technically right there is very little logical difference between containers and VMs. Really the only fundamental difference is that containers use the same kernel while VMs run their own. (let's not even worry about para-virtualization right now).

In practice I would say the biggest difference is that there is better memory sharing so total memory usage will often be less. But honestly this mostly comes down to the fact that the average container bundles less software than the average VM image. Easier management of volumes is also nice because typically you will just bind-mount a host directory, but it also isn't hard to mount a block device on a Linux host.

[-] BCsven@lemmy.ca 10 points 9 months ago

Install Portainer, it helps you get used to managing docker images and containers before going full command line.

[-] RootBeerGuy@discuss.tchncs.de 9 points 9 months ago

I actually prefer dockge, I only have a few containers and its a lot simpler while still able to do all the basics of docker management. Portainer was overkill for me.

[-] ikidd@lemmy.world 5 points 9 months ago

I have a pile of containers both for selfhosting and for dev builds, and still wouldn't use Portainer.

Lazydocker, FTW

[-] Vendetta9076@sh.itjust.works 3 points 9 months ago

I learned on portainer. I just wish it worked better. Dockge is a much better solution anyways

[-] hperrin@lemmy.world 7 points 9 months ago* (last edited 9 months ago)

One benefit that might be overlooked here is that as long as you don’t use any Docker Volumes (and instead bind mount a local directory) and you’re using Docker Compose, you can migrate a whole service, tech stack and everything, to a new machine super easily. I just did this with a Minecraft server that outgrew the machine it was on. Just tar the whole directory, copy it to the new host, untar, and docker compose up -d.

load more comments (3 replies)
[-] festus@lemmy.ca 6 points 9 months ago

I started self-hosting a bit prior to when Docker took off, and getting multiple services running was much harder. Service A wants a certain version of PHP installed with certain plugins while Service B wants a different version. You'd follow a tutorial for installing Service C and desperately hope that it wouldn't somehow break Service A or B. You installed Service D for a bit despite all the installation pain and now want to uninstall it - I hope you tracked exactly what config changes you made throughout the system so you can undo it.

Docker fixed all of this by making each service independent through containers which made self-hosting 10x easier. I'd also add that I love how easy it is to transfer my setup to a new server - I keep all of my container volumes in a specific directory and my docker-compose files in another and that's all I need to backup / transfer. Without Docker you'd have to specifically handle each & every configuration file and database location, and if you later upgrade to a newer version of the OS or a different distro you'd have to handle possible conflicts between your versions and what the distro expects.

[-] Lifebandit666@feddit.uk 5 points 9 months ago

I've used Docker a fair bit over the years because it's a simple line of code I can copy/paste to get a simple web server running.

I ran Home Assistant Supervised in Docker for many years. It was a few lines of code and then I basically had Home Assistant OS running on my Pi without it taking over the whole Pi, meaning I could run other things on it too.

That ended when HA just died one day and I had no clue how to get it running again. I spent a day trying, then just installed HA OS on the Pi instead.

Anyway I now have a Dell Optiplex and Proxmox and I've gone back to Docker. Why? Well I discovered that I could make a Linux VM and install Docker on it, then add the Docker code to install a Portainer client to it, then make that into a template.

Meaning I can clone that template and type the IP address into Portainer and now I have full access to that Docker instance from my original Portainer container. That means I can bang a Docker Compose file into the "Stack" and press go, then tinker with the thing I wanna tinker with. If I get it working it can stay, if I don't then I just delete the VM and I've lost nothing.

Portainer has made Docker way more accessible for me. I love a webui

load more comments (8 replies)
[-] ryannathans@aussie.zone 5 points 9 months ago

A lot of people here really do be describing docker like flatpak

[-] matcha_addict@lemy.lol 6 points 9 months ago

They're similar under the good, but flatpak is optimized for desktop use. Docker targets server applications.

[-] i_am_not_a_robot@discuss.tchncs.de 4 points 9 months ago

If you're already using systemd, do not switch to Docker. Use Podman instead. Docker runs all your services under the Docker service. Podman can both run the same containers as systemctl services.

load more comments (2 replies)
load more comments
view more: next ›
this post was submitted on 11 Mar 2024
153 points (94.2% liked)

Selfhosted

40749 readers
492 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS