I’ve felt for a decade like I’m a fool for deploying on either self-managed Linux VMs or (for small projects) free tier Heroku, and now I feel like I was accidentally doing it the smart way the whole time and didn’t know it.
…or maybe I’m still in the familiarity bias phase of learning a new tool?
@inthehands nope, that’s the actual state of the art. Compose is clearly bolted on, and it was never redesigned as a system.
Compose itself is a pretty shitty tool, too. And it has changed enough over the years that lots of guides are wrong.
@inthehands No, you're getting it. The correct way to use docker in production is: don't.
Docker is a reasonably useful dev tool. Docker compose, even more so. But it's wildly unsuited to production usage. If you want just a few containers on a relatively small and fixed number of hosts, podman or just containerd are better. If you want a lot of containers on a changing number of hosts, that's why people use k8s.
@inthehands Which "docker"? 🤣
@inthehands and the answer is an even scarier place to go - kubernetes.
That said, I'm using Google cloud run everyday as a user-friendly k8s and it's very good.
@inthehands Me, hearing about docker: Cool, yeah, a structured declaration of runtime dependencies does seem like a useful development.
Me, looking into docker: ...
@donaldball @inthehands My experience has been that there are usually better answers.
All I can say for sure about docker is that its defenders get angry really fast.
@donaldball
…and it seems like •all• of the pieces are there for Docker Compose to be exactly this thing we both assumed Docker was upon hearing about it, but…
…
@inthehands @donaldball I'm using both Docker and Compose quite successfully and I really like both of them.
I would *prefer* to have things packaged at the Linux distribution system level, but that's unfortunately not how things fly anymore, in particular since scripting languages became a thing (though things like Swift aren't supported well either).
@inthehands Docker is not art, IMHO
🙂
I’ve felt for a decade like I’m a fool for deploying on either self-managed Linux VMs or (for small projects) free tier Heroku, and now I feel like I was accidentally doing it the smart way the whole time and didn’t know it.
…or maybe I’m still in the familiarity bias phase of learning a new tool?
@inthehands I think it’s great to know how things actually work under the hood
@inthehands I still believe that PaaS is most often the right abstraction for applications. I've been waiting since forever for a good open source PaaS to emerge on top of Kubernetes, but 10 years later there's still nothing.
This is in stark contrast to my brief experiences with Ansible, which gave me the feeling of “oh, this is a lot to learn, but I see where they’re going and it makes sense.”
My last Ansible investigation stalled out trying to set up a clean process for issuing Let’s Encrypt certs, and I maybe need to pick those investigations back up again.
@inthehands LE is not the most natural match with ansible.
The latter is at its best where you can just drop shit in place using ansible as the source.
But you might want to look into acme dns. I find it a lot less painful than the get a cert for the service *through* the service chicken and egg conundrum.
Though that’s still a pain to deploy through ansible.
@inthehands there are community ansible modules in the crypto library that may work, or you can just ansiblize the certbot command with the shell module which for simple task trace'n'track may be easier .. an example only: https://itsfoss.gitlab.io/post/how-to-setup-auto-renew-for-lets-encrypt-ssl-certificates/
@inthehands . .. Containers are the excuse of Developers/Vendors to say "My code only works with these *Libraries*" .. but it's safe to run 'cause it's got C group isolation, so I can ignore it's maintenance for a long, long.. long time" despite external secrurity scans showing thier junk application code is riddled with CVE's not found in the OS vendor's back ported Repo packages deployed by Ansible nightly ...
@inthehands Ansible and Docker solve different problems, but I still feel ya. Ansible is more sensible.
There's a module now for it, might not have existed since the last time you played with it: https://docs.ansible.com/projects/ansible/latest/collections/community/crypto/acme_certificate_module.html
@lerxst
Yeah, I poked at that briefly but had to move on to other things.
The place I got hung up was the chicken and eggs problem of getting the initial cert: unless you’re willing to do ugly things with DNS, you have to already have a server running to do the ACME challenge — but then how do you get the server running without already have a cert?
@inthehands Ansible is a nice long lever that can move a small world. Once I figured it out, it became the only way I manage my team's systems. Give yourself time to write good playbooks and test in staging.
@inthehands I've been told Podman is nice. https://docs.podman.io/en/latest/index.html
@inthehands For LE I use Traefik. It's really nice IMO.
@inthehands It's unfortunate you've been made to feel foolish. Tech trends are insidious like that. Building on solid foundations is a good thing.
@nivex
I just didn’t recognize that it •was• solid foundations!
@inthehands but we can fix it with AI…
No, the state the art is actually that bad. We have lost the major leadership entirely.
