DotCloud Blog

To understand Docker [0] in a complete way you first have to understand a lot of other concepts.

You need to understand what "linux containers" [1] are. To understand that you need to understand cgroups [2]. To understand cgroups you have to understand process groups/sessions [3] and namespace isolation [4], as well as how the kernel implements cgroups. [5] [6]

You need to understand what chroot [7] is. (it just prepends a path to all pathname lookups for a process and its children)

You need to understand what aufs [8] [9] is. To help understand aufs, you need to understand how union filesystems [10] work, how copy-on-write [11] works, and how virtual filesystems work [12] [13] [14].

You need to understand what rsync is [15]. To understand that you need to understand delta compression [16], and how rolling checksums [17] are used.

You should also understand things like how bash works, how processes signal each other and return status on exit, how file descriptors (like stdin/stdout/stderr) work, and other basic UNIXy concepts, to understand how other parts of docker works.

Docker is a frankenstein amalgamation of all these things, working together to allow you to basically run an arbitrary command in a way that is as isolated from your operating system as is practical while still remaining "light weight". Other solutions have other benefits or tradeoffs as evidenced here [18].

[0] http://www.activestate.com/blog/2013/06/solomon-hykes-explains-docker
[1]…

The worst thing for any service provider is to delay the initial confirmation that yes, something seems to be going wrong.

> http://blog.dotcloud.com/working-around-the-ec2-outage

"After one hour, Amazon's Health Dashboard was still pretending that everything was right."

There really is no negative side for someone as large as Amazon to immediately put up a quick notice that "we are receiving complaints about x-y-z and looking into it." I get pinged like crazy within minutes of one my client's servers slowing/going down - I can't imagine that Amazon doesn't know something is wrong within seconds. If it turns out that it wasn't AWS but something else (Level 3 pipe issues or Comcast DNS errors) then just clarify that later. Why make every single AWS customer panic for an hour fearing that the fault lies within their code/services?

Docker is based on LinuX Containers (LXC), which are much more lightweight than a full OS VM. Containers are basically namespaces for processes, networks so I would expect way lower overhead than a full fledged VM.

More details here - http://stackoverflow.com/a/16048358/803923
http://blog.dotcloud.com/under-the-hood-linux-kernels-on-dotcloud-part

It is a virtualization layer, but not nearly as heavyweight (and perhaps not as well isolated) as a full VM. As to the isolation - I don't know how "good" it is, but I expect it will only get better. I think this is what PG means by "do things that don't scale".

That's correct: cgroups have no effect on permissions. They only enforce resource usage limits.

Shameless plug: I work at dotCloud, and I wrote 4 blog posts explaining namespaces, cgroups, AUFS, GRSEC, and how they are relevant to "lightweight virtualization" and the particular case of PAAS. The articles have been grouped in a PDF that you can get here if you want a good technical read for your next plane/train/whatever travel ;-) http://blog.dotcloud.com/paas-under-the-hood-ebook

Here are the announcements on dotCloud's blog.

http://blog.dotcloud.com/dotcloud-announces-native-support-for-websock

http://blog.dotcloud.com/dotcloud-now-supports-mongodb-20

http://blog.dotcloud.com/now-scale-vertically-or-horizontally-on-dotcl