Marc's Public Blog - Linux Hacking

Summary: how to use docker in ways it was never meant to be used, namely to containerize already installed applications on your host system without needing a separate server image just for the container, and a new install of your app in that container.

Full talk description: Container solutions like docker were designed to let you run an application on a vanilla OS image. This is great if you want to totally decouple a new application from the underlying OS. This is not great if you don't want to have to maintain 2 operating systems (the host one and the container one) if you already have well customized OS, and if you simply want to run some existing applications in a container. This gives you the security benefit from resource/disk/network separation between untrusted applications and the rest of your operating system without having to start from scratch with a base OS and lots duplicate packages between the container and the host OS. More importantly this lets you switch existing working applications to a state where half their functionality (like the web facing portion with untrusted php code) runs in a read only container, while the backend that needs access to local disk and network resources, run outside the container, and post the data to a filesystem that is only read only in the container but sufficient for serving results.

You also benefit from completely controlling the container image and not relying on an image retrieved from the internet that may not be trustworthy by reusing the exact same OS image inside and outside the container, also minimizing upgrade time and cost.

My talk will show how to use docker to achieve those goals and get a chance to containerize applications that you probably wouldn't get around to run in containers otherwise.

Video:

Slides which you can read: