Managing Multiple Untrusted Applications

“Docker: The good parts By &quot;linking them&quot; what do you mean exactly? Building container hierarchies using &quot;FROM&quot;? Exposing services through ports? Exposing resources through volumes?<p>If your application is simple, then sure, you can get away with almost any deployment and provisioning approach and it&#x27;ll work &quot;well enough&quot;. But these linking capabilities and products like Chef exist for more complex scenarios, and it would do you well to investigate the rationale behind them before being so dismissive.<p>I currently have a requirement to run 100s of applications provided by mutually untrusted 3rd parties, and co-ordinate startup&#x2F;shutdown (for backup) and RPC access to these applications.<p>I need to be able to start an arbitrary combination of these applications on a node, depending on load (I cannot foresee the bandwidth&#x2F;CPU requirements of each application without running it, and it will change unpredictably over time, sometimes to the point where a 1Gb&#x2F;s link will be saturated by a single application for a few hours, and then change again to a trickle).<p>Sometimes I need to start multiple copies of this infrastructure for independent services that I may need to bring up&#x2F;down independently.<p>In my scenario, using Docker alone to deploy the whole caboodle is not a maintainable solution. Using Docker to package the untrusted applications and selectively expose just the volumes for backup and a single port to just the host control process (keeping applications from talking to one another), and Chef to deploy&#x2F;undeploy applications to nodes in arbitrary and constantly varying configurations that automatically rewire themselves is very maintainable.<p>The way I use these tools:<p>- Chef&#x2F;Puppet&#x2F;etc. = infrastructure deployment and configuration management<p>- Docker = application deployment and confinement<p>This separation is useful because the operations people can do their job, and the developers can do theirs, without stepping on each others toes and with minimal co-ordination. If you do everything in Docker, the ops team has a nightmare managing change in complex applications; if you do everything in Chef, your developers suddenly have to become Chefs, which is overkill and will waste time co-coordinating with the ops people.<p>My example above is childs play compared to what some organisations need to deploy and manage.”