Docker may be wildly popular with many developers. But not everyone loves Docker, as the Boycott Docker initiative shows.
Boycott Docker is a bare-bones website designed to argue against Docker adoption. It criticizes Docker containers on a number of grounds. The most significant claims include:
- Docker is insecure because Docker registries are not secured and “Docker does not know anything about either SELinux or AppArmor,” which help prevent security breaches on Linux systems.
- Building Docker applications requires writing scripts (or Dockerfiles, at least). Docker does not add value to the scripts; you could script application builds without Docker.
- Docker requires some apps to be rewritten to run in containers.
- Docker’s abstraction layers eat up CPU time, thereby undercutting the performance advantages that containers theoretically offer over virtual machines.
- The complexity required to run applications inside containers creates more trouble than it is worth.
- Administering Docker containers requires you to learn new commands.
The list could go on, but these seem to be the chief objections outlined on Boycott Docker.
Some of these claims are inaccurate or outdated. Docker image registries can be secured, and both AppArmor and SELinux can be used to harden the Docker daemon against security threats.
Other Boycott Docker criticisms, however, may seem more valid, especially to developers. It’s hard to deny that there is a relatively significant learning curve for deploying applications using Docker. Even if you’re a skilled programmer and know your way around the Linux CLI, you have to learn a whole new process to create and administer Docker applications.
It’s also hard to deny that Docker adds more complexity. You have to contend with virtual networks, container file systems that are not persistent, user permissions and much more.
Whether that means Docker should be boycotted, however, depends on whether you think the extra complexity that Docker creates is worth the trouble. After all, most new technologies are more complex than the ones they replace. VMware is harder to manage than a bare-metal server, and it requires acquisition of a special set of skills. That doesn’t mean no one is using virtual machines, however.
Whatever you think of Boycott Docker and the claims its proponents make, it’s worth recognizing that opposition to Docker exists. Docker is so popular with some programmers and the tech media that it can be easy to forget that not everyone is in love with Docker containers. Clearly, that is not the case.