Bocker: Docker implemented in around 100 lines of Bash (2015)

[hks0]

I did something (slightly) similar via proot, called Bag [1], which I must have not described as a docker alternative: It has nothing to do with cgroups, and the cli deviates from that of docker's.

The backstory: To bypass internet censorship and deep packet inspection, I had written a proxy chain solution masquerading itself as plain html traffic. I needed it constantly running everywhere I went, but I didn't want to port it to a native android app. I wanted to run it through termux and at the time termux had no jdk/jre. Proot could spawn a archlinux env and there indeed was a jdk available.

The arch env within termux turned out to be generally more suitable for all tasks. Creating and destroying ephemeral envs with different setups and prooting into them to just run a single command is easily automated with a script; I named it bag.sh, a drastically smaller form of a shipping container.

Funny bag.sh also has a roadmap/todo in there untouched for 5 years! It's written on mobile screen hence mostly formatted to 40 columns lines to fit on the display without scrolling.

[1]: https://github.com/hkoosha/bag

[noufalibrahim]

I guess a lot of us had stories like this. I needed to package a bunch of things into a single environment where a VM was unsuitable. I cooked up something using chroot, deb-bootstrap and make an installer using makeself. It created a mini debian inside /opt which held the software and all the dependencies I needed (mysql etc.). Worked pretty well and the company I made this for used it till they got acquired in 2016 or so.

More generally though, implementing a crude version of a larger application is one of the best ways of learning how things work inside it. I'm a big fan of the approach.

[dataflow]

FYI, I think you forgot some important quotes in your script. Try shellcheck?

> mkdir -p $(dirname "$2")

[mst]

I managed to coax my 8" tablet turned horizontal to give me about 80x22 at a size I could actually read.

Combine that with a ~10" bluetooth keyboard that fits comfortably in my leather jacket's inside pockets and I get to leave the house without carrying a bag and still sit and write code in the back corner of a handy beer garden.

Turns out to be surprisingly productive as well, probably because there's just enough extra friction to flipping to my usual distractions compared to a laptop that I tend to just take a sip of my beer while continuing to glare at the code instead.

[p0w3n3d]

Wow

[random3]

I love these. Been a fan of minimal bash stuff. Here's a proof of concept for a intra-cluster load balancer in 40 lines of bash done during a hackathon I organized to promote distributed infra with Docker, Mesos, etc. about a decade ago https://github.com/cell-os/metal-cell/blob/master/discovery/...

I likely lost it, but I had a redundand and distributed reverse SSH tunnel based colo-to-cloud transfer tool.

Shell Fu and others have good collections of these https://www.shell-fu.org/

[taskforcegemini]

shell-fu.org is great, would like to see comments of other users though

[mschuster91]

The fact how simple it is to re-implement a large part of Docker because all it fundamentally is a bit of glue code to the kernel is the biggest problem Docker-the-company faced and still faces.

Where Docker adds real value is not (just) Docker Hub but Docker for Windows and Mac. The integrations offer a vastly superior experience than messing around with VirtualBox and Vagrant by hand (been there, done that) to achieve running Docker on one's development machine.

[seabrookmx]

Rancher desktop is also a viable option and free. Many including my work moved to it after Docker's new licensing kicked in.

IMO the real magic of Docker was the Docker/OCI image format. It's a brilliant way to perform caching and distribute container images, and it's really what still differentiates the workflow from "full" VM's.

[magic_hamster]

Docker Desktop on Mac is a handicapped, underprivileged mess. Docker cli for Mac with Colima is still underprivileged, but at least you can skip the bs license and Docker's gui. On Windows you can at least use Docker on WSL which works great. Why use Docker Desktop is beyond me.

[acedTrex]

I just use colima on macos, its a far better experience. Much lighter weight

[dilyevsky]

Nah, they should have prioritized building some sort of PaaS solution like CloudRun, Render or Fly so they can sell that to enterprises for $$$. Instead they did half-baked docker swarm which never really worked reliably and then lost ground to k8s rapidly

[djmips]

A lot of popular wealthy systems are 'easy' to re-implement. I thought the value was in Docker images? Or is that not how Docker is used? The only way I've used it is to be able to import someone's virtual build setup so I could build something from years ago.

[maxloh]

But Rancher Desktop does the same too (and is also open source).

[exceptione]

I think Docker is really lucky that devs still think container=Docker.

Podman is in many aspects superior, while still being able to function as a drop in.

[aryonoco]

Docker for Windows and Mac are both bloated pieces of software, outperformed by Rancher Desktop and Orbstack.

Docker's only real innovation was the OCI format, which it had to give away for it to become an industry standard, and now doesn't own.

[airstrike]

Docker for Mac is just unusable. They're not really adding any value there.

[Neywiny]

I like when repos say "not implemented yet" or "to-do" or "working on" and the last commit was years ago. Makes me feel better about not going back to my to-dos I drop through my code. (Not meaning to throw shade on this author, just finding it comforting)

[byearthithatius]

Great point! It is not shade at all, you are trying to normalize this which I like. For unpaid, volunteer, or hobby code feeling a _need_ because its public can make coding less fun or prevent people from sharing code publicly they otherwise would.

[ramon156]

I feel like most — if not all — projects are never done. Knowing when to stop is important

[Brian_K_White]

I think it's good. I guess it's possible for something to be simply done, and you don't always have to have a bunch of next ideas, but I generally always have next ideas.

If there is always some next ideas then by definition you must always have todos that never get done. It should actually be the normal state of every single project.

[SoftTalker]

When you start a project it's worth spending some time thinking about "non-goals" i.e. features that come to mind but that you intentionally are not going to implement. It's absolultely fine and often very helpful to have clear scope boundaries so you don't end up chasing rabbits and having projects that never feel "finished."

[thanatos519]

Totall ok! As soon as the program does what I want, and my task is complete, I stop developing. Software is not my hobby.

[mythz]

Surprised no one's mentioned lazydocker as a great alternative for Docker Desktop (on Linux/macOS/Windows) [1].

It's a fairly full-featured Terminal UI that has the benefit of running over ssh:

[1] https://github.com/jesseduffield/lazydocker

[orphea]

Literally a few days ago: https://news.ycombinator.com/item?id=42214873

[acka]

Lazydocker sure looks interesting, but self-promotional ads - for products in an entirely different space - in an OSS project's README.md? Seriously? At least for me it is the first time I have come across anything like this. I'm wondering if advertising like this is even allowed under GitHub's TOS and AUP.

[darkwater]

I wonder why Bocker makes the frontpage so often. Is Docker still that controversial even in 2024? Why people don't recognize that it actually brought something useful (mainly, software distribution and easy of "run everywhere") to the table?

[UK-Al05]

It's just a learning tool to see how docker works.

Docker is just a combination of kernel tech that already exists. Namespaces, cgroups, and union file systems and probably few others.

[oncallthrow]

It hits the frontpage often because people assume that Docker is this super complex thing, but (at its most fundamental), it's actually quite elegant and understandable, which is interesting - a perfect HN story, in fact.

[delusional]

It's possible it's not climbing the front page to slight docker, but rather that people are seeing that docker is something useful and want to know how it works. Bocker can be an entrypoint into the technologies.

[gosub100]

I'm bringing overlayfs to people at my company to save time on a lenghty CI process, and they are in awe at the speedup. But after demo-ing it to a few people I realized they could just use / (I could have brought them) docker.

[sellmesoap]

A brother from another mother: https://bastillebsd.org/ Bastille manages jails using shell with many of the same constructs you'd find in docker. I like it over other jail management software in BSD because it has so few dependencies.

[mst]

I'm also quite impressed by cbsd - shttps://www.bsdstore.ru/en/about.html - though that's more of a 'maximum overkill' solution in spite of being a CLI/TUI driven tool.

Currently I'm going through a phase of building and managing jails with just the stuff in FreeBSD base, but that's entirely intended to only be a phase - it'll last until I have the way all of it fits together burned into my brain well enough to be confident debugging it, and then I'll stop banging rocks together and go back to using higher level tools like a sensible person :D

[sunshine-o]

Absolutely, it adds a lot of value for a shell script that is about 100 LoC.

By the way it took me a while to get why it was named Bastille. As La Bastille was a castle built to defend Paris from English attacks during the Hundred Years' War, and then turned into a prison.

[MathMonkeyMan]

> Because most distributions do not ship a new enough version of util-linux you will probably need to grab the sources from here and compile it yourself.

Careful. The default installation prefix is /usr/bin, and the install will happily clobber your mount command with one that requires a library that doesn't exist. Then next time you boot, the kernel will mount the file system read-only.

[yazzku]

Should also be be /usr/local/bin.

[aussieguy1234]

While not good for daily driving, this gives you an idea on what docker is and how it works.

On Linux, docker is basically fancy chroot.

[musicale]

On macOS/Windows/etc., docker is basically fancy chroot in a linux VM.

[ffk]

Fun fact: docker started as bash, then moved to python before settling on golang.

Also, in a 2013 docker meetup, someone wrote a docker clone in bash.

People want to learn! Hopefully things like this help them.

[nedt]

Two years ago I gave a presentation on how docker works under the hood. After trying to understand docker, moby and containerd and how they interact I was so happy to find Bocker. Pretty much show how it can be done while showing enough of the magic moves that docker itself is actually doing. Bocker is cups&balls with clear plastic cups by Penn and Teller for docker.

[oneeyedpigeon]

If the author happens to see this: the link to your homepage on GitHub is broken - drop the "www."

[xyst]

This was written in 2015, I think we can get this down to 69 lines or less in brainfuck

[noctane]

Practicality aside, there seems to be a lot we can learn from the implementation.

[kondro]

Isn’t this how Docker started?

[amelius]

Does it require root access to the machine I have a user account on?

[schmichael]

Yes, from the README:

> Bocker runs as root and among other things needs to make changes to your network interfaces, routing table, and firewall rules. I can make no guarantees that it won't trash your system.

Linux makes it quite hard to run "containers" as an unprivileged user. Not impossible! https://github.com/rootless-containers/rootlesskit is one approach and demonstrates much of the difficulty involved. Networking is perhaps the most problematic. Your choices are either setuid binaries (so basically less-root as opposed to root-less) or usermode networking. slirp4netns is the state of the art here as far as I know, but not without security and performance tradeoffs.

[zoobab]

I am looking for a bash script that can pull docker images (via curl) and run them via chroot.

I don't need a seperate network nor process isolation.

[yeldarb]

Is there any Docker alternative on Mac that can utilize the MPS device in a container? ML stuff is many times slower in a container on my Mac than running outside

[habitue]

The issue you're running into is that to run docker on mac, you have to run it in a vm. Docker is fundamentally a linux technology, so first emulate x86_64 linux, then run the container. That's going to be slow.

There are native macos containers, but they arent very popular

[fl0id]

Podman-Desktop can do it

[WanderPanda]

Makes me wonder why docker still didn't make it to the ubuntu/debian repositories. Would be such an easy net benefit

[notpushkin]

What do you mean? It's been there for years: https://packages.debian.org/docker.io

It’s an old version, and I think it isn’t supported by Docker Inc (for the reasons mentioned in the sibling comment), but it’s there.

[ddtaylor]

(a) Docker wants to bundle vendor libraries instead of using other packages and (b) Canonical uses LXD and MicroK8s instead.

[dcreater]

Very interesting. With how standard containerization has become, we sorely need an FOSS solution

[tsujamin]

Don’t we have them? I only casually use containers, but what about podman, runc, systemd-nspawn, LXC etc?

[wmf]

If Docker isn't open enough for you, check out Podman (now with extra CNCF).

[MrDrMcCoy]

Why not podman?

[yalogin]

Is the original docker just a script? Have they not added anything to the container story themselves?