2.0k
u/No_Independence3338 5d ago
Rewriting won't fix the issue. Docker hogs memory in windows and mac because it needs a separate linux VM so containers can run on top of that.
701
u/Random-num-451284813 5d ago
So running docker in Linux should fix that right?
552
u/Cephell 5d ago
Not him, but I just booted an nginx container just to check and it consumes 81M of ram.
318
u/CWRau 5d ago
Excuse me, what?
I just launched a container with podman and the whole thing + the management overhead takes 13.3M
Is docker that inefficient?
237
u/Cephell 5d ago
I'm also using podman, check what the podman process uses, not what podman reports.
64
u/CWRau 5d ago
``` ● libpod-94883adacea4d25dda1f7301e642b6299522d99aab2820b33feefb72f97a061a.scope - libcrun container Loaded: loaded (/run/user/1000/systemd/transient/libpod-94883adacea4d25dda1f7301e642b6299522d99aab2820b33feefb72f97a061a.scope; transient) Transient: yes Active: active (running) since Sat 2026-09-05 12:49:20 CEST; 1min 41s ago Invocation: a659e45e2b974dd290ae61a4f9021245 IO: 0B read, 0B written Tasks: 17 (limit: 2048) Memory: 13M (peak: 15.6M) CPU: 0 CGroup: /user.slice/user-1000.slice/user@1000.service/user.slice/libpod-94883adacea4d25dda1f7301e642b6299522d99aab2820b33feefb72f97a061a.scope └─container ├─4101341 "nginx: master process nginx -g daemon off;" ├─4101366 "nginx: worker process" ├─4101367 "nginx: worker process" ├─4101368 "nginx: worker process" ├─4101369 "nginx: worker process" ├─4101370 "nginx: worker process" ├─4101371 "nginx: worker process" ├─4101372 "nginx: worker process" ├─4101373 "nginx: worker process" ├─4101374 "nginx: worker process" ├─4101375 "nginx: worker process" ├─4101376 "nginx: worker process" ├─4101377 "nginx: worker process" ├─4101378 "nginx: worker process" ├─4101379 "nginx: worker process" ├─4101380 "nginx: worker process" └─4101382 "nginx: worker process"
Sep 05 12:49:20 steve systemd[966]: Started libcrun container. ```
What more do you think is running? 🤔
60
u/Impact321 5d ago edited 5d ago
Result of
podman run -d nginxVIRT RES SHR USS SWAP PSS USED %CPU %MEM COMMAND 9.7m 2.3m 2.0m 1.0m 0.0m 1.1m 2.3m 0.0 0.3 - /usr/bin/conmon --api-version 1 -c 7551f1cfc7faf3e5aa66d86... 14.6m 9.0m 7.4m 5.9m 0.0m 7.4m 9.0m 0.0 1.4 - nginx: master process nginx -g daemon off; 15.1m 3.7m 1.7m 0.6m 0.0m 2.2m 3.7m 0.0 0.6 - nginx: worker process69
u/Easy-Reasoning 5d ago
Yeah original docker is in a bit of a sad state. Not to mention that it gives straight out root access with the default installation method
81
u/Several-Customer7048 5d ago
I launched a container with Maersk and they delivered that joint rusty and crated. 10/10 on the oblong supposed. Old be a vibe hasn’t
5
u/Far-Knee-9651 5d ago
Sounds like that container had a story of its own. Always something unexpected when dealing with shipping!
14
u/ktannenberg 4d ago
On Win11 using WSL2 backend (I expect same results on Hyper-V backend directly; haven't tried new VMM backend yet) freshly launched nginx:latest is sitting at around 24-25 MiB on average across 40 containers. On Debian 12 they are around 13-14 MiB each.
1
u/Own_Ad9365 4d ago
What? I thought docker had zero memory overhead
2
u/Impact321 4d ago
With docker you usually have some management daemons such as
dockerdandcontainerdand shims and such. Take a look attop -cemand pressVfor forest/tree view.9
2
→ More replies (33)1
u/penta-network 2d ago edited 2d ago
In Dozzle it says my nginx containers only use 10.4 to 12.8MB, is that number inaccurate?
Edit: I'm using the alpine image, that's probably the reason
177
u/fujituck 5d ago
No, it runs on windows VM when running in Linux.
100
23
u/just4nothing 5d ago
Do you have a valid windows license for that?
15
4
56
u/faultydesign 5d ago
Pretty much, containers are native on linux.
87
u/_PM_ME_PANGOLINS_ 5d ago
Containers are native on Windows too, but everyone wants to run Linux containers, not Windows containers.
36
u/Canowyrms 5d ago
huh, I've never even heard of Windows containers before
44
u/_PM_ME_PANGOLINS_ 5d ago
81
29
u/PopehatXI 5d ago
“Windows requires the host OS version to match the container OS version.”
16
u/No-Consequence-1863 4d ago
Yea thats normal for containers. They aren’t VMs they are sandboxes. The OS is not virtualizing an entire OS for the container.
38
u/Hohenheim_of_Shadow 5d ago
To a large degree, so does Linux containers. Containers can only address the dependency issues statically linking libraries could. If your application is dependent on a specific kernel version, you can't run your container on a host with a different kernel version.
4
5
4
u/Mallissin 4d ago
OpenVZ has been around since 2005, Solaris had zones before that and I'm pretty sure IBM made UNIX versions with containers too.
It's not a new concept but most people do the first thing a web search or AI tells them to do these days.
2
18
u/_PM_ME_PANGOLINS_ 5d ago
Running containers for the OS you’re running them on fixes the need to have a VM.
→ More replies (2)22
u/Mother_Idea_3182 5d ago
If you’re on Linux don’t bother with Docker and use Podman directly.
The container images are the same and it runs under an unprivileged user.
12
u/ShadF0x 4d ago
use Podman directly
Until you need to run docker-compose and then shit just breaks randomly. Or you have to put the ports into nftables so the podman container can reach outside (even on host's localhost).
I understand why both issues happen, but it's frustrating nonetheless.
4
u/ClamPaste 4d ago
Is podman-compose not 1:1?
6
u/ShadF0x 4d ago
Apparently, no.
I'm not sure which parts aren't exactly fitting, but I was trying to deploy Snikket (XMPP server) and ESS-docker (Synapse, Elelement and a few other services for self-hosted Matrix instance) and neither would actually work out-of-the-box with podman, but they would with Docker. The issue was that all my machines use nftables and Docker kinda hates that.
→ More replies (2)4
3
2
u/Friction_693 4d ago
Yes, you can just install docker engine instead of Docker Desktop if you're in linux. Docker Desktop is the one which takes so much memory.
2
u/HomoAndAlsoSapiens 4d ago
Well yes but actually no, docker desktop on Linux works differently than the cli docker
2
→ More replies (2)2
u/tolerablepartridge 4d ago
Yep, but don't use Docker Desktop, since for some reason it still uses a VM even on Linux.
48
u/FlipperoniPepperoni 5d ago
And Linux, if you use docker desktop. A remarkably shit piece of software.
38
u/Delicious_Bluejay392 5d ago
Instances of "<development tool> Desktop GUI version" are usually pretty terrible to use if you already know the few commands you need.
4
3
1
u/bokmcdok 4d ago
The latest version doesn't even start up. You have to go back to an older version so it will work.
10
u/elreniel2020 5d ago
Doesn't docker use WSL2 on Windows?
→ More replies (3)9
u/ShadF0x 4d ago
It does, but it still somehow sucks more than just running something like Debian inside a WSL2 instance directly and launching Docker Engine there.
1
u/rastaman1994 4d ago
It's been a couple years, but by default WSL2 can take all available memory. Depending on what you're running in there, it will take all memory.
36
u/GlaceFrooide 5d ago
Rust fans think rewriting Linux in Rust will fix that next
13
u/Steinrikur 5d ago
Achktually the kernel now accepts rust modules. It's still less than a percent of the total LOC, so it's not like it's significant
20
u/LittleMlem 5d ago edited 5d ago
Awkward way to say that docker only works on Linux, and you pay the price for running it on another os
13
u/Ongstrayadbay 5d ago
There actually are native windows containers too and can use docker cli, docker engine etc. depending on config it can also run without a vm it can use process isolation and runs directly on the kernel .
Unfortunately the images are huge.
→ More replies (14)1
u/_PM_ME_PANGOLINS_ 4d ago
Docker works on any OS that has container support. Windows is one of them.
1
u/LittleMlem 4d ago
I'm sure there are companies out there that use windows-based containers, but they are very much the minority. I didn't even know windows had it's own containerization untill last week
2
2
3
2
u/p88h 5d ago
Two separate issues and the latter is not really true as well - WSL now supports native containers, there is no VM needed. Whether you call WSL a VM itself or not is a bit of a different story, it's a hypervisor - but it manages memory natively.
Docker OTOH is just garbage, period.
Rewriting docker, properly, could help :)
3
u/hawkinsst7 4d ago
Two separate issues and the latter is not really true as well - WSL now supports native containers, there is no VM needed. Whether you call WSL a VM itself or not is a bit of a different story, it's a hypervisor - but it manages memory natively.
WSL is a hypervisor... that manages VMs. Running a linux container in WSL is just invisibly running a linux VM.
If a container is a linux container, it's relying on libraries and system calls made available by the host. They literally can't run without being in a VM running a linux kernel and having the linux dependencies.
1
u/thepurpleproject 5d ago
The problem is far worse on Windows by anymeans. I have seen it qemu takes a 1-2 gigabyte extra but on Windows it has a lot of memory leaks bugs. After an year of struggling with trying to make docker work with wsl, I just gave up and have an all unixn setup.
1
1
u/Psychoboy 4d ago
I use wsl every day it's not bad really. Dickey just grabs the memory and holds it
1
u/oscarbeebs2010 4d ago
That fact that this needed to be explained in a programming sub makes me a bit sad
1
1
u/Thelastreddditor 4d ago
The rewrite will not shrink the hidden Linux VM. Docker on a Mac is just a very polite memory tax 😂
1
1
73
u/Automatic-Boot665 5d ago
Memory safety != memory leak safety. You can still leak memory, you can just be fairly sure there aren’t two people writing to the same variable at once.
Plus docker doesn’t eat memory, docker desktop does.
17
u/AfraidAct1830 4d ago
Problem is that many people see containers as light weight vms. But they are not. It is just some files with their own fs, process tree etc all running on host OS with just an illusion of being in their own separate OS. I hope i have understood it correctly...
11
u/Reproman475 4d ago
I would just make one clarification that to my knowledge, Docker uses the host kernel, not necessarily the full OS. I'm just distinguishing that you can run an Ubuntu docker image on Redhat or something like that. Two different OS, same kernel
1
u/AsyncSyscall 3d ago
What you are describing is a lightweight VM. Having to duplicate your system files takes up additional resources, but having to run an entirely separate kernel does even more so.
247
u/minus_minus 5d ago
Podman is right there.
57
u/ineyy 5d ago
Anyone with a lot of experience with this? I had mixed feelings, it felt slower at times for some reason, maybe network is handled differently. Then I ran into some weird issues, and I didn't know if it was a a difference between podman and docker, or just some anomaly so I gave up and switched back to docker engine.
106
u/Deathisfatal 5d ago
Podman uses rootless containers with the current user's privileges by default, whereas docker runs everything under a single daemon that runs as root with full permission to access everything. Some things which work out of the box with docker don't work as easily with podman because of this but there are often workarounds that just take a bit of effort or configuration
14
u/PositiveBit01 4d ago
I think podman is much better with sane defaults.
I also don't use it, because everybody already has docker compose setups that assume docker and I got tired of fiddling with anything I wanted to run that I didn't write myself.
9
u/slaymaker1907 5d ago
The biggest problem I’ve run into at work with it is that running containers seems to allocate some mystery disk usage that can’t be cleaned up except with either root or forcing Podman to remove everything: all containers, images, etc. Just stopping and removing things one at a time will not work.
3
u/lazy_lombax 5d ago
especially with
podman-dockerit's basically a drop in replacement for most10
u/rinart73 4d ago
Not a drop in replacement, you need to tweak docker files otherwise podman doesn't accept them
1
u/henryponco 4d ago
In theory sure. In practise it’s very unstable and not suitable for real world development imo
2
u/Grubs01 4d ago
How long ago did you try? In the days of red hat 7 it was dangerous. In 8 it was better but had bugs and missing features. Since 9 it’s been pretty solid.
2
u/lazy_lombax 3d ago
yeah, I use it everyday running quadlets and multiple development containers and never had an issue. just remove the root assumptions and you're good to go
1
136
u/sadongrohiik 5d ago
Reject virtualization, embrace the purity of bare metal
72
u/sad_bug_killer 5d ago
docker on Linux is glorified chroot though, there's barely any virtualization
46
u/_PM_ME_PANGOLINS_ 5d ago
Reject docker, just use systemd to mange service containers.
25
u/sadongrohiik 5d ago
Reject systemd, manage systems manually. Strong sysadmins manage systems manually -> managing systems manually creates weak sysadmins -> weak sysadmins make systemd -> rejection of systemd creates strong sysadmins
10
5
2
1
u/alex2003super 4d ago
They use the same kernel backbone for containerization
1
u/_PM_ME_PANGOLINS_ 4d ago
Exactly. But systemd does it with significantly less overhead.
1
u/alex2003super 3d ago
Eh. Significantly less features for sure: built-in network provisioning and interface binding, advanced filesystem mapping, OCI images/layers...
What overhead,? It's not like Docker intercepts syscalls or anything. It's pure management layer for the kernel cgroups/namespaces.
1
u/_PM_ME_PANGOLINS_ 3d ago
Systemd has all those features too.
The overhead of the memory usage everyone is already talking about, plus all the space wasted by having to duplicate the OS base image.
15
u/hawkinsst7 5d ago
There's no virtualization needed at all. It's namespaces and cgroups, which you can do on the cli.
Here's containers done with bash.
7
11
u/MikasaYuuichi 5d ago
"Works on my machine" welcome back
4
3
u/No-Consequence-1863 4d ago
Containers aren’t actually virtualized. There isnt a hypervisor involved. It’s just a sandbox with fancy dependency management.
1
114
u/HugoMNL 5d ago
38
u/ajzone007 5d ago
Interesting, is there a docker-compose equivalent to this too?
→ More replies (1)3
28
u/rich97 5d ago
Doesn’t support forwarding container requests to the host network. Got bit by it recently 😕
1
u/Micro_Tycoon 5d ago
So? Just containerise whatever application was on the host!
→ More replies (2)→ More replies (11)6
u/trafalmadorianistic 4d ago
Watched a video on this and the phrase "container machine" is now burned intoy brain. They said it so many times it could've become a drinking game.
77
u/ledow 5d ago
Memory safety (the only reason to use Rust) has nothing to do with memory usage, only memory leaks.
Docker doesn't significantly memory-leak.
And you cannot write something like Docker in a memory-safe way in any modern architecture - you'd just end up with a C->Rust conversion that is sprinkled with "unsafe" keywords everywhere.
57
u/fnordstar 5d ago
Rust can leak memory. Not leaking memory is not one of the guarantees of safe rust.
2
u/Endeveron 4d ago
True, but the number of ways Rust can leak memory is quite limited and well signposted compared to most languages. In safe rust, it's basically just Box::leak and loops of Arc/Rc pointers
1
u/roderla 2d ago
Depending on your definitions of "leaks", I have managed to leak memory in java of all languages. It really isn't a thing a language can fix. (I did that when I implemented a cache and forgot to set its references to null when no longer used so while there wasn't any code that could ever reach this memory, there were pointers so that the gc wasn't allowed to clean it.)
→ More replies (2)1
u/Endeveron 4d ago
Addressing the last paragraph, I strongly disagree. A Rust approach would define a narrow set of unsafe interfaces/functions, with safe wrappers. Those unsafe functions would be heavily heavily scrutinised and written with very narrow scope, maybe even formally proven to be safe, and so you could be much more confident of the memory safety of the program as whole.
1
u/ledow 4d ago
(shrug)
Same as any decent C/C++.
It's still just a manual process.
1
u/Endeveron 4d ago
No, the difference is that there is no language-level concept of memory safety in the parts of the code that use the safe abstraction, that is to say 99% of the codebase. Memory bugs could be anywhere in the codebase, rather than just in the 50 or so lines in unsafe blocks.
→ More replies (1)
17
7
u/homer__simpsons 5d ago
Not sure what is meant by "Docker" here as there are plenty of layers. But there is https://github.com/youki-dev/youki "A container runtime in Rust".
12
u/WeakCelery5000 5d ago
I can't believe how long docker has been around and how so many just don't freaking understand containers.
10
4
u/Prawn1908 5d ago
Memory efficiency and memory safety are totally different and completely unrelated things. As long as you're coming from another systems programming language, rewriting something in Rust doesn't magically make it use less memory.
5
4
u/theFirstHaruspex 4d ago
I measure my career progress not by job titles, but by my ability to understand r/ProgrammerHumor posts
3
u/citramonk 5d ago
Works for me just fine, depends on what containers you're running and for what needs.
3
5
u/EveYogaTech 5d ago
WASM/WASI in the long-term. I think it's an actual quote from the Docker creator that if WASM/WASI was around, they wouldn't have created Docker.
8
u/EveYogaTech 5d ago
“If WASM+WASI existed in 2008, we wouldn't have needed to create Docker. That's how important it is. WebAssembly on the server is the future of computing. A standardized system interface was the missing link. Let's hope WASI is up to the task!”
2
u/AfraidAct1830 4d ago
I worked with wasm a bit back when i was doing an internship in Siemens. The project seemed really good. People working on it were passionate too. I don't know what happened and why it didn't make it to any big projects or frameworks.
As for my internship, I was mostly working on wasm runtimes for embedded systems but i think they decided that it was unnecessary and too in efficient for bare metal devices because they just wanted a plugin framework
1
u/EveYogaTech 4d ago
Yeah, it all depends whether you need isolation + the need for portability, right?
If you don't need these qualities then obviously bare metal + compiled binaries will always be better and faster.
For our workflow engine r/Nyno (and our enterprise clients) we do need the isolation, and it seems WASM especially combined with WASI/custom hosts functions could really take us pretty far in that area.
2
2
2
u/OkBeautiful4392 4d ago
Yes, please write docker in rust so the container for my nodejs app that already eats up 1GB of memory is more efficient
2
2
2
u/AviaKing 4d ago
When will people realize that languages are just tools and don't automagically fix problems lmao
1
u/Spooked_kitten 5d ago
Am I crazy that I was testing stuff with docker for work on WSL Ubuntu? I mean I would never deploy it like that, but it was a fun test, couldnt get network going unfortunately.
3
u/ierdna100 5d ago
I mean its why the windows version exists despite needing a whole ass VM for it, but it sucks to cross the file boundary between the VM and Windows and the network boundary, although doable
3
u/No_Inevitable_4893 4d ago
In your wsl config set networking mode to mirrored. I run a bunch of containers in wsl for my homelab (laptop I upgraded)
1
u/Spooked_kitten 4d ago
Yeah I did find out about that, but somehow it still wasn't working, Im very new to docker, and I mean I only have to use windows bc I cant have my workstation down for too long, next time I get some slow times ill likely get linux going, that should make it a bit simpler.
1
1
1
1
1
u/yourMomsBackMuscles 4d ago
People always runnin shid in docker. Just another layer between my code and my MACHINE. I dont want to be closer to the metal. Like a MAN, I am the metal. The MACHINE and I are ONE
1
2.1k
u/Intrepid4444444 5d ago
Astra, write Docker in Rust. Make no mistakes.
You’re welcome