Containers!

Containers help make applications portable, repeatable, and disposable. However, they do not help with persistent data, architecture, and security disposable. Here are a few reasons why I still use containers and why I do not use them.

Portable Applications

I like being able to spin up an application and knowing it will work. I do not have to worry about a specific version of a python library being installed, or a conflicting library for example. It just works. This just makes my life easy and I can focus on harder problems. It will work if I run it on my laptop or server.

Enables fast experimentation

Have you ever wanted to test an application quickly to see if it'll benefit you or your process? With containers you can quickly test an application or process without installing files on your host system. It'll allow you to dispose of the application quickly if it will not work for you or your process.

No VM overhead

I often run multiple applications and I do not want a seperate kernel for each application. The old administartors are shaking their fists at this, but this potentially allows more applications to run on a single host due to the lower memory requirements from less virutal machines. Containers allow you to keep processes seperate with boundaries. This does not eliminate security problems, which I will go into here shortly.

Why I don't use them

Security

Running untrusted applications, or speicfiic applications that need their own kernel boundary are not ideal to be ran in the container world. Containers share a single kernel and this model could potentially allow an application in one container to break out with a vulnerability and access data from other applications. MicroVM's are beneficial here.

Complexity

Do you have a application/utility that is a single binary file and will run almost anywhere? Containers will create extra complexity and waste time when you can just simply run the utility directly.

Networking Requirements

There are applications that need special networking requirements, special permissions etc. I prefer to keep those on a different device or VM to keep them seperate from the regular applications. A quick example is Jellfin. Containers typically use bridge mode by default and this breaks the broadcast requirements needed for DNLA to work. Attaching the container to the host network bypasses the network isolation that containers provide.

outro

This is a very highover view of why and when I use docker and podman for on my devices. Containers allow certain things to be made easy but doesn't completly eliminate of requirements of security, persistent data and more.