Programming

Containers are used for a whole bunch of reasons. I'll address just one: process isolation. I'll only do one because I've ran into times when containers were not helpful. And it may lead to some funny stories and interesting discussion from others!

A rule of thumb for me is that if the process is well-behaved, has its dependencies under control and doesn't keep uneccesary state, then it may not need the isolation provided by a container and all the tooling that comes with it.

On one extreme, should we run ls in a container? Probably not. It doesn't write to the filesystem and has only a handful of dependencies available on pretty much any Unix-like/Linux system.

But on the other extreme, what about that big bad internal Node.JS application which requires some weird outdated Python dependencies that has many hardcoded paths and package versions? The original developer is long gone. It dumps all sorts of shit to the filesystem. Nobody is really sure whether those files are used as a cache or they contain some critical state management. Who wants to spend the time and money to tidy that thing up? In this scenario containers can be used to hermetically seal a fragile thing. This can come back to bite you. Instead of actually improving the software to be portable and robust enough to work in varied execution environments (different operating systems, on a laptop, as a library...), you kick the can down the road.