Docker 1.0 is a packaging format before it is anything else

The container is the part that gets discussed, and the kernel features underneath it — cgroups and namespaces — have been in Linux for years and are what LXC has always used. What arrived with 1.0 last month, and what is genuinely new, is a repeatable way to build a filesystem image in layers and move it between machines by name.

FROM ubuntu:14.04

RUN apt-get update && apt-get install -y --no-install-recommends 
        php5-cli php5-curl php5-mysql && 
    rm -rf /var/lib/apt/lists/*

COPY . /srv/app
WORKDIR /srv/app

CMD ["php", "bin/report-worker"]

# docker build -t reports:14 .
# docker run --rm reports:14
# docker save reports:14 | gzip > reports-14.tar.gz

Every instruction produces a layer, every layer is a diff against the one before it, and the result is addressed by content — so the image that ran in staging is the image that runs anywhere else, which is something tarballs and distribution packages have never quite managed. That is the whole of the value today, and it is worth having. The rest is rough. The daemon runs as root and so does everything inside the container unless you say otherwise; there is no story for a stopped machine’s data beyond a -v volume somebody has to remember; and linking two containers is an environment-variable convention rather than a network. Fig, which is the only sane way to describe more than one of these at once, is a separate project by other people. I have it on one spare box for build and test artefacts. Production stays on the provisioned VMs.