Docker 与虚拟机有何不同? [英] How is Docker different from a virtual machine?

问题描述

我不断重读Docker 文档，试图了解 Docker 和完整 VM 之间的区别.它是如何设法提供完整的文件系统、隔离的网络环境等而又不那么重的?

I keep rereading the Docker documentation to try to understand the difference between Docker and a full VM. How does it manage to provide a full filesystem, isolated networking environment, etc. without being as heavy?

为什么将软件部署到 Docker 映像(如果这是正确的术语)比简单地部署到一致的生产环境更容易?

Why is deploying software to a Docker image (if that's the right term) easier than simply deploying to a consistent production environment?

推荐答案

Docker 最初使用 LinuX Containers (LXC)，但后来切换到 runC(以前称为 libcontainer)，它运行在与其主机相同的操作系统中.这允许它共享大量主机操作系统资源.此外，它使用分层文件系统(AuFS)并管理网络.

Docker originally used LinuX Containers (LXC), but later switched to runC (formerly known as libcontainer), which runs in the same operating system as its host. This allows it to share a lot of the host operating system resources. Also, it uses a layered filesystem (AuFS) and manages networking.

AuFS 是一个分层文件系统，因此您可以将只读部分和写入部分合并在一起.可以将操作系统的公共部分设为只读(并在所有容器之间共享)，然后为每个容器提供自己的写入挂载.

AuFS is a layered file system, so you can have a read only part and a write part which are merged together. One could have the common parts of the operating system as read only (and shared amongst all of your containers) and then give each container its own mount for writing.

所以，假设您有一个 1GB 的容器映像；如果您想使用完整的 VM，则需要 1GB x 数量的 VM.使用 Docker 和 AuFS，您可以在所有容器之间共享 1GB 的大部分空间，如果您有 1000 个容器，您仍然可能只有 1GB 多一点的空间用于容器操作系统(假设它们都运行相同的操作系统)图片).

So, let's say you have a 1 GB container image; if you wanted to use a full VM, you would need to have 1 GB x number of VMs you want. With Docker and AuFS you can share the bulk of the 1 GB between all the containers and if you have 1000 containers you still might only have a little over 1 GB of space for the containers OS (assuming they are all running the same OS image).

一个完整的虚拟化系统会获得自己分配给它的一组资源，并进行最少的共享.你得到更多的隔离，但它更重(需要更多的资源).使用 Docker，您可以获得更少的隔离，但容器是轻量级的(需要更少的资源).因此，您可以轻松地在一台主机上运行数千个容器，而且它甚至不会闪烁.尝试使用 Xen 执行此操作，除非您有一个非常大的主机，否则我认为这是不可能的.

A full virtualized system gets its own set of resources allocated to it, and does minimal sharing. You get more isolation, but it is much heavier (requires more resources). With Docker you get less isolation, but the containers are lightweight (require fewer resources). So you could easily run thousands of containers on a host, and it won't even blink. Try doing that with Xen, and unless you have a really big host, I don't think it is possible.

一个完整的虚拟化系统通常需要几分钟才能启动，而 Docker/LXC/runC 容器需要几秒钟，通常甚至不到一秒钟.

A full virtualized system usually takes minutes to start, whereas Docker/LXC/runC containers take seconds, and often even less than a second.

每种类型的虚拟化系统都有利有弊.如果您想要完全隔离且有保证的资源，则可以使用完整的 VM.如果您只是想将进程彼此隔离，并想在合理大小的主机上运行大量进程，那么 Docker/LXC/runC 似乎是您要走的路.

There are pros and cons for each type of virtualized system. If you want full isolation with guaranteed resources, a full VM is the way to go. If you just want to isolate processes from each other and want to run a ton of them on a reasonably sized host, then Docker/LXC/runC seems to be the way to go.

欲了解更多信息，请查看 这组博文很好地解释了 LXC 的工作原理.

For more information, check out this set of blog posts which do a good job of explaining how LXC works.

为什么将软件部署到 Docker 映像(如果这是正确的术语)比简单地部署到一致的生产环境更容易?

Why is deploying software to a docker image (if that's the right term) easier than simply deploying to a consistent production environment?

部署一致的生产环境说起来容易做起来难.即使您使用像 Chef 和 Puppet，总是有操作系统更新以及主机和环境之间发生变化的其他事情.

Deploying a consistent production environment is easier said than done. Even if you use tools like Chef and Puppet, there are always OS updates and other things that change between hosts and environments.

Docker 使您能够将操作系统快照到共享映像中，并使其易于部署在其他 Docker 主机上.在本地，dev、qa、prod 等:都是相同的图像.当然，您可以使用其他工具执行此操作，但不会那么容易或快速.

Docker gives you the ability to snapshot the OS into a shared image, and makes it easy to deploy on other Docker hosts. Locally, dev, qa, prod, etc.: all the same image. Sure you can do this with other tools, but not nearly as easily or fast.

这非常适合测试；假设您有数千个测试需要连接到数据库，并且每个测试都需要数据库的原始副本并将对数据进行更改.经典的方法是在每次测试后使用自定义代码或像 Flyway 之类的工具重置数据库 - 这可以是非常耗时，意味着必须连续运行测试.但是，使用 Docker，您可以创建数据库的映像并为每个测试运行一个实例，然后并行运行所有测试，因为您知道它们都将针对数据库的同一快照运行.由于测试是在 Docker 容器中并行运行的，因此它们可以同时在同一个机器上运行，并且应该会更快地完成.尝试使用完整的 VM 执行此操作.

This is great for testing; let's say you have thousands of tests that need to connect to a database, and each test needs a pristine copy of the database and will make changes to the data. The classic approach to this is to reset the database after every test either with custom code or with tools like Flyway - this can be very time-consuming and means that tests must be run serially. However, with Docker you could create an image of your database and run up one instance per test, and then run all the tests in parallel since you know they will all be running against the same snapshot of the database. Since the tests are running in parallel and in Docker containers they could run all on the same box at the same time and should finish much faster. Try doing that with a full VM.

来自评论...

有趣！我想我仍然对快照 [ting] 操作系统"的概念感到困惑.如果不制作操作系统的映像，如何做到这一点?

Interesting! I suppose I'm still confused by the notion of "snapshot[ting] the OS". How does one do that without, well, making an image of the OS?

好吧，让我们看看我能不能解释一下.您从一个基本映像开始，然后进行更改，并使用 docker 提交这些更改，然后它会创建一个映像.此图像仅包含与基础的差异.当你想运行你的镜像时，你还需要基础，它使用分层文件系统将你的镜像分层在基础之上:如上所述，Docker 使用 AuFS.AuFS 将不同的层合并在一起，你就会得到你想要的；你只需要运行它.您可以继续添加越来越多的图像(图层)，它只会继续保存差异.由于 Docker 通常构建在来自 registry 的现成镜像之上，因此您很少需要快照"整个操作系统自己.

Well, let's see if I can explain. You start with a base image, and then make your changes, and commit those changes using docker, and it creates an image. This image contains only the differences from the base. When you want to run your image, you also need the base, and it layers your image on top of the base using a layered file system: as mentioned above, Docker uses AuFS. AuFS merges the different layers together and you get what you want; you just need to run it. You can keep adding more and more images (layers) and it will continue to only save the diffs. Since Docker typically builds on top of ready-made images from a registry, you rarely have to "snapshot" the whole OS yourself.

这篇关于Docker 与虚拟机有何不同?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！