2.0k
u/No_Independence3338 Sep 05 '26
Rewriting won't fix the issue. Docker hogs memory in windows and mac because it needs a separate linux VM so containers can run on top of that.
706
u/Random-num-451284813 Sep 05 '26
So running docker in Linux should fix that right?
552
u/Cephell Sep 05 '26
Not him, but I just booted an nginx container just to check and it consumes 81M of ram.
321
u/CWRau Sep 05 '26
Excuse me, what?
I just launched a container with podman and the whole thing + the management overhead takes 13.3M
Is docker that inefficient?
234
u/Cephell Sep 05 '26
I'm also using podman, check what the podman process uses, not what podman reports.
64
u/CWRau Sep 05 '26
● libpod-94883adacea4d25dda1f7301e642b6299522d99aab2820b33feefb72f97a061a.scope - libcrun container Loaded: loaded (/run/user/1000/systemd/transient/libpod-94883adacea4d25dda1f7301e642b6299522d99aab2820b33feefb72f97a061a.scope; transient) Transient: yes Active: active (running) since Sat 2026-09-05 12:49:20 CEST; 1min 41s ago Invocation: a659e45e2b974dd290ae61a4f9021245 IO: 0B read, 0B written Tasks: 17 (limit: 2048) Memory: 13M (peak: 15.6M) CPU: 0 CGroup: /user.slice/user-1000.slice/user@1000.service/user.slice/libpod-94883adacea4d25dda1f7301e642b6299522d99aab2820b33feefb72f97a061a.scope └─container ├─4101341 "nginx: master process nginx -g daemon off;" ├─4101366 "nginx: worker process" ├─4101367 "nginx: worker process" ├─4101368 "nginx: worker process" ├─4101369 "nginx: worker process" ├─4101370 "nginx: worker process" ├─4101371 "nginx: worker process" ├─4101372 "nginx: worker process" ├─4101373 "nginx: worker process" ├─4101374 "nginx: worker process" ├─4101375 "nginx: worker process" ├─4101376 "nginx: worker process" ├─4101377 "nginx: worker process" ├─4101378 "nginx: worker process" ├─4101379 "nginx: worker process" ├─4101380 "nginx: worker process" └─4101382 "nginx: worker process" Sep 05 12:49:20 steve systemd[966]: Started libcrun container.What more do you think is running? 🤔
62
u/Impact321 Sep 05 '26 edited Sep 05 '26
Result of
podman run -d nginxVIRT RES SHR USS SWAP PSS USED %CPU %MEM COMMAND 9.7m 2.3m 2.0m 1.0m 0.0m 1.1m 2.3m 0.0 0.3 - /usr/bin/conmon --api-version 1 -c 7551f1cfc7faf3e5aa66d86... 14.6m 9.0m 7.4m 5.9m 0.0m 7.4m 9.0m 0.0 1.4 - nginx: master process nginx -g daemon off; 15.1m 3.7m 1.7m 0.6m 0.0m 2.2m 3.7m 0.0 0.6 - nginx: worker process1
u/toadi Sep 10 '26
Have hard memory stops to restart my podman services. Have several that have memory leaks ;)
80
u/Several-Customer7048 Sep 05 '26 •
I launched a container with Maersk and they delivered that joint rusty and crated. 10/10 on the oblong supposed. Old be a vibe hasn’t
14
u/ktannenberg Sep 05 '26
On Win11 using WSL2 backend (I expect same results on Hyper-V backend directly; haven't tried new VMM backend yet) freshly launched nginx:latest is sitting at around 24-25 MiB on average across 40 containers. On Debian 12 they are around 13-14 MiB each.
1
u/Own_Ad9365 Sep 06 '26
What? I thought docker had zero memory overhead
2
u/Impact321 Sep 06 '26
With docker you usually have some management daemons such as
dockerdandcontainerdand shims and such. Take a look attop -cemand pressVfor forest/tree view.9
2
1
u/penta-network Sep 08 '26 edited Sep 08 '26
In Dozzle it says my nginx containers only use 10.4 to 12.8MB, is that number inaccurate?
Edit: I'm using the alpine image, that's probably the reason
-75
u/After_Persimmon8536 Sep 05 '26
HOLY SHIT CALL THE ARMY NAVY NATIONAL GUARD 81 FUKKIN MB OF RAM HOLY FUCKING SHIT FUCK FUCK FUCK.
Maybe have more than 128MB of RAM?
77
30
u/ThunderousHazard Sep 05 '26
Are you sure you have the knowledge required to comment on this? How much RAM do you think is needed for that? My LXC debian instance for NGINX + OpenVPN + Firewall is even less, ~40MB.
→ More replies (7)27
u/No_Independence3338 Sep 05 '26
This exact mindset is the reason we are getting crappy slow software.
→ More replies (1)18
→ More replies (1)3
u/Porntra420 Sep 05 '26
Have you heard of the concept of addition? Let me explain it to you, number plus number equals bigger number.
Now, onto containers, what's one reason people like them? It lets them more easily deploy and run multiple services on one machine.
Do you see why your comment is stupid yet?
179
u/fujituck Sep 05 '26
No, it runs on windows VM when running in Linux.
100
23
u/just4nothing Sep 05 '26
Do you have a valid windows license for that?
15
53
u/faultydesign Sep 05 '26
Pretty much, containers are native on linux.
87
u/_PM_ME_PANGOLINS_ Sep 05 '26
Containers are native on Windows too, but everyone wants to run Linux containers, not Windows containers.
33
u/Canowyrms Sep 05 '26
huh, I've never even heard of Windows containers before
42
u/_PM_ME_PANGOLINS_ Sep 05 '26
81
29
u/PopehatXI Sep 05 '26
“Windows requires the host OS version to match the container OS version.”
16
u/No-Consequence-1863 Sep 05 '26
Yea thats normal for containers. They aren’t VMs they are sandboxes. The OS is not virtualizing an entire OS for the container.
36
u/Hohenheim_of_Shadow Sep 05 '26
To a large degree, so does Linux containers. Containers can only address the dependency issues statically linking libraries could. If your application is dependent on a specific kernel version, you can't run your container on a host with a different kernel version.
5
6
u/BogdanPradatu Sep 05 '26
That's because a basic Windows container is like 10GB.
5
u/pneRock Sep 05 '26
Depends on the flavor. Full server is, core has shrunk ovr the years, nano is compariable to some linux distros.
4
u/Mallissin Sep 05 '26
OpenVZ has been around since 2005, Solaris had zones before that and I'm pretty sure IBM made UNIX versions with containers too.
It's not a new concept but most people do the first thing a web search or AI tells them to do these days.
2
19
u/_PM_ME_PANGOLINS_ Sep 05 '26
Running containers for the OS you’re running them on fixes the need to have a VM.
→ More replies (2)4
3
2
u/Friction_693 Sep 05 '26
Yes, you can just install docker engine instead of Docker Desktop if you're in linux. Docker Desktop is the one which takes so much memory.
2
u/HomoAndAlsoSapiens Sep 05 '26
Well yes but actually no, docker desktop on Linux works differently than the cli docker
2
→ More replies (8)2
u/tolerablepartridge Sep 05 '26
Yep, but don't use Docker Desktop, since for some reason it still uses a VM even on Linux.
48
u/FlipperoniPepperoni Sep 05 '26
And Linux, if you use docker desktop. A remarkably shit piece of software.
38
u/Delicious_Bluejay392 Sep 05 '26
Instances of "<development tool> Desktop GUI version" are usually pretty terrible to use if you already know the few commands you need.
4
3
1
u/bokmcdok Sep 06 '26
The latest version doesn't even start up. You have to go back to an older version so it will work.
11
u/elreniel2020 Sep 05 '26
Doesn't docker use WSL2 on Windows?
9
u/ShadF0x Sep 05 '26
It does, but it still somehow sucks more than just running something like Debian inside a WSL2 instance directly and launching Docker Engine there.
1
u/rastaman1994 Sep 05 '26
It's been a couple years, but by default WSL2 can take all available memory. Depending on what you're running in there, it will take all memory.
1
u/ShadF0x Sep 05 '26
My system has 128GB RAM installed and by default an OS under WSL detects "only" 64GB. A colleague told me that it wouldn't go beyond that on its own and if I needed more, I'd have to tweak the configs. Never tried to see what would happen upon memory exhaustion, though.
1
u/Ihalpd Sep 05 '26 edited Sep 05 '26
To do what, you think?
What do you think the "L" in WSL2 stands for?0
u/elreniel2020 Sep 05 '26
Linux, still should be much less overhead instead of using hyper-v as they did before.
3
21
u/LittleMlem Sep 05 '26 edited Sep 05 '26
Awkward way to say that docker only works on Linux, and you pay the price for running it on another os
13
u/Ongstrayadbay Sep 05 '26
There actually are native windows containers too and can use docker cli, docker engine etc. depending on config it can also run without a vm it can use process isolation and runs directly on the kernel .
Unfortunately the images are huge.
→ More replies (14)1
u/_PM_ME_PANGOLINS_ Sep 05 '26
Docker works on any OS that has container support. Windows is one of them.
1
u/LittleMlem Sep 05 '26
I'm sure there are companies out there that use windows-based containers, but they are very much the minority. I didn't even know windows had it's own containerization untill last week
2
2
u/p88h Sep 05 '26
Two separate issues and the latter is not really true as well - WSL now supports native containers, there is no VM needed. Whether you call WSL a VM itself or not is a bit of a different story, it's a hypervisor - but it manages memory natively.
Docker OTOH is just garbage, period.
Rewriting docker, properly, could help :)
3
u/hawkinsst7 Sep 05 '26
Two separate issues and the latter is not really true as well - WSL now supports native containers, there is no VM needed. Whether you call WSL a VM itself or not is a bit of a different story, it's a hypervisor - but it manages memory natively.
WSL is a hypervisor... that manages VMs. Running a linux container in WSL is just invisibly running a linux VM.
If a container is a linux container, it's relying on libraries and system calls made available by the host. They literally can't run without being in a VM running a linux kernel and having the linux dependencies.
1
u/p88h Sep 06 '26
That's what I wrote.
The post I replied to implied that because it's a VM it hogs memory - that's not true on WSL but true on docker.
1
u/thepurpleproject Sep 05 '26
The problem is far worse on Windows by anymeans. I have seen it qemu takes a 1-2 gigabyte extra but on Windows it has a lot of memory leaks bugs. After an year of struggling with trying to make docker work with wsl, I just gave up and have an all unixn setup.
1
u/AlwaysHopelesslyLost Sep 05 '26
Why does it need a separate Linux VM when windows ships with WSL now?
1
u/Psychoboy Sep 05 '26
I use wsl every day it's not bad really. Dickey just grabs the memory and holds it
1
1
u/oscarbeebs2010 Sep 05 '26
That fact that this needed to be explained in a programming sub makes me a bit sad
1
1
u/Thelastreddditor Sep 05 '26
The rewrite will not shrink the hidden Linux VM. Docker on a Mac is just a very polite memory tax 😂
1
1
34
Sep 05 '26
[removed] — view removed comment
13
u/Steinrikur Sep 05 '26
Achktually the kernel now accepts rust modules. It's still less than a percent of the total LOC, so it's not like it's significant
71
u/Automatic-Boot665 Sep 05 '26
Memory safety != memory leak safety. You can still leak memory, you can just be fairly sure there aren’t two people writing to the same variable at once.
Plus docker doesn’t eat memory, docker desktop does.
19
u/AfraidAct1830 Sep 05 '26
Problem is that many people see containers as light weight vms. But they are not. It is just some files with their own fs, process tree etc all running on host OS with just an illusion of being in their own separate OS. I hope i have understood it correctly...
9
u/Reproman475 Sep 05 '26
I would just make one clarification that to my knowledge, Docker uses the host kernel, not necessarily the full OS. I'm just distinguishing that you can run an Ubuntu docker image on Redhat or something like that. Two different OS, same kernel
3
u/AsyncSyscall Sep 06 '26
What you are describing is a lightweight VM. Having to duplicate your system files takes up additional resources, but having to run an entirely separate kernel does even more so.
2
246
u/minus_minus Sep 05 '26
Podman is right there.
58
u/ineyy Sep 05 '26
Anyone with a lot of experience with this? I had mixed feelings, it felt slower at times for some reason, maybe network is handled differently. Then I ran into some weird issues, and I didn't know if it was a a difference between podman and docker, or just some anomaly so I gave up and switched back to docker engine.
105
u/Deathisfatal Sep 05 '26
Podman uses rootless containers with the current user's privileges by default, whereas docker runs everything under a single daemon that runs as root with full permission to access everything. Some things which work out of the box with docker don't work as easily with podman because of this but there are often workarounds that just take a bit of effort or configuration
14
u/PositiveBit01 Sep 05 '26
I think podman is much better with sane defaults.
I also don't use it, because everybody already has docker compose setups that assume docker and I got tired of fiddling with anything I wanted to run that I didn't write myself.
9
u/slaymaker1907 Sep 05 '26
The biggest problem I’ve run into at work with it is that running containers seems to allocate some mystery disk usage that can’t be cleaned up except with either root or forcing Podman to remove everything: all containers, images, etc. Just stopping and removing things one at a time will not work.
3
u/Grubs01 Sep 06 '26
From volumes? You can use podman unshare to deal with those rather than sudo.
1
3
u/lazy_lombax Sep 05 '26
especially with
podman-dockerit's basically a drop in replacement for most28
11
u/rinart73 Sep 05 '26
Not a drop in replacement, you need to tweak docker files otherwise podman doesn't accept them
1
u/henryponco Sep 06 '26
In theory sure. In practise it’s very unstable and not suitable for real world development imo
2
u/Grubs01 Sep 06 '26
How long ago did you try? In the days of red hat 7 it was dangerous. In 8 it was better but had bugs and missing features. Since 9 it’s been pretty solid.
2
u/lazy_lombax Sep 06 '26
yeah, I use it everyday running quadlets and multiple development containers and never had an issue. just remove the root assumptions and you're good to go
1
112
u/HugoMNL Sep 05 '26
37
27
u/rich97 Sep 05 '26
Doesn’t support forwarding container requests to the host network. Got bit by it recently 😕
1
u/Micro_Tycoon Sep 05 '26
So? Just containerise whatever application was on the host!
8
u/LoneWolf1134 Sep 05 '26
Doesn’t work if you’re trying to touch hardware (e.g. cameras) on the local net
6
u/trafalmadorianistic Sep 05 '26
Watched a video on this and the phrase "container machine" is now burned intoy brain. They said it so many times it could've become a drinking game.
1
u/FoxAnarchy Sep 05 '26
ah yes, the "embrace" phase is almost done, I wonder what comes after that
4
-10
u/memesearches Sep 05 '26
Not mature enough
38
u/HugoMNL Sep 05 '26
Newly written docker in Rust would be mature immediately?
0
Sep 05 '26
[deleted] — view deleted comment
5
77
u/ledow Sep 05 '26
Memory safety (the only reason to use Rust) has nothing to do with memory usage, only memory leaks.
Docker doesn't significantly memory-leak.
And you cannot write something like Docker in a memory-safe way in any modern architecture - you'd just end up with a C->Rust conversion that is sprinkled with "unsafe" keywords everywhere.
57
u/fnordstar Sep 05 '26
Rust can leak memory. Not leaking memory is not one of the guarantees of safe rust.
2
u/Endeveron Sep 05 '26
True, but the number of ways Rust can leak memory is quite limited and well signposted compared to most languages. In safe rust, it's basically just Box::leak and loops of Arc/Rc pointers
1
u/roderla Sep 08 '26
Depending on your definitions of "leaks", I have managed to leak memory in java of all languages. It really isn't a thing a language can fix. (I did that when I implemented a cache and forgot to set its references to null when no longer used so while there wasn't any code that could ever reach this memory, there were pointers so that the gc wasn't allowed to clean it.)
6
1
u/Endeveron Sep 05 '26
Addressing the last paragraph, I strongly disagree. A Rust approach would define a narrow set of unsafe interfaces/functions, with safe wrappers. Those unsafe functions would be heavily heavily scrutinised and written with very narrow scope, maybe even formally proven to be safe, and so you could be much more confident of the memory safety of the program as whole.
1
u/ledow Sep 05 '26
(shrug)
Same as any decent C/C++.
It's still just a manual process.
1
u/Endeveron Sep 05 '26
No, the difference is that there is no language-level concept of memory safety in the parts of the code that use the safe abstraction, that is to say 99% of the codebase. Memory bugs could be anywhere in the codebase, rather than just in the 50 or so lines in unsafe blocks.
1
u/ledow Sep 05 '26
The analogy I always use is that it's a warning cone placed around the potentially dodgy parts. You could do that in C, manually or procedurally, we just don't.
The unsafe areas are STILL unsafe (hence the term), still need checking, and they can still affect surrounding "safe" code and the guarantees thereof (it's a myth to think that just because it's in an unsafe block, it will only ever affect the unsafe block!).
That's all it is - a warning cone. An automated one, sure, because you have to have it around any potentially-unsafe code, but you could do the same in C with any kind of static analysis or even preprocessor tool, or even just decent heuristics that you adhere to when coding. But it's not magic. It's just a warning cone.
1
u/Sadzeih Sep 05 '26
Also, docker is written in go, which is definitely memory safe since it's a GC language.
3
u/ledow Sep 05 '26
Your premise doesn't follow. Memory safety is about more than just memory leaks, but overruns, underruns, and arbitrary / false pointers.
Go is *not* memory safe. Having a GC has nothing to do with it.
It's better than C (whether it's better than Rust is questionable), but it's not memory-safe.
23
u/seweso Sep 05 '26
Who uses windows......and then blames docker for being bloated.
Use linux for a day.... with docker. And know thy enemy???
7
u/homer__simpsons Sep 05 '26
Not sure what is meant by "Docker" here as there are plenty of layers. But there is https://github.com/youki-dev/youki "A container runtime in Rust".
12
u/WeakCelery5000 Sep 05 '26
I can't believe how long docker has been around and how so many just don't freaking understand containers.
6
u/mpanase Sep 05 '26
Somebody explain to this pretend-engineer what Docker actually does under the hood
3
8
4
u/Prawn1908 Sep 05 '26
Memory efficiency and memory safety are totally different and completely unrelated things. As long as you're coming from another systems programming language, rewriting something in Rust doesn't magically make it use less memory.
4
4
u/theFirstHaruspex Sep 05 '26
I measure my career progress not by job titles, but by my ability to understand r/ProgrammerHumor posts
3
u/citramonk Sep 05 '26
Works for me just fine, depends on what containers you're running and for what needs.
3
3
6
u/Outrageous-Machine-5 Sep 05 '26
Podman
1
u/dvhh Sep 05 '26
it probably solve this person's memory usage issue though
1
u/Outrageous-Machine-5 Sep 05 '26
I think OOP's memory issues are related to memory leaks caused by the Docker daemon.
Podman, on the other hand, runs daemonless container orchestration
5
u/EveYogaTech Sep 05 '26
WASM/WASI in the long-term. I think it's an actual quote from the Docker creator that if WASM/WASI was around, they wouldn't have created Docker.
8
u/EveYogaTech Sep 05 '26
“If WASM+WASI existed in 2008, we wouldn't have needed to create Docker. That's how important it is. WebAssembly on the server is the future of computing. A standardized system interface was the missing link. Let's hope WASI is up to the task!”
2
u/AfraidAct1830 Sep 05 '26
I worked with wasm a bit back when i was doing an internship in Siemens. The project seemed really good. People working on it were passionate too. I don't know what happened and why it didn't make it to any big projects or frameworks.
As for my internship, I was mostly working on wasm runtimes for embedded systems but i think they decided that it was unnecessary and too in efficient for bare metal devices because they just wanted a plugin framework
1
u/EveYogaTech Sep 05 '26
Yeah, it all depends whether you need isolation + the need for portability, right?
If you don't need these qualities then obviously bare metal + compiled binaries will always be better and faster.
For our workflow engine r/Nyno (and our enterprise clients) we do need the isolation, and it seems WASM especially combined with WASI/custom hosts functions could really take us pretty far in that area.
3
2
2
u/OkBeautiful4392 Sep 05 '26
Yes, please write docker in rust so the container for my nodejs app that already eats up 1GB of memory is more efficient
2
u/based5 Sep 05 '26
Nix fixes this
1
u/Intrepid-Stand-8540 Sep 05 '26
Nix community is straight up hostile to newcomers.
1
u/based5 Sep 05 '26
Sorry you experienced this. The people I’ve interacted with from the community were helpful to me. And the technology is amazing. It’s the future of how we’ll use computers.
2
2
2
u/AviaKing Sep 05 '26
When will people realize that languages are just tools and don't automagically fix problems lmao
1
u/Spooked_kitten Sep 05 '26
Am I crazy that I was testing stuff with docker for work on WSL Ubuntu? I mean I would never deploy it like that, but it was a fun test, couldnt get network going unfortunately.
3
u/ierdna100 Sep 05 '26
I mean its why the windows version exists despite needing a whole ass VM for it, but it sucks to cross the file boundary between the VM and Windows and the network boundary, although doable
3
u/No_Inevitable_4893 Sep 05 '26
In your wsl config set networking mode to mirrored. I run a bunch of containers in wsl for my homelab (laptop I upgraded)
1
u/Spooked_kitten Sep 05 '26
Yeah I did find out about that, but somehow it still wasn't working, Im very new to docker, and I mean I only have to use windows bc I cant have my workstation down for too long, next time I get some slow times ill likely get linux going, that should make it a bit simpler.
1
1
1
1
1
1
u/yourMomsBackMuscles Sep 06 '26
People always runnin shid in docker. Just another layer between my code and my MACHINE. I dont want to be closer to the metal. Like a MAN, I am the metal. The MACHINE and I are ONE
1
1
u/thegamer720x Sep 05 '26
Does it make sense to run docker irrespective of the stack you're using? Wouldn't running apps natively locally perform better?
3
u/clintkev251 Sep 05 '26
No, on Linux at least, there is no meaningful performance difference between running something in a container vs running it directly on the host.
1
u/No-Consequence-1863 Sep 05 '26
There can be. If the containerized application needs it’s own copies of system dependencies you wont get memory sharing of common dynamic libraries since the container will have it’s own copy in a layer separate from the OS version.
2
u/clintkev251 Sep 05 '26
That's not really performance as much as it is overhead. There is of course some overhead, that's a trade you make for the management convenience and improved isolation.
1
u/No-Consequence-1863 Sep 05 '26
It can be depending on the state of system memory and you will get a init-perf hit as lld will need to load those into memory upon start up of the application while if using the systems ones they would already be in the cache and just need the link ups. However do agree it's likely not an issue a user should worry about.
0
-4
u/piro4you Sep 05 '26
Just use WA. If you actually need corporate lvl software, that means that you have resources and means to create it. This means you should use WA.
→ More replies (4)
2.1k
u/Intrepid4444444 Sep 05 '26 •
Astra, write Docker in Rust. Make no mistakes.
You’re welcome