# Docker

558 Hacker News commenters recommended Docker and 515 criticized it, November 2025 to November 2026. It was recommended in 13 of 13 months; owners who said how long report a median of 10 years (22 owners).

**Verdict:** Recommended for reproducible environments that run identically locally and in deployment, and for easy self-hosting with docker compose; critics stress it is not a real security boundary.

## Why people recommend it

- Consistent, reproducible environments anywhere (6 comments): "Using pixi + docker + dokku for my data processing projects lets me push an identical environment to a cloud instance with basically no devops overhead." ([source](https://news.ycombinator.com/item?id=45813682)) "Working on multiple projects, over a longer period of time, with different people, is so much easier when setup is just 'docker compose up -d'" ([source](https://news.ycombinator.com/item?id=46676636)) "Should you learn - yes. I use it always to set up my dev environment so that the team can have a consistent environment to work on." ([source](https://news.ycombinator.com/item?id=46569169))
- Easy self-hosting with compose (4 comments): "Working on multiple projects, over a longer period of time, with different people, is so much easier when setup is just 'docker compose up -d'" ([source](https://news.ycombinator.com/item?id=46676636)) "all server software that I wanted to run was provided in Docker docker containers and with docker compose examples, so it was just easier" ([source](https://news.ycombinator.com/item?id=47409245)) "It is like 4 lines of config for Postgres, the only line you need to change is on which path Postgres should store the data." ([source](https://news.ycombinator.com/item?id=47872817))
- Handy sandbox guardrail (4 comments): "At the very least, run it in Docker. It's not a security tool, but it's at least some kind of guardrail against data loss and exfiltration." ([source](https://news.ycombinator.com/item?id=47942317)) "I would always prefer the latter but would love to know what your approach to security is that's better than running npm inside Docker." ([source](https://news.ycombinator.com/item?id=47611554)) "I would probably always reach for a docker container if I want a sandboxed command that can run identically anywhere" ([source](https://news.ycombinator.com/item?id=47604114))
- Transformed packaging and deployment (4 comments): "Docker makes for great packaging. But containerizing ever step of the build process or even just doing it in one big container is a bit extra." ([source](https://news.ycombinator.com/item?id=46250527)) "Created the open source project that almost single-handely revolutionized deployments, development environments, and cloud computing" ([source](https://news.ycombinator.com/item?id=47153977)) "I am a huge Docker fan! I would reiterate what several commenters have said already that it had a huge impact on my career." ([source](https://news.ycombinator.com/item?id=50205281))

## What people warn about

- Not a real security boundary (7 comments): "Rootless Docker reduces one class of risk, but it’s important not to mistake a smaller privilege boundary for a complete security boundary." ([source](https://news.ycombinator.com/item?id=49505668)) "It's a security boundary, sure, but it's not as battle-tested as the isolation of not being root, or the isolation between VMs." ([source](https://news.ycombinator.com/item?id=46306343)) "It's a fine one, as long as you don't disable the boundary, which is as easy as running a container with --privileged." ([source](https://news.ycombinator.com/item?id=46308697))
- Untrusted images and Docker Hub (3 comments): "The moment you start pulling random dockerfiles from random sources, you'll be wasting colossal amounts of resources compared to just installing packages on your host OS" ([source](https://news.ycombinator.com/item?id=47626247)) "people find out testcontainers or whatever is pulling from docker hub rather than the company registry only when their CI build fails from rate limits" ([source](https://news.ycombinator.com/item?id=48159345)) "I did docker pull a few times base on some webpost (looks reasonable) and detect app/scripts from inside the docker connect to some .ru sites" ([source](https://news.ycombinator.com/item?id=46318500))
- Overkill for some builds (3 comments): "So instead of an ansible playbook/role that installs, say, nginx from the distro package repository, and then pushes some specific configuration, I have a dockerfile that does the same thing? Woohoo?" ([source](https://news.ycombinator.com/item?id=45925128)) "Docker makes for great packaging. But containerizing ever step of the build process or even just doing it in one big container is a bit extra." ([source](https://news.ycombinator.com/item?id=46250527)) "when something is shipped as 5 different docker containers it is MUCH harder to extract it into something you can run without docker" ([source](https://news.ycombinator.com/item?id=50112257))
- Complex, bloated, slow layer caching (4 comments): "The containers became too large. And I had to write too long arguments for volume mounts and environment variables." ([source](https://news.ycombinator.com/item?id=50057582)) "The moment you start pulling random dockerfiles from random sources, you'll be wasting colossal amounts of resources compared to just installing packages on your host OS" ([source](https://news.ycombinator.com/item?id=47626247)) "Sure Linux, Docker, Kubernetes, Postgres, and all the other standard tools in the box are open source and free, but they're also arcane and complex to run" ([source](https://news.ycombinator.com/item?id=48983083))

## Alternatives hackers recommend

- [Kubernetes](https://hackerapproved.com/p/kubernetes.md): 333 recommend
- [Docker Compose](https://hackerapproved.com/p/docker-compose.md): 149 recommend
- [Uncloud](https://hackerapproved.com/p/uncloud.md): 33 recommend
- [Podman Quadlets](https://hackerapproved.com/p/podman-quadlets.md): 30 recommend
- [podman-compose](https://hackerapproved.com/p/podman-compose.md): 8 recommend

## Cite as

Hacker Approved, "Docker", https://hackerapproved.com/p/docker/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).