The author acknowledges that, the blog post seems to be aimed at demystifying the concept of namespaces by showing that a "container runtime" that only does limited filesystem namespaces (using chroot) is enough to get some widely used containers running (of course without all the nice features and possibilities of the other types of namespaces)

Yeah, and this brings no tangible UX or security benefits and is only ever used because last-century package managers can't manage packages, containers are glorified chroots.

Containers are fine but docker is a pain in the ass that lazy people use when they don't want to provide clean installation/packaging.

How many times have I seen an equivalent of "we use a custom fork of an obsolete version of an unmaintained package, so if you want to compile it yourself good luck because we forgot how we even did it. Alternatively, you can install the docker version"...

People are afraid of what they do not understand. This still holds true here.

And fear leads to hate.

Great way to show off you haven't actually read any of the article past its title.

Containers are great, but I find Docker's way of making container images to be pretty bad, personally. Fortunately you can use other tools to create OCI images and then copy them into Docker, as the runtime is pretty nice for dev machines.

Not that it's really relevant for the discussion, but yes. You can do that, with or without chroot.

That's obviously not the point, but we're already comparing oranges and apples with chroot and containers.

Without the chroot, that's how shared webhosting works but it can be hundreds or thousands of sites, depending on resource usage and server capacity.

Your site is great!

You're comparing apples to oranges. One is a declarative Linux system environment creation solution and the other a daemon that starts sub-system environments using Linux namespaces.

You could in theory use NixOS to define a system environment that you'd run inside of a docker container. It's a bit harder to get systemd running inside of Docker which NixOS heavily relies on but that's beside the point. Easier integrations exist for LXD and systemd-nspawn which actually fulfil an equivalent purpose to Docker. The single component that is most comparable to Docker in a typical NixOS deployment would arguably be its init process (systemd), though its use extends far beyond setting up the namespace (the root namespace in this case).