Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transitioning from Docker to Podman

developers.redhat.com

Post reply on HN
Print view View original

131–140 of 278 posts

Re: Transitioning from Docker to Podman

#131

Post by throwaway894345 »

yjftsjthsd-h wrote: post #48
throwaway894345 wrote: post #18

Earlier quoted context omitted.

I actually like the idea of Docker as a better systemd (or rather, the interface is better). No bespoke file format, programmable API, no need to google for the right journalctl switches, and then of course the advantages of containers and images over processes and system packages. I’m not suggesting everything should be a container nor that docker is the ideal implementation, but it certainly points in the right dir…

How are you using Docker that doesn't need a bespoke file format? You're building from a Dockerfile and either scripting around the docker command or running docker-compose.yml

Compose

Re: Transitioning from Docker to Podman

#133

Post by deckard1 »

Spivak wrote: post #27
throwaway894345 wrote: post #18

Earlier quoted context omitted.

I actually like the idea of Docker as a better systemd (or rather, the interface is better). No bespoke file format, programmable API, no need to google for the right journalctl switches, and then of course the advantages of containers and images over processes and system packages. I’m not suggesting everything should be a container nor that docker is the ideal implementation, but it certainly points in the right dir…

But systemd has all of those things. Everything in systemd can be orchestrated with dbus. In fact that’s all systemctl really is — a dbus client. And the file format is ini. And shell style environment files if you want. And systemd actually comes with two image launching systems systemd-nspawn and systemd-portable. And then with systemd-machined you can add software that needs virtualization too. The interface to jo…

> The interface to journald is more complicated than it should be but it’s also really powerful

I thought the point of logging to stdout (i.e. docker logs) is that you just take that output and dump it to another server for processing and filtering.

journald/journalctl seem to be a solution a few decades late to the party. For a single user machine or a single app prod environment, I would take a plaintext log any day of the week. At least I can remember how to grep the damn thing. And then when you get to a distributed system, what's the point of journalctl? You would hopefully have all of that logging aggregated together in one place with a much nicer web interface for it all.

Re: Transitioning from Docker to Podman

#134

Post by dahfizz »

zelly wrote: post #126

It's compatible with cgroups v2 unlike the standard Docker. If you're using Fedora, you have to add a kernel parameter to Grub to use cgroups v1 instead. RedHat seems to be pushing a standard ecosystem for Linux: systemd, Wayland, SELinux, GNOME, and now maybe podman. I've been on Linux for a while; it's a welcome change from all the fragmentation I'm used to. Whereas others try to work around the kernel and implemen…

Anecdotally, I've worked with developers at Redhat and Canonical, and the Redhat developers had passion. They really believed in open source and the linux community. In comparison Canonical seemed like Just Another Software Company to me.

Re: Transitioning from Docker to Podman

#135

Post by soraminazuki »

educar wrote: post #110
soraminazuki wrote: post #102

Earlier quoted context omitted.

It's a root daemon which can be made to run arbitrary commands by anyone using its interface, so yes it is a huge, huge security burden. You can't just brush that off as a superficial problem.

Given that the most common case is running docker in server environments in VMs and the sysadmins are root, is this a real issue? Can you tell me an environment where a multi-tenant system runs docker?

Yes, it[1] is[2] a[3] real[4] issue[5] which leads to privilege escalation bugs. It also doesn't help that most containers that Docker is responsible for managing is supposed to be unprivileged, and Docker itself is commonly used as a component for a multi-tenant container runtime.

[1] https://www.cvedetails.com/cve/CVE-2019-15752/

[2] https://www.cvedetails.com/cve/CVE-2019-14271/

[3] https://www.cvedetails.com/cve/CVE-2019-5736/

[4] https://www.cvedetails.com/cve/CVE-2018-15664/

[5] https://www.cvedetails.com/cve/CVE-2018-15514/

Re: Transitioning from Docker to Podman

#136

Post by zer0nka »

zelly wrote: post #126

It's compatible with cgroups v2 unlike the standard Docker. If you're using Fedora, you have to add a kernel parameter to Grub to use cgroups v1 instead. RedHat seems to be pushing a standard ecosystem for Linux: systemd, Wayland, SELinux, GNOME, and now maybe podman. I've been on Linux for a while; it's a welcome change from all the fragmentation I'm used to. Whereas others try to work around the kernel and implemen…

btrfs is depreciated in redhat distribution

Re: Transitioning from Docker to Podman

#138

Post by weikju »

zer0nka wrote: post #136
zelly wrote: post #126

It's compatible with cgroups v2 unlike the standard Docker. If you're using Fedora, you have to add a kernel parameter to Grub to use cgroups v1 instead. RedHat seems to be pushing a standard ecosystem for Linux: systemd, Wayland, SELinux, GNOME, and now maybe podman. I've been on Linux for a while; it's a welcome change from all the fragmentation I'm used to. Whereas others try to work around the kernel and implemen…

btrfs is depreciated in redhat distribution

*deprecated

On the other hand isn’t btrfs becoming the default in Fedora 33, thus eventually making a comeback in RHEL?

Re: Transitioning from Docker to Podman

#139

Post by gitweb »

dahfizz wrote: post #134
zelly wrote: post #126

It's compatible with cgroups v2 unlike the standard Docker. If you're using Fedora, you have to add a kernel parameter to Grub to use cgroups v1 instead. RedHat seems to be pushing a standard ecosystem for Linux: systemd, Wayland, SELinux, GNOME, and now maybe podman. I've been on Linux for a while; it's a welcome change from all the fragmentation I'm used to. Whereas others try to work around the kernel and implemen…

Anecdotally, I've worked with developers at Redhat and Canonical, and the Redhat developers had passion. They really believed in open source and the linux community. In comparison Canonical seemed like Just Another Software Company to me.

My experience has consistently been the opposite.

Re: Transitioning from Docker to Podman

#140

Post by bogomipz »

defen wrote: post #121
bogomipz wrote: post #108

Earlier quoted context omitted.

Your CI server running in a container that is itself executing Docker commands.

You need more constraints than that to explain why you can't just mount /run/docker.sock in the CI container.

If you don't manage your own CI server then that is not an option is it?

I also never said that it requires two levels of Docker or that it requires DinD. I was responding to the general question of the parent who was asking a question of someone who was running DinD. I responded to the GP below that Kaniko also solves this problem so clearly I'm not advocating for running DinD or that this is even needed.

Post reply on HN