Transitioning from Docker to Podman • Hacker News Board

Re: Transitioning from Docker to Podman

#171

Post by jrumbut » Sat, Nov 21, 2020, 6:28 AM UTC

ryan29 wrote: post #161

tikkabhuna wrote: post #56

Earlier quoted context omitted.

We use kaniko[1] in Gitlab CI and it’s working great for us. It’s annoying the kaniko image requires us to specify the entrypoint. There’s some peculiarities with Dive [2], but otherwise it’s been a very easy migration. [1] https://github.com/GoogleContainerTools/kaniko [2] https://github.com/wagoodman/dive/issues/318

I tried kaniko and didn't like it. Having build and push as part of the same job is frustrating and I view it as a sign that a CI system is built with the expectation of having everything happen post commit by shoveling money into a CI auto-scaler. I know there's `--no-push`, but that's a poor substitute for independent `build`, `tag`, `push` build steps IMO. Do you have any way of running / debugging locally with Gi…

> I remember people complaining about Gradle start times so much they came up with the Gradle daemon. Now no one bats an eye at CI based build systems where you have to commit your code, wait for a runner to get provisioned, wait for Docker or the OCI runtime to spin up, and wait for your project to actually build on some anemic VM.

I want this framed or sewn onto a pillow or something.

It's amazing what we can build, it's baffling what we have built.

Re: Transitioning from Docker to Podman

#172

Post by ofrzeta » Sat, Nov 21, 2020, 6:32 AM UTC

scaladev wrote: post #170

SEJeff wrote: post #148

Earlier quoted context omitted.

They just made it the default in fedora. It is likely not deprecated for unreleased RHEL versions

Fedora is a community distribution despite what many think. It is not controlled by RH in any way.

"Fedora is developed and sponsored by Fedora Project and Red Hat."

https://www.redhat.com/en/topics/linux/fedora-vs-red-hat-ent...

Re: Transitioning from Docker to Podman

#173

Post by rat9988 » Sat, Nov 21, 2020, 6:35 AM UTC

waheoo wrote: post #156

gitweb wrote: post #139

Earlier quoted context omitted.

My experience has consistently been the opposite.

This sounds anecdotal to me.

As anecdotal as the person he is replying to.

Re: Transitioning from Docker to Podman

#174

Post by maurys » Sat, Nov 21, 2020, 6:41 AM UTC

I've used Podman, SystemD and Buildah.

It's great to hack around with. SystemD is particular is very polarizing and I don't want to start a flamewar, but it helped me "get" init systems.

Podman seems to have a better security model than Docker, so we were trying it out at work too.

Redhat is clearly very invested in this.

There was excellent documentation and good tooling around all this.

Re: Transitioning from Docker to Podman

#175

Post by stevekemp » Sat, Nov 21, 2020, 6:59 AM UTC

ranadeep wrote: post #22

At my company, we run our CI/CD (Jenkins) using the Docker-in-Docker paradigm to facilitate easy maintainability of the CI itself and allow us to run containerized builds. When we shifted to RHEL 8, we attempted to move this over to Podman and it went miserably (this was back in November 2019). The main reason being is that podman-in-podman doesn't work and had bugs (at least back in Nov 2019). Maybe it fixed now but…

I'm not married to docker either, and love the idea of podman. In my case the blocker for migrating was related to docker-compose.

podman-compose doesn't support as much as I needed for my current deployments - although offhand I cannot recall what was missing.

I'm looking forward to trying things again in a few months, but those corner-cases can be real pains to deal with.

Re: Transitioning from Docker to Podman

#176

Post by fuzxi » Sat, Nov 21, 2020, 7:01 AM UTC

gitweb wrote: post #139

dahfizz wrote: post #134

Earlier quoted context omitted.

Anecdotally, I've worked with developers at Redhat and Canonical, and the Redhat developers had passion. They really believed in open source and the linux community. In comparison Canonical seemed like Just Another Software Company to me.

My experience has consistently been the opposite.

With Redhat, Canonical, or both?

Re: Transitioning from Docker to Podman

#177

Post by fuzxi » Sat, Nov 21, 2020, 7:10 AM UTC

ziftface wrote: post #101

fredthomsen wrote: post #46

Earlier quoted context omitted.

Heavy compose user here, and when I tried the podman equivalent of compose was missing some functionality that made me move back.

I had the same experience, and I'm not really sure why I can't use docker-compose with podman. If it's a drop in replacement, why can't I alias podman as docker and use docker-compose like normal? I did try that and it doesn't work, and podman compose isn't as useable. So I switched back to docker.

>If it's a drop in replacement, why can't I alias podman as docker and use docker-compose like normal?

Podman is (mostly) a drop-in replacement for docker. However, docker-compose is a separate package from docker that requires explicit installation. So too is podman-compose separate from podman, though unfortunately it still needs more work.

Re: Transitioning from Docker to Podman

#178

Post by watermelon0 » Sat, Nov 21, 2020, 7:16 AM UTC

hinkley wrote: post #149

joana035 wrote: post #42

Earlier quoted context omitted.

It is because to build the image using docker requires the docker client to talk with a dockerd daemon, so one has to configure the client to access the dockerd which allow untrusted code to run as root in the host. Docker-in-docker is a workaround to make docker work in CI. Basically a security nightmare and bad design that podman doesn't have.

Any build script can do serious damage to the environment it runs in. Before docker, you'd have to create a new VM from time to time because the build agent had rotted away or died in an altercation with a bad build. Docker in Docker in CI is like a lock on a door. It keeps honest people from being naughty, and is fairly efficient about it. I don't think the question is "should I run CI in docker in docker," it's who…

You do know that spinning up a new VM only takes a few seconds? With projects like https://firecracker-microvm.github.io/, the difference between launching a new Docker container or a new VM is negligible.

This works great if you own or rent the hardware, but most cloud providers don't allow nested virtualization.

Re: Transitioning from Docker to Podman

#179

Post by lima » Sat, Nov 21, 2020, 7:23 AM UTC

mekster wrote: post #141

lopatin wrote: post #15

I was just about to complain about another thing to learn. Then I saw you can do "$ alias docker=podman". Just want to acknowledge the importance of that work. Making things compatible is both boring and a pain, but it's a door opener for people like me who refuse to learn your new API because I know a decent one already.

So far, it's just a less functional docker and didn't bring much to the table. I don't feel the need for daemonless as docker has been working fine. I've swapped back to docker on Fedora and CentOS by forcibly installing docker on those unsupported platforms because podman-compose doesn't work, containers just didn't work like expected in several situations (forgot detail) and portainer wouldn't work against it. Eith…

Plus there's no Buildkit support.

Re: Transitioning from Docker to Podman

#180

Post by fuzxi » Sat, Nov 21, 2020, 7:25 AM UTC

speedgoose wrote: post #162

fuzxi wrote: post #85

Earlier quoted context omitted.

The other major benefit of podman is that it doesn't use a daemon.

Many people say that, but don't feel like it's very important. Having a deamon or not is a technical detail that most people do not care about in my opinion. And it has advantages too, like accessing Docker remotely or from another VM on the same host, or directly from the host which is nice for Docker on Mac or Windows.

See replies here [1] for more information

[1]: https://news.ycombinator.com/item?id=25165789