Earlier quoted context omitted.
Many people say that, but don't feel like it's very important. Having a deamon or not is a technical detail that most people do not care about in my opinion. And it has advantages too, like accessing Docker remotely or from another VM on the same host, or directly from the host which is nice for Docker on Mac or Windows.
See replies here [1] for more information [1]: https://news.ycombinator.com/item?id=25165789
Transitioning from Docker to Podman
181–190 of 278 posts
Re: Transitioning from Docker to Podman
#182It's compatible with cgroups v2 unlike the standard Docker. If you're using Fedora, you have to add a kernel parameter to Grub to use cgroups v1 instead. RedHat seems to be pushing a standard ecosystem for Linux: systemd, Wayland, SELinux, GNOME, and now maybe podman. I've been on Linux for a while; it's a welcome change from all the fragmentation I'm used to. Whereas others try to work around the kernel and implemen…
I think governments prefer redhat because they are consistent and they accept gobs of cash to promise security patches to software that are past their support window.
Re: Transitioning from Docker to Podman
#183Earlier quoted context omitted.
> beastly 5G docker image my beastly 12GB image that even includes Matlab wants a word with you
>> beastly 5G docker image > my beastly 12GB image that even includes Matlab wants a word with you Perhaps in the next 10 years we will be rediscovering packages. :P If you are in the business of charging complex prices per bits over the network, then docker seems to be quite a good investment and making it as popular as possible is a good strategy to print money. /s
True, that.
To be fair, at least it allows me to avoid lots of the brokenness of Python packaging.
Re: Transitioning from Docker to Podman
#184I find the podman integrates with systemd well claims a bit dubious. Last time I checked both podman and CRI-O double fork and have reimplemented process supervision from scratch (through conmon) whilst they could get all those features for free if they didn't daemonize themselves and let systemd handle running things in the background. I found this very surprising. I still don't understand why they made that choice.…
In an ideal world, systemd-nspawn would be the preferred CRI. That was basically the goal of rkt.
Re: Transitioning from Docker to Podman
#185Earlier quoted context omitted.
If you lock down the docker user, is it a problem?
The biggest issue lies not in the few lines in /etc/passwd or /etc/group, but rather the highly privileged process with a large attack surface that is the Docker daemon.
Re: Transitioning from Docker to Podman
#186It's compatible with cgroups v2 unlike the standard Docker. If you're using Fedora, you have to add a kernel parameter to Grub to use cgroups v1 instead. RedHat seems to be pushing a standard ecosystem for Linux: systemd, Wayland, SELinux, GNOME, and now maybe podman. I've been on Linux for a while; it's a welcome change from all the fragmentation I'm used to. Whereas others try to work around the kernel and implemen…
btrfs is depreciated in redhat distribution
Re: Transitioning from Docker to Podman
#187At my company, we run our CI/CD (Jenkins) using the Docker-in-Docker paradigm to facilitate easy maintainability of the CI itself and allow us to run containerized builds. When we shifted to RHEL 8, we attempted to move this over to Podman and it went miserably (this was back in November 2019). The main reason being is that podman-in-podman doesn't work and had bugs (at least back in Nov 2019). Maybe it fixed now but…
> Docker-in-Docker paradigm Apologies for the patronising comment, but do you really mean that? Docker in Docker works but is intended for the developers of Docker to debug Docker itself. Usually for running Docker from within a container, you just hook up the Docker client to the TCP port of the Docker daemon running outside the container, which isn't strictly Docker-in-Docker. I ask this in case you're trying a wil…
Sure, there are some details you might want to control, like image caches and such being shared with host, i just find there is a lack of documentation and best practices of how to do nested docker, if that is even intended to work or if mounting docker.sock is an unsupported hack. Most information found about this is scattered on shady blogs.
For the examples of CI brought up the use cases are fairly obvious, you have a jenkins installation with x plugins installed - running as a container. Within this jenkins you are building multiple different projects which all require their own respective image to build. As a project developer here i don't even want to know if this jenkins is a bare metal, a vm or a container. Here docker is more used to bundle all the dependencies, not for strict security with perfect containerization.
Re: Transitioning from Docker to Podman
#188It's compatible with cgroups v2 unlike the standard Docker. If you're using Fedora, you have to add a kernel parameter to Grub to use cgroups v1 instead. RedHat seems to be pushing a standard ecosystem for Linux: systemd, Wayland, SELinux, GNOME, and now maybe podman. I've been on Linux for a while; it's a welcome change from all the fragmentation I'm used to. Whereas others try to work around the kernel and implemen…
I think governments prefer redhat because they are consistent and they accept gobs of cash to promise security patches to software that are past their support window.
Re: Transitioning from Docker to Podman
#189Earlier quoted context omitted.
Docker in docker is a very common pattern in CI, in some cases is the only way to achieve certain tasks.
What kinds of tasks require two levels of containers?
Also if your application is shipped as orchestrated containers (like docker-compose), or as multiple containers in a 'pod' (e.g. sidecars), you may want the ability to run containers from containers as part of CI.
Re: Transitioning from Docker to Podman
#190Earlier quoted context omitted.
Docker in docker is a very common pattern in CI, in some cases is the only way to achieve certain tasks.
What kinds of tasks require two levels of containers?
https://github.com/kubernetes-sigs/kind https://github.com/bsycorp/kind