Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transitioning from Docker to Podman

developers.redhat.com

Post reply on HN
Print view View original

191–200 of 278 posts

Re: Transitioning from Docker to Podman

#191

Post by tannhaeuser »

zelly wrote: post #126

It's compatible with cgroups v2 unlike the standard Docker. If you're using Fedora, you have to add a kernel parameter to Grub to use cgroups v1 instead. RedHat seems to be pushing a standard ecosystem for Linux: systemd, Wayland, SELinux, GNOME, and now maybe podman. I've been on Linux for a while; it's a welcome change from all the fragmentation I'm used to. Whereas others try to work around the kernel and implemen…

> RedHat just goes with what Linux already has

More like, Redhat/IBM defines what Linux has simply by paying most Linux devs, and of course they take advantage of it in userspace and sys management.

cgroups/namespaces, systemd, gnome (and it's integration with systemd) plus others are two-sided swords: one one hand they create new functionality, but on the other hand the price to pay is concentrating Linux know-how in one place, and greatly diminishing portability of Linux apps vs other Unix O/Ses and even other Linuxes that don't want to go with the program of absorbing ever more functionality into kernels and system frameworks for no real reason other than monopolization.

Unix was designed as a simple portable operating system in very short time. With 30 years of development, the situation today could also be interpreted in such a way that Linux devs just can't stop to add code. Time will tell if Linux can be maintained if the original generation of devs step down. I'd feel more comfortable if we've let kernels stay minimal rather than becoming kitchen sinks. Apart from better portability, this would've also enabled younger devs to start from scratch rather than having to maintain daddy-o's monstrosity.

Re: Transitioning from Docker to Podman

#192

Post by choeger »

TechBro8615 wrote: post #167
choeger wrote: post #79

Earlier quoted context omitted.

Your problem is the assumption that a gitlab CI process requires a docker image. If you do the following, you are fine: * Switch to a shell runner * Put the CI dockerfile into your repo * Provide an entry script for CI that builds the container on-demand (and manages caching/cleanup) and then runs the tests/whatever inside that container The point here is that docker/podman provide you with everything you need as lon…

AFAIU you can't switch to a shell runner unless you self host gitlab runner.

That is exactly my point. Gitlab uses docker runners because it is much simpler for them. But why should you be constrained by what's simpler for gitlab?

Re: Transitioning from Docker to Podman

#193

Post by choeger »

stingraycharles wrote: post #165
choeger wrote: post #79

Earlier quoted context omitted.

Your problem is the assumption that a gitlab CI process requires a docker image. If you do the following, you are fine: * Switch to a shell runner * Put the CI dockerfile into your repo * Provide an entry script for CI that builds the container on-demand (and manages caching/cleanup) and then runs the tests/whatever inside that container The point here is that docker/podman provide you with everything you need as lon…

But how would you run integration tests between multiple docker containers? We launch our services in these docker containers and do some integration / e2e tests, and this very much requires Gitlab CI to launch docker containers while inside a Docker container. After using dind for some time we chose to just mount /var/run/docker.sock and keep using the host machine’s docker instance (mostly for the cache), but all i…

To the contrary. You should never expect to be able to do what you want with a system provided by someone else. Gitlab has its design decisions in their default setup and you need to take control to cater your use case. This herd mentality of "everyone is doing it this way" is really fundamentally problematic.

Re: Transitioning from Docker to Podman

#194

Post by Shakahs »

zelly wrote: post #126

It's compatible with cgroups v2 unlike the standard Docker. If you're using Fedora, you have to add a kernel parameter to Grub to use cgroups v1 instead. RedHat seems to be pushing a standard ecosystem for Linux: systemd, Wayland, SELinux, GNOME, and now maybe podman. I've been on Linux for a while; it's a welcome change from all the fragmentation I'm used to. Whereas others try to work around the kernel and implemen…

What you are noticing is the RedHat “upstream first” policy, and it’s very practical. They try to minimize RedHat specific modifications and instead contribute improvements directly to the original projects.

This reduces the amount of code they are responsible for maintaining, and everyone involved gets the benefit of open source collaboration.

They have a blog post about it here:

https://www.redhat.com/en/blog/what-open-source-upstream

Re: Transitioning from Docker to Podman

#195

Post by choeger »

tikkabhuna wrote: post #56
yjftsjthsd-h wrote: post #45

Earlier quoted context omitted.

Okay, I want to build a container image using gitlab CI, which runs builds in docker. How would you like me to build an image without using docker in docker, or buildah in docker?

We use kaniko[1] in Gitlab CI and it’s working great for us. It’s annoying the kaniko image requires us to specify the entrypoint. There’s some peculiarities with Dive [2], but otherwise it’s been a very easy migration. [1] https://github.com/GoogleContainerTools/kaniko [2] https://github.com/wagoodman/dive/issues/318

It is really working for you? Presumably you setup kaniko to build the images first that then run the second part of your pipeline. To run the images, you need to tag them with something that you use inside the gitlab-ci.yml, right?

Now what happens when two people push code that make changes to the containers at the same time?

Re: Transitioning from Docker to Podman

#196

Post by MrBuddyCasino »

mseidl wrote: post #182
dariusj18 wrote: post #152

Earlier quoted context omitted.

I think governments prefer redhat because they are consistent and they accept gobs of cash to promise security patches to software that are past their support window.

We have our LTSS -> Long term support at SUSE. Just in case you're a big government that wants to throw us lots of money.

Off-topic, but what’s you experience working at Suse? I know a former employee, and what he told me sounded hellish.

Re: Transitioning from Docker to Podman

#197

Post by stingraycharles »

choeger wrote: post #193
stingraycharles wrote: post #165

Earlier quoted context omitted.

But how would you run integration tests between multiple docker containers? We launch our services in these docker containers and do some integration / e2e tests, and this very much requires Gitlab CI to launch docker containers while inside a Docker container. After using dind for some time we chose to just mount /var/run/docker.sock and keep using the host machine’s docker instance (mostly for the cache), but all i…

To the contrary. You should never expect to be able to do what you want with a system provided by someone else. Gitlab has its design decisions in their default setup and you need to take control to cater your use case. This herd mentality of "everyone is doing it this way" is really fundamentally problematic.

Nowhere in my post am I saying "everyone is doing it this way".

You started out with asserting "you're too far into Docker", we bring up valid use cases for docker-in-docker, and then you saying "This herd mentality [..] is really fundamentally problematic" is really not adding a lot to the discussion.

Re: Transitioning from Docker to Podman

#198

Post by perlgeek »

Podman is amazing for CI and dev environments:

* It doesn't require special privileges to run

* It runs containers as the same UID as the calling user, so directories mounted into the container can't be polluted with files belonging to other UIDs, as Docker tends to do

* It's easy to get it to only pull images from custom registries. With docker, this requires some fiddling (at least last I tried).

The only thing missing is Debian packages in Debian Stable (currently available in Bullseye aka testing).

Re: Transitioning from Docker to Podman

#200

Post by IceWreck »

For anyone not using Podman just because lack of docker compose like functionality, there are multiple alternatives.

* Podman's official stance is to use Kubernetes YAML. The provide tools to generate this as well as convert docker-compose to kubeyaml

* podman-compose is not official, but it works well. you have to note that its not 100% compatible with dc but a lot of dc files run out of the box without modifications

* ansible with podman

* i personally use the podman cli with makefiles to get docker-compose like functionality

* also, podman v2 supports a docker comptaible rest api so its possible that docker-compose can be modified to support podman in the future

Post reply on HN