Podman: A Daemonless Container Engine

Under the covers, both podman AND docker use runc. Redhat is writing a new version named "crun" which is lower overhead and faster:

https://github.com/containers/crun

I had pretty negative experiences with it. I'm not sure how much of my experience is _actually_ the fault of Podman and how much of it was around using it as a drop-in replacement for Docker. It baffled me though and I'm a long time Docker and Linux user.

I used Arch Linux and followed their docs[1], mainly because I wanted it to also run without root. Big mistake. Attempting to run a simple postgres database w/ and w/o root permissions for Podman resulted in my system getting into an inconsistent state. I was unable to relaunch the container due to the state of my system.

I mucked around with runc/crun and I ended up literally nuking both the root and non-root directories that stored them on my computer. I reset my computer back to Podman for root only, hoping that I had just chosen a niche path. It still would leave my system broken, requiring drastic measures to recover. No thanks.

After much debugging, finally switching back to Docker, I realized my mistake: I had forgotten a required environment variable. Silly mistake.

Docker surfaced the problem immediately. Podman did not.

Docker recovered gracefully from the error. Podman left my system in an inconsistent state, unable to relaunch the container and unable to remove it

Again, I'm not sure how much of my experience was just trying to force Podman into a square hole? I'm sure there are other people that make it work just fine for their use cases

Edit: I should note that I used it as a docker-compose replacement, which is probably another off-the-beaten path usage that made this more dramatic than it should have been

1. https://wiki.archlinux.org/index.php/Podman

One huge advantage over docker is that if you mount a directory into the container, and the container writes files there, on the host system they always have the owner of the user that started the container.

That makes it much more convenient for build environments, without having to hard-code user IDs both in the container and on the host.

$ for your favorite infra oss startup or volunteer

rhel ~forces you to do podman in rhel 8+. They make it hard enough to do a docker install that corp policies will reject docker (non-standard centos 7 repos etc), while allowing ibm's thing. Ex: Locks podman over docker for a lot of US gov where rhel 8 is preferred and with only standard repos, and anything else drowns in special approvals.

subtle and orthogonal to podman's technical innovations.. but as a lot of infra oss funding ultimately comes from what enterprise policies allow, this a significant anti-competitive adoption driver for podman by rhel/ibm.

It removes a privilege escalation scenario. With docker i can easily gain root, with podman i can’t.

Might not be relevant if it’s your own machine though but for $BIG_CORP desktop that might be useful.