Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Migrating from Docker to Podman

marcusnoble.co.uk

Post reply on HN
Print view View original

101–110 of 111 posts

Re: Migrating from Docker to Podman

#101

Post by hda111 »

windexh8er wrote: post #66
moxzyros wrote: post #24

Earlier quoted context omitted.

Having just fought it, Docker rootless is a pain to set up and feels like a hack; it's not the default behavior, requires a lot of additional setup to get it working, behaves differently than rootful docker, and lastly most documentation assumes you're using rootful docker because it's been the only way for years. The fundamental architecture of docker makes rootless awkward but the company needs to compete with podm…

The idea that Podman is "more secure" than Docker is hyperbole. As documented in Arch Linux [0]... "Podman relies on the unprivileged user namespace usage (CONFIG_USER_NS_UNPRIVILEGED) which has some serious security implications..." A lot of hype around Podman on HN this week (two FP conversations regarding, but nothing "new" with Podman). Seems to be an intentional push to get people talking about it for not much o…

I agree that podman isn’t more secure but the project seems to be more open to contributions than moby.

You can still use podman rootful and use it like Docker. Then there should be not security issues.

Re: Migrating from Docker to Podman

#102

Post by hda111 »

omginternets wrote: post #57

Is podman suitable for use as a library in a larger project? Or are there dedicated libraries for that?

I’m not sure if the API is stable enough. But podman is in fact libpod (was named to podman) and it’s used to some extent in Cri-O. Nothing prevents you from using it as a library.

Re: Migrating from Docker to Podman

#103

Post by cpuguy83 »

hda111 wrote: post #101
windexh8er wrote: post #66

Earlier quoted context omitted.

The idea that Podman is "more secure" than Docker is hyperbole. As documented in Arch Linux [0]... "Podman relies on the unprivileged user namespace usage (CONFIG_USER_NS_UNPRIVILEGED) which has some serious security implications..." A lot of hype around Podman on HN this week (two FP conversations regarding, but nothing "new" with Podman). Seems to be an intentional push to get people talking about it for not much o…

I agree that podman isn’t more secure but the project seems to be more open to contributions than moby. You can still use podman rootful and use it like Docker. Then there should be not security issues.

Moby maintainer here. Have you experienced this?

Re: Migrating from Docker to Podman

#104

Post by cutemonster »

thomasbacklund wrote: post #82
sgt wrote: post #76

Earlier quoted context omitted.

Ok thanks. Interesting approach. I guess it would be interesting to see how easy something is to troubleshoot, should something actually go wrong.

Indeed, the goal has to keep the number of moving parts down as much as possible so it can be easy to understand the full cluster and how to troubleshoot it. But of course, it still requires knowledge about the architecture to do so.

How was your experience writing that much Bash code?

I wonder what tools there are, currently (I noticed it's in beta), to get an overview of the state of the cluster, maybe what is talking to what, how much bandwidth they use etc (I don't know what one would need to know)

Re: Migrating from Docker to Podman

#105

Post by [deleted] »

thomasbacklund wrote: post #82
sgt wrote: post #76

Earlier quoted context omitted.

Ok thanks. Interesting approach. I guess it would be interesting to see how easy something is to troubleshoot, should something actually go wrong.

Indeed, the goal has to keep the number of moving parts down as much as possible so it can be easy to understand the full cluster and how to troubleshoot it. But of course, it still requires knowledge about the architecture to do so.

[deleted]

Re: Migrating from Docker to Podman

#106

Post by thomasbacklund »

cutemonster wrote: post #104
thomasbacklund wrote: post #82

Earlier quoted context omitted.

Indeed, the goal has to keep the number of moving parts down as much as possible so it can be easy to understand the full cluster and how to troubleshoot it. But of course, it still requires knowledge about the architecture to do so.

How was your experience writing that much Bash code? I wonder what tools there are, currently (I noticed it's in beta), to get an overview of the state of the cluster, maybe what is talking to what, how much bandwidth they use etc (I don't know what one would need to know)

Thanks for asking :) Writing this much Bash is quite straining because there is a lot of typing, but it is also liberating in the sense of coding very close to the OS (utils).

Also, most of it is not written in Bash, it's written in Posix standard, which is even more spartanic, but is then compatible with Dash and Ash (BusyBox) also, which is good because Bash is not always available.

To make Simplenetes we used another tool we also created which is meant for writing shell script apps and to perform agent-less automation, it is called Space.sh [1]

About tools for getting an overview of the cluster, there is only the command line tooling as for now, which does parts of the job, but tools for analyzing traffic and such is not created yet.

1: https://space.sh/

Re: Migrating from Docker to Podman

#108

Post by cutemonster »

madars wrote: post #17

The main thing I'm missing with podman is gVisor support https://github.com/google/gvisor/issues/311 . Would be happy to switch once that is available!

There's also Bottlerocket, https://github.com/bottlerocket-os/bottlerocket

I haven't used any of them, but maybe B.r. works with podman?

Re: Migrating from Docker to Podman

#109

Post by cutemonster »

thomasbacklund wrote: post #106
cutemonster wrote: post #104

Earlier quoted context omitted.

How was your experience writing that much Bash code? I wonder what tools there are, currently (I noticed it's in beta), to get an overview of the state of the cluster, maybe what is talking to what, how much bandwidth they use etc (I don't know what one would need to know)

Thanks for asking :) Writing this much Bash is quite straining because there is a lot of typing, but it is also liberating in the sense of coding very close to the OS (utils). Also, most of it is not written in Bash, it's written in Posix standard, which is even more spartanic, but is then compatible with Dash and Ash (BusyBox) also, which is good because Bash is not always available. To make Simplenetes we used anot…

Thanks for the reply & info. (I'm not good at shell scripting :-))

I wonder if there's a way to get notified when it's closer to stable, .. maybe following you on Twitter? I barely ever check Twitter though

Re: Migrating from Docker to Podman

#110

Post by thomasbacklund »

cutemonster wrote: post #109
thomasbacklund wrote: post #106

Earlier quoted context omitted.

Thanks for asking :) Writing this much Bash is quite straining because there is a lot of typing, but it is also liberating in the sense of coding very close to the OS (utils). Also, most of it is not written in Bash, it's written in Posix standard, which is even more spartanic, but is then compatible with Dash and Ash (BusyBox) also, which is good because Bash is not always available. To make Simplenetes we used anot…

Thanks for the reply & info. (I'm not good at shell scripting :-)) I wonder if there's a way to get notified when it's closer to stable, .. maybe following you on Twitter? I barely ever check Twitter though

Sure :) follow me as @bashlund on twitter but also star the repo on github https://github.com/simplenetes-io/simplenetes
Post reply on HN