Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Podman, the open source Docker alternative ported to M1 (Apple Silicon) machines

github.com

Post reply on HN
Print view View original

121–130 of 151 posts

Re: Podman, the open source Docker alternative ported to M1 (Apple Silicon) machines

#121

Post by infogulch »

wernerb wrote: post #120
junon wrote: post #54

Earlier quoted context omitted.

Docker does this a lot. For example, we were trying to turn off gzipping images on the wire when pulling because it actually cost more when done from the intranet. You can't. And modifying the source was so convoluted that we gave up. Then we needed to clean up docker (before there were commands to do that) when it started to eat up all of the disk space. To our (un)surprise, Docker uses 3 (!!) different storage form…

I am honestly wondering more about your specific use case. Does the CPU cost outweigh the storage cost? Is it a timing problem (speedup) or are you at such large scale (on premise)? Maybe where I'm getting at is, I can think of 99 problems but docker gzip ain't one :) how was this a priority (at some point)

Pretty sure it's CPU vs network not CPU vs storage. A fast internal network can be cheap compared to the cpu required to pack/unpack images on every download. I wonder if choosing a fast-to-decompress algorithm like zstd would change that.

Re: Podman, the open source Docker alternative ported to M1 (Apple Silicon) machines

#122

Post by imwillofficial »

nsonha wrote: post #98
imwillofficial wrote: post #90

Earlier quoted context omitted.

Trust me, learn QEMU, worth the time.

how do you mean learn it? So far I've only used these as drivers to run other things so my only concern is that QEMU is supposed to be slow. I don't really do anything directly with it.

My mistake, I took your usage of QEMU as a shorthand for managing and manipulating VMs, and wanting to use VMware et al due to not wanting to use the “QEMU ecosystem”

Re: Podman, the open source Docker alternative ported to M1 (Apple Silicon) machines

#123

Post by junon »

wernerb wrote: post #120
junon wrote: post #54

Earlier quoted context omitted.

Docker does this a lot. For example, we were trying to turn off gzipping images on the wire when pulling because it actually cost more when done from the intranet. You can't. And modifying the source was so convoluted that we gave up. Then we needed to clean up docker (before there were commands to do that) when it started to eat up all of the disk space. To our (un)surprise, Docker uses 3 (!!) different storage form…

I am honestly wondering more about your specific use case. Does the CPU cost outweigh the storage cost? Is it a timing problem (speedup) or are you at such large scale (on premise)? Maybe where I'm getting at is, I can think of 99 problems but docker gzip ain't one :) how was this a priority (at some point)

As we were a deployment company (ZEIT) our usecase was quite different.

And yes, as the other person mentioned, it was on the wire GZIP, not storage concerns.

Re: Podman, the open source Docker alternative ported to M1 (Apple Silicon) machines

#124

Post by infogulch »

kbenson wrote: post #25
SilverRed wrote: post #10

Earlier quoted context omitted.

I suspect the push for podman was more about how docker ignored CGroupsV2 for so long that Fedora eventually turned it on anyway which broke docker and then told users to switch to podman.

I think a really big part of it was where Red Hat asked Docker to accept their patch that allowed people to run docker with local registries only (no docker.io), and were told Docker would not be accepting that patch, and to go pound sand if they didn't like it (eh, so maybe not so forcefully). The first thing I tried to figure out when looking into Docker for work was how to limit the registries it would look at to…

I agree that it should be possible to disable the default registry, but I'm not sure I agree with allowing you to override it. (These requests appear to be conflated in various comments.) Use your own registry by specifying the domain first `myregistry.example.com/repo/image`; an unadorned `repo/image` being globally reserved as shorthand for `registry.docker.io/repo/image` seems fine. Allowing overriding the meaning of `repo/image` would be a support nightmare for both moby and internal IT, just use qualified names.

Re: Podman, the open source Docker alternative ported to M1 (Apple Silicon) machines

#125

Post by TobTobXX »

alias_neo wrote: post #82
alibarber wrote: post #65

Earlier quoted context omitted.

Podman's been a great tool (on Linux) for a while, it's my daily driver. Rootless, no daemon and networking nonsense, and docker-compose can be replaced with real K8s pod definitions for the most part. I'm actually really happy to see the zeal that has come to it from docker's changes - thank you docker ;)

> docker-compose can be replaced with real K8s pod definitions for the most part Could you elaborate on this part? Are you running in Kubernetes or somehow using the pod definition format with Podman? I'd like a way to declaratively specify my Podman pods without docker-compose and friends.

There's also podman-compose, which does exactly what docker-compose does, but with podman.

Re: Podman, the open source Docker alternative ported to M1 (Apple Silicon) machines

#126

Post by stavros »

nickjj wrote: post #102
stavros wrote: post #45

Earlier quoted context omitted.

It certainly is a problem. We want to run local development stacks with Docker, but, since it runs as root, it leaves files into your home directory (database and other files mounted from the guest) that are owned by root, so you can never delete them. It's really bad UX.

If you create a user inside of your Dockerfile and switch to that your files will be owned by whoever is assigned to uid:gid 1000:1000 on your dev box if you use a volume mount. This solves the problem in nearly every case because your primary dev box user is almost always going to be 1000:1000. It'll work on native Linux, Windows (WSL) and macOS using Docker Desktop or not. Here's a bunch of complete web app example…

Oh, good call, I wasn't doing this because 1000 is not always the user uid, but it's almost always, and at worst you'll need root to delete the files, thanks!

Re: Podman, the open source Docker alternative ported to M1 (Apple Silicon) machines

#127

Post by gizdan »

TobTobXX wrote: post #125
alias_neo wrote: post #82

Earlier quoted context omitted.

> docker-compose can be replaced with real K8s pod definitions for the most part Could you elaborate on this part? Are you running in Kubernetes or somehow using the pod definition format with Podman? I'd like a way to declaratively specify my Podman pods without docker-compose and friends.

There's also podman-compose, which does exactly what docker-compose does, but with podman.

podman-compose is sadly not as good docker-compose. It simply converts compose yaml files into podman commands.

As an alternative, as of podman v3 (rootfull) and v3.2 (rootless) podman has an optional podman socket you can enable. The API is docker compatible, thus allows for full docker-compose support, and will take any other application that interacts with the docker api directly.

Re: Podman, the open source Docker alternative ported to M1 (Apple Silicon) machines

#128

Post by heavyset_go »

takeda wrote: post #34
jamesfinlayson wrote: post #17

Earlier quoted context omitted.

I don't think Mac/Darwin has cgroups but it's based on BSD to it might have jails?

A lot of people assume that, but it's only partially true. Darwin's userland is taken from FreeBSD, the kernel is from NeXTSTEP, although it also borrowed some things from FreeBSD, but I don't think they incorporated jails[1]. [1] https://github.com/apple/darwin-xnu/search?q=jail

XNU itself is Mach plus a BSD "personality" taken from FreeBSD[1].

[1] https://developer.apple.com/library/archive/documentation/Da...

Re: Podman, the open source Docker alternative ported to M1 (Apple Silicon) machines

#129

Post by nickysielicki »

simnalamburt wrote: post #66

Hi, podman-apple-silicon developer here! I want to share some FAQs about this project. :) Q: Does this run amd64 docker images or aarch64 docker images? A: aarch64 images currently, but I'm going to patch podman to make it possible to run both amd64 image and aarch64 image. All I have to do for this is to make QEMU call and Linux image configurable, so it won't be very hard. However, if you are running amd64 images,…

Q: What sort of contributions/help are you looking for?

Re: Podman, the open source Docker alternative ported to M1 (Apple Silicon) machines

#130

Post by light_hue_1 »

infogulch wrote: post #124
kbenson wrote: post #25

Earlier quoted context omitted.

I think a really big part of it was where Red Hat asked Docker to accept their patch that allowed people to run docker with local registries only (no docker.io), and were told Docker would not be accepting that patch, and to go pound sand if they didn't like it (eh, so maybe not so forcefully). The first thing I tried to figure out when looking into Docker for work was how to limit the registries it would look at to…

I agree that it should be possible to disable the default registry, but I'm not sure I agree with allowing you to override it. (These requests appear to be conflated in various comments.) Use your own registry by specifying the domain first `myregistry.example.com/repo/image`; an unadorned `repo/image` being globally reserved as shorthand for `registry.docker.io/repo/image` seems fine. Allowing overriding the meaning…

This suggestion is a security nightmare!

Anyone is one typo away from installing random junk from the internet on your machines. No one should be using docker in production while it can connect to a public registry where you have zero control of its contents.

Post reply on HN