Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Podman in Linux

diego-pacheco.blogspot.com

Post reply on HN
Print view View original

21–30 of 90 posts

Re: Podman in Linux

#21

Post by zapita »

rmetzler wrote: post #3

Somehow a lot of these blog posts seem to get the fine technical details of the marketing speak wrong. > Docker recently changed the license From my understanding this is related to Docker Desktop not Docker. I'm pretty sure Podman can't replace Docker Desktop. This is also what the linked website says. Or did I miss something? And in the linked Blog post it says > Docker was dropped from Kubernetes. which from my un…

You are correct on both counts. Most people are not intimately familiar with the details of the Docker and Kubernetes stacks. Unscrupulous vendors have been taking advantage of this confusion to spread FUD and shine a more flattering light on their own products.

Re: Podman in Linux

#22

Post by zapita »

jonfw wrote: post #6
rmetzler wrote: post #3

Somehow a lot of these blog posts seem to get the fine technical details of the marketing speak wrong. > Docker recently changed the license From my understanding this is related to Docker Desktop not Docker. I'm pretty sure Podman can't replace Docker Desktop. This is also what the linked website says. Or did I miss something? And in the linked Blog post it says > Docker was dropped from Kubernetes. which from my un…

Podman can replace docker desktop. It doesn't have the same GUI but it does have the capability to run containers via familiar CLI commands on a variety of OSes, connecting to (and in some cases provisioning through podman machine) a VM when required I also think that it's more than safe to say that K8s is dropping Docker when they've deprecated it as a container runtime

> I also think that it's more than safe to say that K8s is dropping Docker when they've deprecated it as a container runtime

This is wrong. Docker itself is no longer a container runtime: it has spun out that capability into containerd. Kubernetes can now call Docker’s container runtime (again: containerd) directly instead of going through a redundant docker-shim.

In other words: Kubernetes has dropped Docker’s old container runtime in favor of… Docker’s new container runtime.

Re: Podman in Linux

#23

Post by jrockway »

inetknght wrote: post #10
ActorNightly wrote: post #8

Im just wondering if the full loop will ever be complete and deployment patterns start shifting to single file compiled executables.

cp ./app.AppImage /srv/app/app.AppImage for deployment_host in $( okay boss, what's the next problem?

app.AppImage used up all the RAM on the machine, and the kernel OOMkilled sshd. Now it's time to roll back.

(But I guess it wasn't the fault of that deployment -- you just staged the binary, you didn't start it running.)

Re: Podman in Linux

#24

Post by benatkin »

nickstinemates wrote: post #18
benatkin wrote: post #13

Earlier quoted context omitted.

You can also run regular docker with vagrant instead of Docker Desktop. This seems to be the way you can replace Docker Desktop with Podman: https://www.redhat.com/sysadmin/replace-docker-podman-macos There was Kitematic for Docker, I think it was independent, but it's owned by Docker now and they shut it down. https://github.com/docker/kitematic

It evolved to become Docker Desktop

No it didn't, Docker Desktop was already released before Docker bought Kitematic. I have receipts: https://www.zdnet.com/article/docker-reels-in-kitematic-as-i... (2015) https://en.m.wikipedia.org/wiki/Docker_(software) (Initial release: 2012)

If you mean Docker Desktop added some features from Kitematic, that's a misleading way of saying it.

Re: Podman in Linux

#25

Post by kbenson »

Iolaum wrote: post #12

podman user here, because of the ability to run in rootless mode. Using it on RPi4 with Fedora IoT running linuxserver io containers. Appreciate the systemd integration as well making the containers services that gracefully go down and come up when the pi gets rebooted without me needing to do anything.

I was enamored with this feature too, but a comment here on HN[1] made me reconsider its use. Apparently rootless requires unprivileged user namespaces, which provides a different security context than most apps are expected to run in, and might be less thoroughly tested than you would think.

I still like the systemd integration and that it doesn't require a daemon too, and I still favor it over Docker.

1: https://news.ycombinator.com/item?id=28393949

Edit: Clarified that it's the unprivileged user namespaces feature specifically, not namespaces in general. Thanks for the feedback solarkraft.

Re: Podman in Linux

#26

Post by kblev »

some0x80070005 wrote: post #19
Iolaum wrote: post #12

podman user here, because of the ability to run in rootless mode. Using it on RPi4 with Fedora IoT running linuxserver io containers. Appreciate the systemd integration as well making the containers services that gracefully go down and come up when the pi gets rebooted without me needing to do anything.

It’s great that podman serves a good role for you, and I’m not going to argue that. My points: 1. Docker containers absolutely can be run without root. Yes, it’s not the default policy, but containers can have a user ID. If you are referencing the daemon-less root-less nature of podman, that’s a clear advantage of podman vs Docker. 2. Docker containers also have a restart policy which I use to also have them startup…

Thanks

Re: Podman in Linux

#27

Post by PhilippGille »

some0x80070005 wrote: post #19
Iolaum wrote: post #12

podman user here, because of the ability to run in rootless mode. Using it on RPi4 with Fedora IoT running linuxserver io containers. Appreciate the systemd integration as well making the containers services that gracefully go down and come up when the pi gets rebooted without me needing to do anything.

It’s great that podman serves a good role for you, and I’m not going to argue that. My points: 1. Docker containers absolutely can be run without root. Yes, it’s not the default policy, but containers can have a user ID. If you are referencing the daemon-less root-less nature of podman, that’s a clear advantage of podman vs Docker. 2. Docker containers also have a restart policy which I use to also have them startup…

> root-less nature of podman

I see this repeated a lot, but it's not the default, its has to be explicitly configured: https://github.com/containers/podman/blob/v3.3.1/docs/tutori...

And in addition to the known upsides, there are some lesser known downsides:

1. There are feature limitations with it: https://github.com/containers/podman/blob/v3.3.1/rootless.md

2. There are security implications, quoting Arch Wiki:

> Warning: Rootless Podman relies on the unprivileged user namespace usage (CONFIG_USER_NS_UNPRIVILEGED) which has some serious security implications, see Security#Sandboxing applications for details.

Also worth noting that Docker itself has a rootless mode as well by now: https://docs.docker.com/engine/security/rootless/

I'm happy that there are Docker alternatives, but I have the feeling that podman has been hyped a lot recently and many articles and comments give the impression that it's more secure by default and without any downsides.

Re: Podman in Linux

#28

Post by rpncreator »

The challenges I’ve had switching out Docker Engine, CLI, and Compose with Podman has been the absence of a vetted Docker Compose replacement.

What I’ve done so far in replacing Docker Desktop has been to use just the CLI, Engine, and Compose on WSL2.

Re: Podman in Linux

#29

Post by gizdan »

amarshall wrote: post #16
gizdan wrote: post #14

Earlier quoted context omitted.

From what I've seen in all these Podman articles, I've come to the same conclusion as you. This is how Podman fits in: Podman (and its various components) can replace everything but parts of Docker Desktop, namely the GUI that Docker Desktop, has. For everything else, it has it's own Docker compatible CLI, an optional daemon (by default it's daemonless), there is no containerd component as it communicates directly to…

Docker Desktop isn’t really about the GUI so much as the management of, and host integration with, a Linux VM for running on non-Linux OSes. Notably, there’s no Docker Desktop for Linux, only macOS and Windows.

Yep. Podman takes cares of those things using the `podman machine` sub-command. From what I understand, currently only macOS might be working, but Windows support will be coming if it's not already there.

Re: Podman in Linux

#30

Post by encryptluks2 »

dmart wrote: post #4
rmetzler wrote: post #3

Somehow a lot of these blog posts seem to get the fine technical details of the marketing speak wrong. > Docker recently changed the license From my understanding this is related to Docker Desktop not Docker. I'm pretty sure Podman can't replace Docker Desktop. This is also what the linked website says. Or did I miss something? And in the linked Blog post it says > Docker was dropped from Kubernetes. which from my un…

It seems to me that almost no one understands the difference between the various layers of "Docker" (that is to say: Desktop, CLI, daemon, containerd, runc) and which layers tools like Podman aim to replace.

Yes, but Docker won't work on Windows without having some machine-compatible integration with Hyper-V. Docker Machine was deprecated in favor of Docker Desktop:

https://docs.docker.com/machine/

For now however, you can use minikube which provides drivers for Hyper-V and hyperkit:

https://minikube.sigs.k8s.io/docs/drivers/

Post reply on HN