Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Podman in Linux

diego-pacheco.blogspot.com

Post reply on HN
Print view View original

81–90 of 90 posts

Re: Podman in Linux

#81

Post by amarshall »

darkwater wrote: post #72
amarshall wrote: post #16

Earlier quoted context omitted.

Docker Desktop isn’t really about the GUI so much as the management of, and host integration with, a Linux VM for running on non-Linux OSes. Notably, there’s no Docker Desktop for Linux, only macOS and Windows.

> Notably, there’s no Docker Desktop for Linux, only macOS and Windows. Looks like they are adding it https://twitter.com/glours/status/1438526841577357315 I quote: "A dream coming true for a lot of #linux users, @dieuthicao announced that we’ll start working on a #Linux version of @docker Desktop"

What does Docker Desktop even really offer on Linux? k8s, I guess? There are other open-source (Docker Desktop is proprietary ofc) ways to do that.

As a Linux user, far from a dream at all, really.

Re: Podman in Linux

#82

Post by flemhans »

rpncreator wrote: post #28

The challenges I’ve had switching out Docker Engine, CLI, and Compose with Podman has been the absence of a vetted Docker Compose replacement. What I’ve done so far in replacing Docker Desktop has been to use just the CLI, Engine, and Compose on WSL2.

When I found out Podman supports Kubernetes pod YML files with `podman play kube`, I "ported" my Compose files to those, and that works pretty well (in the newest versions of Podman).

Re: Podman in Linux

#83

Post by jhickok »

gizdan wrote: post #31
jhickok wrote: post #17

Earlier quoted context omitted.

My understanding is that Podman is working on a "GUI" since it is one of the most requested items. Taken from the interview with the founders of Podman over on the Google Kubernetes podcast: https://kubernetespodcast.com/episode/164-podman/ ETA: Oh hey here it is: https://github.com/heyvito/podman-macos

Good to know about the GUI! > ETA: Oh hey here it is: https://github.com/heyvito/podman-macos This GUI isn't an official Podman application. It's a third party. Not that it's bad or anything, it's just not official.

Yeah true. They talk about a first party app on the podcast episode tho, I'm just not smart enough to find it.

Re: Podman in Linux

#84

Post by nonameiguess »

akerl_ wrote: post #36
some0x80070005 wrote: post #19

Earlier quoted context omitted.

It’s great that podman serves a good role for you, and I’m not going to argue that. My points: 1. Docker containers absolutely can be run without root. Yes, it’s not the default policy, but containers can have a user ID. If you are referencing the daemon-less root-less nature of podman, that’s a clear advantage of podman vs Docker. 2. Docker containers also have a restart policy which I use to also have them startup…

When people talk about “rootless” in this context, they’re not talking about “launching containers whose process runs as non-root”. The innovation of podman is that a non-root user can “safely” be given permission to launch containers whose maximum permissions are “the perms that user has”. Docker doesn’t have this functionality: the daemon runs as root, and anybody who is granted access to launch containers by invok…

It's not the default setup and not trivial to do, but Docker has had the ability to run the daemon as a non-root user for a few years. The standard .deb and .rpm packages even include scripts to automate the transition for you on Debian and RedHat Linux variants. See https://docs.docker.com/engine/security/rootless/

The only thing podman gives you that docker itself can't is running without a daemon at all.

Re: Podman in Linux

#85

Post by nonameiguess »

ActorNightly wrote: post #8

Im just wondering if the full loop will ever be complete and deployment patterns start shifting to single file compiled executables.

For programming languages that offer a good experience with static linking, sure, but even those may depend on external config files, environment variables, specific ports and sockets, all of which can potentially conflict with other programs on the same physical host. Go binaries are almost always just one file and yet are among the most popular to deploy as containers along with making up virtually all of the CNCF ecosystem.

Re: Podman in Linux

#86

Post by nickstinemates »

benatkin wrote: post #61
nickstinemates wrote: post #41

Earlier quoted context omitted.

Guess I don't know what I'm talking about

Hmm, I can't find an official Docker installer for Mac that's older than this (2015-08-11), and it has Kitematic. Wikipedia date is for Docker in general. I stand corrected. https://github.com/docker-archive/toolbox/commit/a7e7a070ba9...

The kitematic peeps are wonderful, smart, and genuine people.

Re: Podman in Linux

#87

Post by modshatereality »

CameronNemo wrote: post #37
solarkraft wrote: post #32

Earlier quoted context omitted.

Thanks for linking the original comment. Every container uses namespaces, this is (TL;DR attempt) about user namespaces, which is a not particularly well audited kernel feature, meaning you may open up potentially insecure kernel code to unprivileged users. The way I understand it, with containers running under a root user, is that to break out of a container you‘d have to find a vulnerability in standard (rootful) n…

But the vulnerability without usernamespaces is much more severe, because the process then has UID 0 on the host. Frankly if you are that concerned about security (e.g. you have multitenant workloads or are dealing with sensitive data), you should be using KVM or gvisor.

"the vulnerability" means one specific vulnerability in docker or somesuch "privileged container" i presume. there are also some sleeping in the kernel code that userns opens up, and even outright intentionally allow, that were previously not on the radar.

ultimately we must consider userns vs privileged-ns a fork in the road. one direction sweeps privilege concerns under the rug, and opens up new attack surface today leaving the door open for more non-obvious problems tomorrow. the other relies on highly competent engineers that know the nuances of the system they are working with, and have strong will to stomp out needless complexity from design to implementation.

Re: Podman in Linux

#88

Post by hda111 »

CameronNemo wrote: post #38
PhilippGille wrote: post #27

Earlier quoted context omitted.

> root-less nature of podman I see this repeated a lot, but it's not the default, its has to be explicitly configured: https://github.com/containers/podman/blob/v3.3.1/docs/tutori... And in addition to the known upsides, there are some lesser known downsides: 1. There are feature limitations with it: https://github.com/containers/podman/blob/v3.3.1/rootless.md 2. There are security implications, quoting Arch Wiki: >…

Why should I trust the Arch wiki? People like Christian Brauner think the value of not running as UID 0 outweighs the increased attack surface from the user namespace. https://people.kernel.org/brauner/runtimes-and-the-curse-of-...

Thanks for writing this. He knows what he is talking about. One of the LXC maintainers.

Re: Podman in Linux

#89

Post by hda111 »

terrywang wrote: post #70

Podman is not (YET) a drop-in replacement for Docker CE (on Linux), at least for me (even after 3.0.0 release when it adds seamless Docker Compose support, the way it does it contradicts daemon-less...). Deploying stacks (on Linux) Docker Compose style are typical use cases for using Docker, `podman-compose` works sometimes, however, over half of such initial attempts fail and require tinkering. Docker CE (at least f…

No, it doesn’t contradict daemon-less (wrt resources used by the daemon). This “daemon” only runs activated by a systemd socket for a few seconds. Whereas Docker CE always runs at least containerd (dockerd is also socket activated). You could argue that conmon is the daemon of podman and every container has its own daemon. It’s a bit wasteful wrt memory but that how it’s designed.

Re: Podman in Linux

#90

Post by yencabulator »

TD-Linux wrote: post #54
infogulch wrote: post #35

Can you use podman with ZFS on Linux volumes?

There is a dedicated storage driver for zfs: https://www.jwillikers.com/podman-with-btrfs-and-zfs That said, the default overlay storage driver already supports reflinks, which will get you most of the benefits.

Last I looked, ZFS didn't support reflinks. https://github.com/openzfs/zfs/issues/405
Post reply on HN