Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Podman 4.2.0

github.com

Post reply on HN
Print view View original

51–60 of 104 posts

Re: Podman 4.2.0

#51

Post by plonk »

5e92cb50239222b wrote: post #34
Lutger wrote: post #28

Earlier quoted context omitted.

Isn't there support for rootless docker these days as well?

I never used it, but have seen separate "rootless" images many times. Seems like you have to build a separate image for rootless Docker? podman runs regular images under an unprivileged user just fine.

You don't need a separate image. You can run a script to install a rootless systemd service that starts the Docker daemon. You just point the Docker client to that rootless daemon's socket and do things as before.

You'll need some configuration if you want to expose system ports (below 1024).

Re: Podman 4.2.0

#53

Post by eriksjolund »

I like this Podman feature:

Socket activation of containers

Advantages:

- Faster network. Rootless Podman will run with native network speed. Normally rootless Podman runs with reduced network speed due to the performance penalty that comes from using slirp4netns.

- Improved security as you can disable the ability to establish outgoing connections with --network=none. The container can still communicate over the socket-activated socket with a client that has connected via the internet.

I contributed a Podman socket activation tutorial: https://github.com/containers/podman/blob/main/docs/tutorial...

and I wrote two blogs about the security advantages

https://www.redhat.com/sysadmin/socket-activation-podman

https://www.redhat.com/sysadmin/podman-systemd-limit-access

Docker does not support socket activation of containers. (Docker only supports socket activation of the Docker daemon)

Edit: A clarification about the network speed. The improved speed is about the communication that passes over the socket-activated socket. This communication does not pass through slirp4netns so it has the same performance characteristics as the normal network on the host.

Re: Podman 4.2.0

#54

Post by sph »

Hallucinaut wrote: post #22

I was looking at this just last night and the story with Ubuntu is horrible. That's essentially going to be stuck on v3.4 for ten years because it's "a lot of work" to get into that distribution. You'd think an entity the size of RedHat trying to take the reins from Docker would understand that this is an investment they have to make to make it a first-class replacement. I also installed it on Windows to see how the…

> I was looking at this just last night and the story with Ubuntu is horrible. That's essentially going to be stuck on v3.4 for ten years because it's "a lot of work" to get into that distribution.

Ah shit, thanks for the heads up, I'm in the process of upgrading (actually, on a test snapshot) a client's Ubuntu 14.04 LTS to 22.04 LTS and migrating everything to containers running on podman.

Their IT department is crap so instead of creating a new VPS on top of RHEL or something and switching the DNS entry, I have to stay on Ubuntu Server, which I hate.

Re: Podman 4.2.0

#55

Post by sph »

mwcampbell wrote: post #40
Iolaum wrote: post #25

Earlier quoted context omitted.

Red Hat has no official affiliation with Canonical who make Ubuntu. If you want to test podman you 'll have better luck using an OS from the Fedora ecosystem where Red Hat has affiliations and is actively contributing. Since you mentioned Windows I 'd suggest trying something like this [1] or this [2] [1]: https://github.com/yosukes-dev/FedoraWSL [2]: https://github.com/WhitewaterFoundry/Fedora-Remix-for-WSL Disclaim…

I wonder why Fedora doesn't provide an official WSL package on the Microsoft Store as other distros do. My guess is that they feel that the WSL kernel and init diverge too far from the Fedora kernel and systemd. Can anyone from the Fedora project comment on this?

No, it's not kernel related.

It's because Fedora strives to be open-source and free software only. WSL isn't completely libre so they can't support it officially and neither is the Windows Store. There's third party Fedora images for WSL you can install.

https://lists.fedoraproject.org/archives/list/legal@lists.fe...

Re: Podman 4.2.0

#56

Post by vetinari »

mwcampbell wrote: post #40
Iolaum wrote: post #25

Earlier quoted context omitted.

Red Hat has no official affiliation with Canonical who make Ubuntu. If you want to test podman you 'll have better luck using an OS from the Fedora ecosystem where Red Hat has affiliations and is actively contributing. Since you mentioned Windows I 'd suggest trying something like this [1] or this [2] [1]: https://github.com/yosukes-dev/FedoraWSL [2]: https://github.com/WhitewaterFoundry/Fedora-Remix-for-WSL Disclaim…

I wonder why Fedora doesn't provide an official WSL package on the Microsoft Store as other distros do. My guess is that they feel that the WSL kernel and init diverge too far from the Fedora kernel and systemd. Can anyone from the Fedora project comment on this?

The reason is that Microsoft wanted indemnification agreement and Fedora refused to provide it.

More here: https://lists.fedoraproject.org/archives/list/legal@lists.fe...

Re: Podman 4.2.0

#57

Post by eriksjolund »

bongobingo1 wrote: post #8

Big fan of Podman. Technically every time I have tried to push it into my production workflow I've hit some snags, mostly around networking and some volume stuff but those snags are getting chipped away each release. The last time I did a strong test flight was around 3.X, so probably about time to try again, 4.0 was a big release. I like the integration with systemd and bringing "pods" out of k8. I like the "they're…

I haven't tried it out, but shouldn't you be able to detect the true remote address by using a socket that has been passed in via socket activation?

Re: Podman 4.2.0

#58

Post by jacooper »

Hallucinaut wrote: post #22

I was looking at this just last night and the story with Ubuntu is horrible. That's essentially going to be stuck on v3.4 for ten years because it's "a lot of work" to get into that distribution. You'd think an entity the size of RedHat trying to take the reins from Docker would understand that this is an investment they have to make to make it a first-class replacement. I also installed it on Windows to see how the…

Yup that's pretty annoying. Docker offers official repos to always have the latest version, wish podman will offer something similar.

Re: Podman 4.2.0

#59

Post by dbrgn »

encryptluks2 wrote: post #11
robinhoodexe wrote: post #7

Does anyone have experience “migrating” from docker to podman on a somewhat large scale? I am starting a new job soon in a DevOps role where the devs use both podman and docker and although the resulting images are the same, using two tools where one would suffice does not seem optimal. For context, it is a medium-sized (~40 devs) commodities trading company running some hundred applications in azure k8s but consider…

If you want to do a straight migration you can start the socket unit and expose it via the DOCKER_HOST environment variable and use the standard docker tooling or use podman-docker to make it seamless. As long as you make no other changes everything should just work. Where people frequently run into issues is when they want to utilize the rootless feature, and that definitely requires adjustments and work.

I agree, rootless was also the main blocker when I attempted my last migration in June. My goal was to run all my Docker containers as rootless Podman containers through systemd. The first service I ported was single-container, which made it easier. Still quite some work (like manually adjusting the podman-generated unit file, tracking down some weird-looking error messages, etc), but doable. Once you get to multi-container setups, I ran into even more issues (IIRC related to the linking of containers through a network, while staying rootless), so I gave up for the moment and started a Docker daemon for the rest of the services...

Re: Podman 4.2.0

#60

Post by the8472 »

eriksjolund wrote: post #53

I like this Podman feature: Socket activation of containers Advantages: - Faster network. Rootless Podman will run with native network speed. Normally rootless Podman runs with reduced network speed due to the performance penalty that comes from using slirp4netns. - Improved security as you can disable the ability to establish outgoing connections with --network=none. The container can still communicate over the sock…

That's neat and quite a unixy solution but still fairly limiting. Are there any plans for a hybrid solution where most of podman runs as non-root via userns but invokes a suid helper to setup the network?
Post reply on HN