Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Podman 4.2.0

github.com

Post reply on HN
Print view View original

61–70 of 104 posts

Re: Podman 4.2.0

#61

Post by jacooper »

eriksjolund wrote: post #53

I like this Podman feature: Socket activation of containers Advantages: - Faster network. Rootless Podman will run with native network speed. Normally rootless Podman runs with reduced network speed due to the performance penalty that comes from using slirp4netns. - Improved security as you can disable the ability to establish outgoing connections with --network=none. The container can still communicate over the sock…

> - Faster network. Rootless Podman will run with native network speed. Normally rootless Podman runs with reduced network speed due to the performance penalty that comes from using slirp4netns.

Did they fix the IP propagation issue with Rootless networking ? It makes it largely useless when the Proxy is also a container.

on Docker you can force it to use Slirp, but its slow and doesn't support IPv6.

Re: Podman 4.2.0

#62

Post by motoboi »

Hallucinaut wrote: post #22

I was looking at this just last night and the story with Ubuntu is horrible. That's essentially going to be stuck on v3.4 for ten years because it's "a lot of work" to get into that distribution. You'd think an entity the size of RedHat trying to take the reins from Docker would understand that this is an investment they have to make to make it a first-class replacement. I also installed it on Windows to see how the…

They are frantically working to be the alternative to docker.

Just give them enough time and it will run in Ubuntu just fine.

Obviously it will happen after they get it feature complete on their own OS.

Given the amount of work need to achieve feature parity with docker (which I suppose Docker Inc tough was it's moat), they have no viable competition right now and so this strategy makes sense.

Re: Podman 4.2.0

#63

Post by eriksjolund »

jacooper wrote: post #61
eriksjolund wrote: post #53

I like this Podman feature: Socket activation of containers Advantages: - Faster network. Rootless Podman will run with native network speed. Normally rootless Podman runs with reduced network speed due to the performance penalty that comes from using slirp4netns. - Improved security as you can disable the ability to establish outgoing connections with --network=none. The container can still communicate over the sock…

> - Faster network. Rootless Podman will run with native network speed. Normally rootless Podman runs with reduced network speed due to the performance penalty that comes from using slirp4netns. Did they fix the IP propagation issue with Rootless networking ? It makes it largely useless when the Proxy is also a container. on Docker you can force it to use Slirp, but its slow and doesn't support IPv6.

You could detect the source IP address by using the command-line option:

--net=slirp4netns:port_handler=slirp4netns

See https://github.com/containers/podman/discussions/10472#discu...

Shouldn't it also be possible to detect the source IP address if you use socket activation? (I haven't tried it out, though).

Re: Podman 4.2.0

#64

Post by pjmlp »

Hallucinaut wrote: post #22

I was looking at this just last night and the story with Ubuntu is horrible. That's essentially going to be stuck on v3.4 for ten years because it's "a lot of work" to get into that distribution. You'd think an entity the size of RedHat trying to take the reins from Docker would understand that this is an investment they have to make to make it a first-class replacement. I also installed it on Windows to see how the…

Let me guess, Podman desktop is an Electron app.

Re: Podman 4.2.0

#65

Post by eriksjolund »

the8472 wrote: post #60
eriksjolund wrote: post #53

I like this Podman feature: Socket activation of containers Advantages: - Faster network. Rootless Podman will run with native network speed. Normally rootless Podman runs with reduced network speed due to the performance penalty that comes from using slirp4netns. - Improved security as you can disable the ability to establish outgoing connections with --network=none. The container can still communicate over the sock…

That's neat and quite a unixy solution but still fairly limiting. Are there any plans for a hybrid solution where most of podman runs as non-root via userns but invokes a suid helper to setup the network?

Not exactly what you are asking for but there is a Systemd feature request to add Connect= setting to service unit files. https://github.com/systemd/systemd/issues/23067#issuecomment... (That could a be cool feature)

Also interesting would be to fix the security considerations of using bypass4netns:

"However, it is probably possible to connect to host loopback IPs by exploiting TOCTOU of struct sockaddr * pointers."

There seems to be an implementation idea for how the problem could be fixed:

https://github.com/rootless-containers/bypass4netns/issues/2...

Re: Podman 4.2.0

#66

Post by florentbenoit »

Hallucinaut wrote: post #22

I was looking at this just last night and the story with Ubuntu is horrible. That's essentially going to be stuck on v3.4 for ten years because it's "a lot of work" to get into that distribution. You'd think an entity the size of RedHat trying to take the reins from Docker would understand that this is an investment they have to make to make it a first-class replacement. I also installed it on Windows to see how the…

Could you file a bug to podman desktop https://github.com/containers/podman-desktop/issues about your auth.json file / "podman login" ?

Re: Podman 4.2.0

#67

Post by dralley »

mtsr wrote: post #36
bonzini wrote: post #32

Earlier quoted context omitted.

> obsolete 10 year old versions Talk about hyperboles. RHEL 8 is from 2018 and has had considerably more updates than Ubuntu 18.04. In fact some packages might even be newer than what is in 20.04.

Maybe, but plenty of RHEL8 packages still package versions from 10+ years ago.

Can you name a few specifically?

Re: Podman 4.2.0

#68

Post by lima »

kodah wrote: post #21
bongobingo1 wrote: post #8

Big fan of Podman. Technically every time I have tried to push it into my production workflow I've hit some snags, mostly around networking and some volume stuff but those snags are getting chipped away each release. The last time I did a strong test flight was around 3.X, so probably about time to try again, 4.0 was a big release. I like the integration with systemd and bringing "pods" out of k8. I like the "they're…

You can use podman with buildkit, it's just kind of a pain because you have to do it manually. It is missing some nice to have feature integrations with buildkit. The instructions are fairly clear: https://github.com/moby/buildkit

This really just means using rootless libcontainer (i.e. the Docker machinery) inside podman, it's not a native integration.

Re: Podman 4.2.0

#70

Post by encryptluks2 »

eriksjolund wrote: post #53

I like this Podman feature: Socket activation of containers Advantages: - Faster network. Rootless Podman will run with native network speed. Normally rootless Podman runs with reduced network speed due to the performance penalty that comes from using slirp4netns. - Improved security as you can disable the ability to establish outgoing connections with --network=none. The container can still communicate over the sock…

Podman 4 supports netavark which to my understanding should solve a lot of the networking issues with slirp4netns
Post reply on HN