Exploring Podman: A More Secure Docker Alternative

Glad that podman is getting more traction tbh, too many tools are built with the assumption that people add the sudo docker group which break if you have any kind of security conscious docker setup (such as not blindly giving it root access).

Re: Exploring Podman: A More Secure Docker Alternative

#5

Post by sureglymop » Sat, Jan 13, 2024, 6:03 PM UTC

coldblues wrote: post #3

https://www.techrepublic.com/article/how-to-fix-the-docker-a... I almost got burned by this.

Docker even just messes with iptables in its default configuration/installation. It's always been a pain point especially if one wants to use the newer nftables.

Re: Exploring Podman: A More Secure Docker Alternative

#6

Post by tekeous » Sat, Jan 13, 2024, 6:16 PM UTC

Podman was good when it supported systemd unit files, so I could auto start and auto update containers, even entire pods with systemd.

Then they removed that in favor of Quadlet. Now in order to do a single container I can do a unit file, but for a pod, I need to use a Kubernetes cluster definition.

Plus, unlike Docker their containers bow to SELinux definitions, so I have repeatedly struggled with containers unable to access mapped directories.

So what is it, Podman? Should I just use Kubernetes? Should I just make dedicated directories for everything instead of mapping logical places for things?

Re: Exploring Podman: A More Secure Docker Alternative

#7

Post by CodeCompost » Sat, Jan 13, 2024, 6:17 PM UTC

deleted

Re: Exploring Podman: A More Secure Docker Alternative

#8

Post by ajb » Sat, Jan 13, 2024, 6:21 PM UTC

CodeCompost wrote: post #7

deleted

It's supposed to be a drop-in replacement for docker - IE, you can literally alias docker to podman. I did that for a while, but ran into some command line options that weren't supported.

I see they've added some k8s integration, but not sure how you see it being a k8s alternative? Maybe a minikube alternative...

Re: Exploring Podman: A More Secure Docker Alternative

#9

Post by madjam002 » Sat, Jan 13, 2024, 6:24 PM UTC

CodeCompost wrote: post #7

deleted

Maybe you’re thinking of something else, because Podman is mostly a replacement for Docker and shares most of the same command line, not k8s

Re: Exploring Podman: A More Secure Docker Alternative

#10

Post by rcarmo » Sat, Jan 13, 2024, 6:26 PM UTC

tekeous wrote: post #6

Podman was good when it supported systemd unit files, so I could auto start and auto update containers, even entire pods with systemd. Then they removed that in favor of Quadlet. Now in order to do a single container I can do a unit file, but for a pod, I need to use a Kubernetes cluster definition. Plus, unlike Docker their containers bow to SELinux definitions, so I have repeatedly struggled with containers unable…

This. Quadlet wasn't really needed and just complicated matters for me, so I went back to docker-compose.