Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploring Podman: A More Secure Docker Alternative

betterstack.com

Post reply on HN
Print view View original

11–20 of 133 posts

Re: Exploring Podman: A More Secure Docker Alternative

#11

Post by emerongi »

tekeous wrote: post #6

Podman was good when it supported systemd unit files, so I could auto start and auto update containers, even entire pods with systemd. Then they removed that in favor of Quadlet. Now in order to do a single container I can do a unit file, but for a pod, I need to use a Kubernetes cluster definition. Plus, unlike Docker their containers bow to SELinux definitions, so I have repeatedly struggled with containers unable…

> Plus, unlike Docker their containers bow to SELinux definitions, so I have repeatedly struggled with containers unable to access mapped directories.

Add the following to containers.conf if you don't want to deal with it:

   [containers]
   label=false
If you don't like podman's default security level, there is usually a way to turn things off.

Re: Exploring Podman: A More Secure Docker Alternative

#13

Post by politelemon »

Sounds good, I like their security first approach and some of the decisions they've made, going for secure defaults out of the box, and that it works with docker compose. I wonder if podman gains enough traction, at some point, they decide to go their own way with regards to the commands and the yml, because right now it seems to be a tool that 'hangs on to' docker and docker's compose file format.

It would be good to have a swarm alternative in podman, it seems like k8s is a crutch for lack of orchestration. With their good security hat on they could probably come up with a sane, simple way of running containers at small scales without having to dive into a PhD in k8s which doesn't have secure defaults out of the box, while maintaining compatibility with docker compose format.

Anyway that's a good intro thanks for sharing, I'll be trying it later.

Re: Exploring Podman: A More Secure Docker Alternative

#14

Post by bonzini »

tekeous wrote: post #6

Podman was good when it supported systemd unit files, so I could auto start and auto update containers, even entire pods with systemd. Then they removed that in favor of Quadlet. Now in order to do a single container I can do a unit file, but for a pod, I need to use a Kubernetes cluster definition. Plus, unlike Docker their containers bow to SELinux definitions, so I have repeatedly struggled with containers unable…

> unlike Docker their containers bow to SELinux definitions,

That's a bug in docker. If your system isn't configured for SELinux, disable it.

Also the systemd files generated by podman-generate-systemd are just executing "podman start containername", you can write them on your own easily but (unlike e.g. docker-composr) the containers are black boxes pretty much.

The advantage of quadlet is that the definition of the container is declared in the .container file; before I used to write the podman run command line manually in a handwritten systemd unit, and quadlet is a big improvement in that respect and can be an alternative to docker-compose (with advantages and disadvantages).

Re: Exploring Podman: A More Secure Docker Alternative

#15

Post by qwertox »

I have such a huge arsenal of custom tools to manage Docker, that I envy Podman users because I can't move to it because of this technical debt.

I just keep hoping that Docker isn't that bad and is a good alternative to Podman, because I've read mostly good things about the it, while Docker usually gets dragged through the dirt.

Re: Exploring Podman: A More Secure Docker Alternative

#17

Post by pydry »

qwertox wrote: post #15

I have such a huge arsenal of custom tools to manage Docker, that I envy Podman users because I can't move to it because of this technical debt. I just keep hoping that Docker isn't that bad and is a good alternative to Podman, because I've read mostly good things about the it, while Docker usually gets dragged through the dirt.

Podman itself is good but on the tooling side it falls down.

Docker tooling tends to work with podman but you have to do a bunch of stuff like run a server to imitate docker. At that point why bother?

Re: Exploring Podman: A More Secure Docker Alternative

#19

Post by hinkley »

tekeous wrote: post #6

Podman was good when it supported systemd unit files, so I could auto start and auto update containers, even entire pods with systemd. Then they removed that in favor of Quadlet. Now in order to do a single container I can do a unit file, but for a pod, I need to use a Kubernetes cluster definition. Plus, unlike Docker their containers bow to SELinux definitions, so I have repeatedly struggled with containers unable…

I’ve been complaining about our OPs people pushing Colima over podman and now you’re making me think my podman info is outdated. Ouch.

Re: Exploring Podman: A More Secure Docker Alternative

#20

Post by _cenw »

tekeous wrote: post #6

Podman was good when it supported systemd unit files, so I could auto start and auto update containers, even entire pods with systemd. Then they removed that in favor of Quadlet. Now in order to do a single container I can do a unit file, but for a pod, I need to use a Kubernetes cluster definition. Plus, unlike Docker their containers bow to SELinux definitions, so I have repeatedly struggled with containers unable…

`podman generate systemd` is still there, and I see no reason you couldn't use it. it's just a bunch of podman commands wrapped in a unit file, no magic.

feels like a lot more cruft than quadlets to me though.

Post reply on HN