Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploring Podman: A More Secure Docker Alternative

betterstack.com

Post reply on HN
Print view View original

31–40 of 133 posts

Re: Exploring Podman: A More Secure Docker Alternative

#31

Post by koito17 »

BossingAround wrote: post #27

I still don't really understand why Red Hat invests into creating a Docker alternative, but I really like it. Podman does pretty much everything Docker does, but it has more features (e.g. pods) or the way Podman does it tends to be better (e.g. daemonless container spawning process). The main issue to a common developer would be Docker compose I suppose, which if you use simple compose files, there's actually a podm…

I use Podman on Mac OS. I've found the experience better than Docker for the most part, especially when it comes to supporting older versions of Mac OS. The only major downside of Podman on Mac OS is that you cant use the host network in a container, but people will rarely want to use the host network in a container anyway. This is something to keep in mind if you want to experiment with network things in a container and want to retain the same hostname and IP address of your host, however. I manage to work around this limitation anyway.

Re: Exploring Podman: A More Secure Docker Alternative

#32

Post by jamesu »

coldblues wrote: post #3

https://www.techrepublic.com/article/how-to-fix-the-docker-a... I almost got burned by this.

Speaking of networking issues, one big problem I ran into was running out of memory for network devices when using a nested setup (requiring a system restart to fix). Would have been a great lxc alternative otherwise.

Re: Exploring Podman: A More Secure Docker Alternative

#33

Post by bravetraveler »

INTPenis wrote: post #22
bonzini wrote: post #14

Earlier quoted context omitted.

> unlike Docker their containers bow to SELinux definitions, That's a bug in docker. If your system isn't configured for SELinux, disable it. Also the systemd files generated by podman-generate-systemd are just executing "podman start containername", you can write them on your own easily but (unlike e.g. docker-composr) the containers are black boxes pretty much. The advantage of quadlet is that the definition of the…

>That's a bug in docker. If your system isn't configured for SELinux, disable it. I feel obligated to say that you should set it to permissive mode, never disable SElinux. sudo setenforce 0

I know it's a hard sell, but the 30 minutes to an hour to understand filesystem contexts and how to copy them from a good place isn't a lot

It's likely to little gain. I know why people don't, but it is very accessible to those open to it

The more one adheres to the FHS, the easier SELinux is

Re: Exploring Podman: A More Secure Docker Alternative

#34

Post by bonzini »

INTPenis wrote: post #22
bonzini wrote: post #14

Earlier quoted context omitted.

> unlike Docker their containers bow to SELinux definitions, That's a bug in docker. If your system isn't configured for SELinux, disable it. Also the systemd files generated by podman-generate-systemd are just executing "podman start containername", you can write them on your own easily but (unlike e.g. docker-composr) the containers are black boxes pretty much. The advantage of quadlet is that the definition of the…

>That's a bug in docker. If your system isn't configured for SELinux, disable it. I feel obligated to say that you should set it to permissive mode, never disable SElinux. sudo setenforce 0

I meant disable labeling in podman. :)

Re: Exploring Podman: A More Secure Docker Alternative

#35

Post by lolinder »

koito17 wrote: post #31
BossingAround wrote: post #27

I still don't really understand why Red Hat invests into creating a Docker alternative, but I really like it. Podman does pretty much everything Docker does, but it has more features (e.g. pods) or the way Podman does it tends to be better (e.g. daemonless container spawning process). The main issue to a common developer would be Docker compose I suppose, which if you use simple compose files, there's actually a podm…

I use Podman on Mac OS. I've found the experience better than Docker for the most part, especially when it comes to supporting older versions of Mac OS. The only major downside of Podman on Mac OS is that you cant use the host network in a container, but people will rarely want to use the host network in a container anyway. This is something to keep in mind if you want to experiment with network things in a container…

> The only major downside of Podman on Mac OS is that you cant use the host network in a container

And this isn't even a Podman-specific issue, it's true of Docker Desktop as well [0]:

> The host networking driver only works on Linux hosts, and is not supported on Docker Desktop for Mac, Docker Desktop for Windows, or Docker EE for Windows Server.

[0] https://docs.docker.com/network/drivers/host/

Re: Exploring Podman: A More Secure Docker Alternative

#36

Post by nineteen999 »

INTPenis wrote: post #22
bonzini wrote: post #14

Earlier quoted context omitted.

> unlike Docker their containers bow to SELinux definitions, That's a bug in docker. If your system isn't configured for SELinux, disable it. Also the systemd files generated by podman-generate-systemd are just executing "podman start containername", you can write them on your own easily but (unlike e.g. docker-composr) the containers are black boxes pretty much. The advantage of quadlet is that the definition of the…

>That's a bug in docker. If your system isn't configured for SELinux, disable it. I feel obligated to say that you should set it to permissive mode, never disable SElinux. sudo setenforce 0

Only if you want it back in enforcing mode after the next reboot. If you want to make the change permanent, you need to set the following in /etc/selinux/config as well:

SELINUX=permissive

Re: Exploring Podman: A More Secure Docker Alternative

#37

Post by Modified3019 »

bravetraveler wrote: post #33
INTPenis wrote: post #22

Earlier quoted context omitted.

>That's a bug in docker. If your system isn't configured for SELinux, disable it. I feel obligated to say that you should set it to permissive mode, never disable SElinux. sudo setenforce 0

I know it's a hard sell, but the 30 minutes to an hour to understand filesystem contexts and how to copy them from a good place isn't a lot It's likely to little gain. I know why people don't, but it is very accessible to those open to it The more one adheres to the FHS, the easier SELinux is

>understand filesystem contexts and how to copy them from a good place

I’m not really sure what this means (I have 0 knowledge on selinux)

Re: Exploring Podman: A More Secure Docker Alternative

#38

Post by jrm4 »

Big picture, it feels like Podman is essential the same way Linux used to be.* It doesn't matter if very few people use it -- it's presence prevents its much bigger privately-owned brother(s) from doing terrible things.

*(I say "used to be" because Linux is now even more essential and central, not less.)

Re: Exploring Podman: A More Secure Docker Alternative

#39

Post by Kwpolska »

INTPenis wrote: post #22
bonzini wrote: post #14

Earlier quoted context omitted.

> unlike Docker their containers bow to SELinux definitions, That's a bug in docker. If your system isn't configured for SELinux, disable it. Also the systemd files generated by podman-generate-systemd are just executing "podman start containername", you can write them on your own easily but (unlike e.g. docker-composr) the containers are black boxes pretty much. The advantage of quadlet is that the definition of the…

>That's a bug in docker. If your system isn't configured for SELinux, disable it. I feel obligated to say that you should set it to permissive mode, never disable SElinux. sudo setenforce 0

You should set it to permissive mode if you think you will ever need to re-enable that trainwreck.

Re: Exploring Podman: A More Secure Docker Alternative

#40

Post by geerlingguy »

BossingAround wrote: post #28
INTPenis wrote: post #26

As a certified RHEL engineer I have been using Podman for years already. To be perfectly honest I do enjoy it for all my personal container use. But at work I still use docker for our developers. There is so far nothing I can offer our developers that can match docker compose in simplicity. We even use buildah in CI pipelines when we make container images, but specifically for developer end users docker compose is st…

You should be able to use podman with docker compose though ( https://www.redhat.com/sysadmin/podman-docker-compose )

Should, but there are still edge cases where people use weird edge features of Docker's implementation that don't always work out of the box with Podman (it's a lot better now, though, and most of my compose files are fine either way).
Post reply on HN