Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploring Podman: A More Secure Docker Alternative

betterstack.com

Post reply on HN
Print view View original

111–120 of 133 posts

Re: Exploring Podman: A More Secure Docker Alternative

#111

Post by Cyph0n »

jay-aye-see-key wrote: post #109
Cyph0n wrote: post #97

Earlier quoted context omitted.

I recently migrated over to NixOS which treats systemd as the source of truth for everything, including containers. I found this model extremely intuitive, but it was difficult to apply this to Docker Compose without a lot of manual migration. So I ended up writing a tool that handles this for you — it converts your Compose files into a NixOS config that can be interpreted and managed natively. https://github.com/aks…

This is a cool idea. Two questions: Arion can wrap docker-compose and run as a project or part of a nixos config. Did you come across Arion before creating this, and have you compared them? I had a brief look through your examples and it doesn’t look like compose2nix implements docker-compose’s network per compose file. Is this something you want to add?

So, from what I understand, arion provides a Nix frontend for Docker Compose. This allows you to write Nix that runs via Docker Compose. It doesn’t solve the migration problem: if you have an existing Docker Compose project, you still need to manually convert it into Nix for arion to consume.

My tool does the opposite: it takes a Compose file and converts it into OCI containers in Nix. The idea is that your Compose file is the source of truth, and you simply generate Nix to run on NixOS. One benefit here is that you can easily migrate an existing Compose project into native Docker/Podman containers running on NixOS. This removes Docker Compose from the equation entirely - essentially a “reimplementation” of Compose.

It should support the default network per Compose project. See: https://github.com/aksiksi/compose2nix/blob/6dc451fd960f7a9b.... If you’re talking about something else, please feel free to open an issue and I can take a look.

Re: Exploring Podman: A More Secure Docker Alternative

#112

Post by [deleted] »

tekeous wrote: post #6

Podman was good when it supported systemd unit files, so I could auto start and auto update containers, even entire pods with systemd. Then they removed that in favor of Quadlet. Now in order to do a single container I can do a unit file, but for a pod, I need to use a Kubernetes cluster definition. Plus, unlike Docker their containers bow to SELinux definitions, so I have repeatedly struggled with containers unable…

[deleted]

Re: Exploring Podman: A More Secure Docker Alternative

#113

Post by scrozart »

tw04 wrote: post #102
ape4 wrote: post #54

Earlier quoted context omitted.

Its documented. If you just type `podman-compose` in the command line you get... usage: podman-compose [-h] [-v] [--in-pod in_pod] [--pod-args pod_args] [--env-file env_file] [-f file] [-p PROJECT_NAME] [--podman-path PODMAN_PATH] [--podman-args args] [--podman-pull-args args] [--podman-push-args args] [--podman-build-args args] [--podman-inspect-args args] [--podman-run-args args] [--podman-start-args args] [--podma…

That’s… not documentation. That’s a CLI helpfile. It’s better than nothing but also what is completely broken with the “move fast and break things” mindset.

Sure looks like documentation to me, but I don't need pretty webpages. 'man' is more than sufficient for tools like these.

Re: Exploring Podman: A More Secure Docker Alternative

#114

Post by lmeyerov »

notso411 wrote: post #64
lolinder wrote: post #21

Earlier quoted context omitted.

I already was defining my infrastructure with docker-compose.yml files, and found out that podman-compose has a poorly documented feature that generates systemd units. It doesn't use the now-deprecated podman feature, it writes the unit files itself, and I find the process much smoother than the podman feature anyway. To enable the feature: $ podman-compose systemd -a create-unit To register a systemd unit: $ podman-…

I thought docker compose was for local dev only and not meant to be used for production workloads?

It's great in prod. Doesn't make $ for companies marketing k8s iaac devops, so no one to advertise.

Re: Exploring Podman: A More Secure Docker Alternative

#115

Post by Helmut10001 »

I agree that rootless containers and isolated namespaces are critical security features. But with docker rootless, this is also possible and not complicated. You just have to do it. I have written a blog post to set up Mastodon in docker rootless with all the best practices currently available [1].

The benefit with sticking with docker is that accessibility is better: More communities, more blogs, broad availability of docker compose configs, more peers knowing how to use it etc. In the end, both podman and docker run processes in isolated namespaces on the host.

[1]: https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless...

Re: Exploring Podman: A More Secure Docker Alternative

#116

Post by BossingAround »

windexh8er wrote: post #47
BossingAround wrote: post #27

I still don't really understand why Red Hat invests into creating a Docker alternative, but I really like it. Podman does pretty much everything Docker does, but it has more features (e.g. pods) or the way Podman does it tends to be better (e.g. daemonless container spawning process). The main issue to a common developer would be Docker compose I suppose, which if you use simple compose files, there's actually a podm…

> I see no reason using Docker at least on Linux boxes. Not sure how Podman fares on macOS or Windows. I hope the majority doesn't end up with your point of view. Docker is not RedHat/IBM. If Docker goes away RedHat gets to continue to push their corporate agenda with a heavier hand. There are some advantages to Podman, but there are also some things that have not been executed well in RedHat's mission to replace all…

Honestly, I trust Red Hat a lot more than Docker.

After the first two or so sentences, you don't mention a single specific thing in your comment, so it's difficult to understand what you mean.

Re: Exploring Podman: A More Secure Docker Alternative

#117

Post by mrAssHat »

nashashmi wrote: post #100
freedomben wrote: post #44

I almost never see what is IMHO the killer feature of Podman touted as a reason to prefer it over Docker: Docker mangles your network config. It is a nightmare trying to run Docker and KVM virtual machines with bridges at the same time. Podman on the other hand plays very nice OOTB. I've also had a lot of VPNs break and/or be broken by Docker. I don't know much about the way podman does networking, but whatever it is…

Podman is free. Docker is also free, but a pain to install docker without docker desktop.

No pain at all.

Re: Exploring Podman: A More Secure Docker Alternative

#118

Post by INTPenis »

BossingAround wrote: post #28
INTPenis wrote: post #26

As a certified RHEL engineer I have been using Podman for years already. To be perfectly honest I do enjoy it for all my personal container use. But at work I still use docker for our developers. There is so far nothing I can offer our developers that can match docker compose in simplicity. We even use buildah in CI pipelines when we make container images, but specifically for developer end users docker compose is st…

You should be able to use podman with docker compose though ( https://www.redhat.com/sysadmin/podman-docker-compose )

I've tried several times over the last few years and it always messes up somewhere, usually with networking. I stopped trying.

Re: Exploring Podman: A More Secure Docker Alternative

#119

Post by PhilippGille »

sph wrote: post #90
emerongi wrote: post #11

Earlier quoted context omitted.

> Plus, unlike Docker their containers bow to SELinux definitions, so I have repeatedly struggled with containers unable to access mapped directories. Add the following to containers.conf if you don't want to deal with it: [containers] label=false If you don't like podman's default security level, there is usually a way to turn things off.

The only times I had issues with SELinux and podman, it was because I forgot to add the z flag to the volume: podman run -v .:/app:z image This only happens locally as files in your home have strict security rules, never had any issue on a CentOS server.

Note there's also uppercase Z, for when the volume shouldn't be shared with other containers: https://unix.stackexchange.com/questions/651198/podman-volum...

Re: Exploring Podman: A More Secure Docker Alternative

#120

Post by jmnicolas »

morelisp wrote: post #81
lolinder wrote: post #67

Earlier quoted context omitted.

I'm using podman-compose for my homelab, which is obviously fine. But even for small-scale single-node production use cases, I suspect that podman-compose with systemd doesn't have the same concerns as docker-compose does. Since you're registering the workload with systemd, it'll restart with the node as easily as any other service, and rootless containers are a big win for security. Where you can't keep using (podma…

You can keep using x-compose on several nodes, you just need e.g. ansible or salt on top of it. For many things this is still a local maximum compared to a K8s cluster or "just ssh in'.

Why not docker swarm then?
Post reply on HN