Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploring Podman: A More Secure Docker Alternative

betterstack.com

Post reply on HN
Print view View original

121–130 of 133 posts

Re: Exploring Podman: A More Secure Docker Alternative

#121

Post by Modified3019 »

bravetraveler wrote: post #42
Modified3019 wrote: post #37

Earlier quoted context omitted.

>understand filesystem contexts and how to copy them from a good place I’m not really sure what this means (I have 0 knowledge on selinux)

edit: Apologies for the wall. I think I finally landed on a decent mix after many edits. I'm finished now, lol. SELinux has a bit of a well deserved reputation... but I, a fairly silly person, have managed to work with it This video likely explains things far better than I can in this post: https://www.youtube.com/watch?v=_WOKRaM-HI4 I'll probably fail with specifics, where they certainly do a better job. So. First i…

Very enlightening, I really appreciate the time you took to outline all of this, thank you!

Re: Exploring Podman: A More Secure Docker Alternative

#123

Post by jmnicolas »

windexh8er wrote: post #45
jrm4 wrote: post #38

Big picture, it feels like Podman is essential the same way Linux used to be.* It doesn't matter if very few people use it -- it's presence prevents its much bigger privately-owned brother(s) from doing terrible things. *(I say "used to be" because Linux is now even more essential and central, not less.)

> It doesn't matter if very few people use it -- it's presence prevents its much bigger privately-owned brother(s) from doing terrible things. I'm going to assume that "bigger privately-owned brother(s)" you're referring to Docker? If so, ironic given all of the evil things RedHat and IBM do in the OSS realm.

What evil things? (honest question)

I was burned by the CentOS shenanigans but I'm not aware of anything else.

And my beef with CentOS is the way they handled it, if they had left me enough time to migrate my servers we'd still be cool.

Re: Exploring Podman: A More Secure Docker Alternative

#124

Post by figmert »

pydry wrote: post #17
qwertox wrote: post #15

I have such a huge arsenal of custom tools to manage Docker, that I envy Podman users because I can't move to it because of this technical debt. I just keep hoping that Docker isn't that bad and is a good alternative to Podman, because I've read mostly good things about the it, while Docker usually gets dragged through the dirt.

Podman itself is good but on the tooling side it falls down. Docker tooling tends to work with podman but you have to do a bunch of stuff like run a server to imitate docker. At that point why bother?

A bunch of stuff being enabling a single systemd service, and pointing the DOCKER_HOST env to said service.

Re: Exploring Podman: A More Secure Docker Alternative

#125

Post by ClumsyPilot »

scrozart wrote: post #113
tw04 wrote: post #102

Earlier quoted context omitted.

That’s… not documentation. That’s a CLI helpfile. It’s better than nothing but also what is completely broken with the “move fast and break things” mindset.

Sure looks like documentation to me, but I don't need pretty webpages. 'man' is more than sufficient for tools like these.

How would I ever read this documentation without installing postman? Am I suppose to download and install every tool just to read about how it works?

Re: Exploring Podman: A More Secure Docker Alternative

#126

Post by AkihiroSuda »

dathinab wrote: post #68
throwawaaarrgh wrote: post #55

Somebody should tell them Docker can run in rootless mode.

It can but: - They by default don't. - It's only semi officially supported. It requires non official tooling, through they link to that tooling officially in their doc. But issues specific to rootless docker seem to not be much of a priority. - roots less docker sometimes has some slight issues, but mostly minor stuff The fact that they can make it save to use, but do not, is a really huge red flag. And it's not the…

> It requires non official tooling

Rootless Docker has been merged into the official since Docker 19.03, and graduated from experimental since Docker 20.10.

The "tooling" is available in the official apt/dnf repo too: - https://download.docker.com/linux/ubuntu/dists/jammy/pool/st... - https://download.docker.com/linux/centos/9/x86_64/stable/Pac...

Re: Exploring Podman: A More Secure Docker Alternative

#127

Post by AkihiroSuda »

> Podman is designed to help with this by providing stronger default security settings compared to Docker. Features like rootless containers, user namespaces, and seccomp profiles, while available in Docker, aren't enabled by default and often require extra setup.

Seccomp has been enabled by default since 2015: https://github.com/moby/moby/pull/18780

It is true that Rootless isn't enabled by default but its "extra setup" can be done with a single command (`dockerd-rootless-setuptool.sh install`)

Re: Exploring Podman: A More Secure Docker Alternative

#128

Post by pydry »

figmert wrote: post #124
pydry wrote: post #17

Earlier quoted context omitted.

Podman itself is good but on the tooling side it falls down. Docker tooling tends to work with podman but you have to do a bunch of stuff like run a server to imitate docker. At that point why bother?

A bunch of stuff being enabling a single systemd service, and pointing the DOCKER_HOST env to said service.

From what I remember it wasnt just that.

Re: Exploring Podman: A More Secure Docker Alternative

#129

Post by morelisp »

jmnicolas wrote: post #120
morelisp wrote: post #81

Earlier quoted context omitted.

You can keep using x-compose on several nodes, you just need e.g. ansible or salt on top of it. For many things this is still a local maximum compared to a K8s cluster or "just ssh in'.

Why not docker swarm then?

For a lot of the services I'm thinking of for this case the scheduling may be across multiple nodes but it may not be flexible - e.g. this is my preferred way to run things which need guaranteed local iops. So Swarm maybe helps with service discovery etc. but its main purpose is lost.

I have a lot of complaints about Docker Swarm but they're either about its ownership issues or relatively minor (but - lots of minor) issues, if you want to use it it's fine. But you do still need an orchestration layer above it anyway.

Re: Exploring Podman: A More Secure Docker Alternative

#130

Post by freedomben »

tahnyall wrote: post #87
freedomben wrote: post #44

I almost never see what is IMHO the killer feature of Podman touted as a reason to prefer it over Docker: Docker mangles your network config. It is a nightmare trying to run Docker and KVM virtual machines with bridges at the same time. Podman on the other hand plays very nice OOTB. I've also had a lot of VPNs break and/or be broken by Docker. I don't know much about the way podman does networking, but whatever it is…

> It is a nightmare trying to run Docker and KVM virtual machines with bridges at the same time. I'm doing it right now, no nightmares, just works, odd.

Are you bridging to the main eth interface on the host? (not just a KVM private bridge). Can you share your KVM configs?
Post reply on HN