Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker is dead? Podman – an alternative tool?

content.fme.de

Post reply on HN
Print view View original

101–110 of 183 posts

Re: Docker is dead? Podman – an alternative tool?

#101

Post by zbentley »

stingraycharles wrote: post #99
smarx007 wrote: post #96

How did the intro get so many things wrong?! 1. Mirantis did not acquire Docker Inc., they only bought Docker Enterprise. See https://techcrunch.com/2019/11/13/mirantis-acquires-docker-e... and https://www.docker.com/blog/docker-enterprise-edition/ 2. k8s didn't remove dockershim for political reasons but because containerd was refactored out of Docker long time ago and k8s wanted to get rid of the extra layer. See h…

> The rate limits were mostly in place to deny corporate CI users access to the Hub free of charge and force them to pay or deploy a mirror. What I never understood is why they didn’t just properly handle this with mirrors like any package manager does; why is this a problem for docker, but not for yum / apt / etc? I have to admit that these rate limits have accelerated my migration to alternatives like quay.io

A guess: it takes a long time to get a reliable network of mirrors (mostly spent building relationships with institutions, like universities, with both the bandwidth/infrastructure you need and the willingness to lend it for free), and Docker is quite new.

Re: Docker is dead? Podman – an alternative tool?

#102

Post by jarek83 »

iknownothow wrote: post #40

It's okay to stick with Docker if it works for us right? There's nothing fundamentally wrong with it right? At the moment Podman is just more work for us because I and other devs don't have years of of experience and intuitions about Podman like we have with Docker. I'd rather just focus on business problems rather than another migration.

Similar feelings here. We use Docker without any issues beyond usual problems of a caliber that I guess any other tool would have.

I see some new live in docker desktop and I also have flawless experience on M! Mac with it. I even ignored all recent hype to ditch Docker because it became more transparent tool to my workflow, I forgot I use it.

Re: Docker is dead? Podman – an alternative tool?

#103

Post by zbentley »

nickjj wrote: post #93
teekert wrote: post #76

Earlier quoted context omitted.

Are you saying that all files from your containers are owned by you as user? If so I will start investigating right now. It is so super annoying to download something with nzbget for example and then having to go through sudo to get to your downloaded files. It is indeed my major gripe with my docker compose setup atm. Or just messing with a html file in the nginx docker bind mount, ugh! If podman solves that I’m goi…

> Are you saying that all files from your containers are owned by you as user? If so I will start investigating right now You can do this with Docker today without much fuss. Here's a bunch of web app examples (Flask, Rails, Django, Node, Phoenix) that run your containers as a non-root user which ensures any volume mounted files end up being set to your Docker host's user along with running your main process as a non…

That's fair, but that issue is more common than you think. Some folks use Linux desktop systems with multiple users: shared computers (family or university--not all lab environments have sane workstation user management, unfortunately), or a personal computer with multiple accounts for separation (e.g. a home and work user) both come to mind.

And sure, UID remapping is available, but that's no longer in the realm of "just works".

Re: Docker is dead? Podman – an alternative tool?

#104

Post by Havoc »

djbusby wrote: post #14
Havoc wrote: post #6

Think it is rapidly moving towards being more of a data carrier/format rather than being dead per se. Half the time you're jamming it into some cloud service anyway where you have no idea what GCP/fly/aws is using under the hood to actually run it. Meaning this discussion is more relevant to the self-hosted context. In which case I'd say containerization isn't really security. So in my mind that residual risk of the…

I'm still in the VM all the things camp. Like, containers are neat but VMs have the same cheapness for me - that is deploy some VM per app. Like Docker per app. Many times these days I'm one VM for just one Docker package. (Can you tell VM is my favorite isolation method)

>I'm still in the VM all the things camp.

I do both with deciding factor being whether it has internet exposure.

>VMs have the same cheapness for me

It's all kinda relative (ballooning etc), but from what I've seen LXC allows for much higher density. Lowest LXC I've got running is ~20MB used. Lowest VM is at 380MB. Both headless debians so vaguely comparable (though MQTT vs Wireguard).

Not much of a difference if you've got a 128gb server on hand, yet its nearly 20x so depending on perspective its either a big difference or doesn't matter.

Re: Docker is dead? Podman – an alternative tool?

#105

Post by Nullabillity »

stingraycharles wrote: post #99
smarx007 wrote: post #96

How did the intro get so many things wrong?! 1. Mirantis did not acquire Docker Inc., they only bought Docker Enterprise. See https://techcrunch.com/2019/11/13/mirantis-acquires-docker-e... and https://www.docker.com/blog/docker-enterprise-edition/ 2. k8s didn't remove dockershim for political reasons but because containerd was refactored out of Docker long time ago and k8s wanted to get rid of the extra layer. See h…

> The rate limits were mostly in place to deny corporate CI users access to the Hub free of charge and force them to pay or deploy a mirror. What I never understood is why they didn’t just properly handle this with mirrors like any package manager does; why is this a problem for docker, but not for yum / apt / etc? I have to admit that these rate limits have accelerated my migration to alternatives like quay.io

Docker is a for-profit company. The question wasn't "how do we ensure that this stays available?" but "how do we make money from this?".

Re: Docker is dead? Podman – an alternative tool?

#106

Post by forty »

stingraycharles wrote: post #99
smarx007 wrote: post #96

How did the intro get so many things wrong?! 1. Mirantis did not acquire Docker Inc., they only bought Docker Enterprise. See https://techcrunch.com/2019/11/13/mirantis-acquires-docker-e... and https://www.docker.com/blog/docker-enterprise-edition/ 2. k8s didn't remove dockershim for political reasons but because containerd was refactored out of Docker long time ago and k8s wanted to get rid of the extra layer. See h…

> The rate limits were mostly in place to deny corporate CI users access to the Hub free of charge and force them to pay or deploy a mirror. What I never understood is why they didn’t just properly handle this with mirrors like any package manager does; why is this a problem for docker, but not for yum / apt / etc? I have to admit that these rate limits have accelerated my migration to alternatives like quay.io

By default container images are not signed (there is notary, but it's not commonly used - maybe notary V2 will change that - and I think the signature changes depending on the registry it's hosted on anyway?) which make it inconvenient to mirror.

Now, why are we still producing new package formats without mandatory signatures (containers, npm, cargo, etc) is not really clear to me. I guess everyone must think "those old crazy Unix folks signing their Deb and Rpm must have had their crazy reasons, but we have no reason to do the same" :) a more cynical thinking would say "it makes it inconvenient to mirror things and easier to build a business from the central repository" :)

Re: Docker is dead? Podman – an alternative tool?

#107

Post by mekster »

gigatexal wrote: post #23
jordemort wrote: post #11

Why not both? Since Podman 4.1 came out with full Compose 2.x compatibility, I'm running Podman on Docker's socket, but using Docker's CLI to talk to it, so that I can use the buildx and compose CLI plugins. It works great, Docker's CLI doesn't seem to have any clue that it's talking to not-Docker. I even have VSCode's Docker extension and Remote Containers working this way.

Wow did not know about full compose support going to check it out now.

That took a while... Although I don't see what benefit I get by going podman when docker works fine and I don't really care about theoretical rootless security enhancement.

Re: Docker is dead? Podman – an alternative tool?

#108

Post by vocram »

smarx007 wrote: post #96

How did the intro get so many things wrong?! 1. Mirantis did not acquire Docker Inc., they only bought Docker Enterprise. See https://techcrunch.com/2019/11/13/mirantis-acquires-docker-e... and https://www.docker.com/blog/docker-enterprise-edition/ 2. k8s didn't remove dockershim for political reasons but because containerd was refactored out of Docker long time ago and k8s wanted to get rid of the extra layer. See h…

> To execute the images Podman then uses e.g. the mentioned containerd,

Another wrong thing. Podman directly controls the runtime (crun or runC). It does not talk with containerd like Docker.

Re: Docker is dead? Podman – an alternative tool?

#109

Post by forty »

qbasic_forever wrote: post #29

Rootless podman is my first choice for using containers now, it works fantastically well in my experience. It's so much nicer to have all my container related stuff like volumes, configs, the control socket, etc. in my home directory and standard user paths vs. scattered all over the system. Permission issues with bind mounts just totally disappear when you go rootless. It's so much easier and better than the root pr…

If you are on Linux, there is the fantastic podman option "--userns keep-id" which will make sure the uid inside the container is the same as your current user uid.

Re: Docker is dead? Podman – an alternative tool?

#110

Post by mekster »

lapser wrote: post #85
matsemann wrote: post #67

Earlier quoted context omitted.

Is the compose support recent? Tried earlier this year, and it was not nearly there. And I use docker compose stuff as remote interpreter in IntelliJ/Pycharm stuff, that didn't work well with podman when I tested. I don't really care what I use, I just want to be able to develop locally without spending days setting stuff up. Rootless or whatever means nothing to me. Docker compose have made that easy for lots of oth…

It is at least a year or so old. But there have been quite a few bugs, and iirc it was only at v4 where incompatible bugs have been ironed out. Not that it wasn't usable previously, you'd just run into a few issues.

> Not that it wasn't usable previously, you'd just run into a few issues.

I don't like that definition of "usable".

Compose v2.0 compatibility became available only since last month which was very late.

If podman isn't for technical benefit, is this all about political decision for RH to govern container ecosystem on their own instead of dealing with docker?

Post reply on HN