101–110 of 212 posts
Earlier quoted context omitted.
The next step: systemkubed.
Nah, we got that already. Quadlet can handle k8s manifests. https://man.archlinux.org/man/quadlet.5.en#Kube_units_%5BKub...
Could it be done with systemd and dbus? Can dbus be distributed among several systems like mmc on Windows? I have no idea, just some questions that popped into my head lately.
Earlier quoted context omitted.
> I also miss the simplicity of compose, but for me running rootless is worth the tradeoff. To setup/tear down software dev environments deployed locally, the root/rootless discussion isn't really relevant. Ease of deployment and ease of use are critical though, and Docker is above all a development experience victory.
Relevant to who? The damage done with container escape is bigger on my machine than any production server I have access to. And there are a lot more packages running in my dev environment than on production servers. When it comes to security or convenience I always choose the first but I know most people wont. Podman-compose isn't as good as docker but it exists, and you can run docker-compose with podman as the runt…
If you are concerned that your dev machine is vulnerable but for any reason you decided to not do anything about it, them you might be happy to learn that it's possible to configure Docker to not run as root.
Earlier quoted context omitted.
I mean the best part about open source and Linux is that you have choice. Do you want to run an OS devoid of SystemD? Fine. Will you be going against the tide and leaving a large part of the ecosystem behind? Yup. I’ve chosen to embrace systemd and learn it as it is the defacto standard it seems rather than fight what I think is a futile war against it. That being said. I won’t force you to use it if you don’t. But I…
systemd is extremely intrusive. anything dependent on it is a failure.
Earlier quoted context omitted.
> Is software supposed to update without administrator supervision yes proper CI is a thing, and containers not being updated is actually quite a bit of an issue in the current software industry especially if combined with custom registries auto update is quite a neet thing oh also it's a SystemD feature to let SystemD manage your containers so why are you asking if it works without SystemD?
Updating your custom registry with new upstream dep versions after testing in CI with the all services you care about is fine. But the OP seems to just blindly pull the newest wordpress images from upstream or am I missing something? How is this meant to work reliably? I guess given wordpress's security record taking breaking your site from time to time is preferable to your site being broken into from time to time.
> Running containerized workloads in systemd is a simple yet powerful means for reliable and rock-solid deployments.
They say its reliable and rock-solid. Isn't that enough for you? /s
---
Honestly, the amount of companies who: Don't understand the problems, forgot history, and think we're innovating into new territory because of hyped up branding is utterly baffling in the whole container space.
I'm not saying they're all bad, and better common tools are a good thing. But i see so many companies operating at [required complexity level] + 1 in the hopes to no longer be bothered by simpler problems.
Earlier quoted context omitted.
Relevant to who? The damage done with container escape is bigger on my machine than any production server I have access to. And there are a lot more packages running in my dev environment than on production servers. When it comes to security or convenience I always choose the first but I know most people wont. Podman-compose isn't as good as docker but it exists, and you can run docker-compose with podman as the runt…
> Relevant to who? The damage done with container escape is bigger on my machine than any production server I have access to. If you are concerned that your dev machine is vulnerable but for any reason you decided to not do anything about it, them you might be happy to learn that it's possible to configure Docker to not run as root. https://docs.docker.com/engine/security/rootless/
Why would you assume I'm not doing anything about it? Podman is one piece in my hygiene, not allowing npm scripts is another. It does make some things harder and most devs I work with don't even know it's possible and should be done. Assuming you aren't vulnerable and waiting for a problem to appear before solving it is doing it backwards if you ask me. Your kind of self-confidence is what usually gets people.
I could also point docker-compose to the podman socket (it's the default for the podman compose command), if that was something I needed. Pods do it for me these days, which was my initial point. Even though compose is cool it's not really needed and wouldn't add that much for me these days. I've been using podman so long that I don't see the point in going back to docker, changing the default when what I'm using was built to fix that issue to begin with.
What point are you trying to make? I can live without docker.
Earlier quoted context omitted.
What worse is , it screws up the firewall rules. Podman avoid that so , quadlets should be fine? Podman supposed to be drop-in replacement for docker but - last try (4 months ago) of podman to run our development docker containers fails to build so i think Podman is still far away from docker replacement.
> Podman supposed to be drop-in replacement for docker but - last try (4 months ago) of podman to run our development docker containers fails to build so i think Podman is still far away from docker replacement. I'd be curious what failed to build under podman. I have been using podman as a replacement for docker for the last 3 years and haven't found any blocker. Sometimes you can't reuse a docker-compose file share…
So not a drop-in replacement then...
To me, this big problem with Docker is that it does a ton of changes to my system, even when I don't use it. It runs a daemon, it uses a bunch of IPs, it mounts a ton of stuff ... Is there a reason for all that noise and complexity? There can't be a reason until I run a container, right? And even then, it seems way too much. Is it different when using Quadlets?
One of podman's selling points is that it doesn't need a daemon, and it runs without root privileges. I'm not familiar enough with the lower level details to know how it works, but it certainly feels less like you are making "a ton of changes to the system" compared to docker
Earlier quoted context omitted.
> Podman supposed to be drop-in replacement for docker but - last try (4 months ago) of podman to run our development docker containers fails to build so i think Podman is still far away from docker replacement. I'd be curious what failed to build under podman. I have been using podman as a replacement for docker for the last 3 years and haven't found any blocker. Sometimes you can't reuse a docker-compose file share…
> Sometimes you can't reuse a docker-compose file shared by a third party project straight away without adaptation So not a drop-in replacement then...
Earlier quoted context omitted.
INI files are not specified anywhere, so it ends up being a implementation-defined free-for-all. Also, YAML supports data structures that INI files don't. I don't understand the hate that YAML gets. If you're not tasked with writing a parser, the data format just works as expected.
> I don't understand the hate that YAML gets https://noyaml.com/ is a decent overview of exactly how shit it is. But outside of that, using spaces for logic is extremely error prone if you go past 10-15 lines and 2-3 levels deep.
If that site lists all the complains that nitpickers managed to put together, it sounds like YAML is virtually perfect.
Also, to underline how silly and futile these nitpicking complains are, some YAML parsers already explicitly address silly things like the Norway problem.