Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ditched Docker for Podman

codesmash.dev

Post reply on HN
Print view View original

101–110 of 670 posts

Re: I ditched Docker for Podman

#101

Post by CuriouslyC »

linuxftw wrote: post #75
LelouBil wrote: post #61

Earlier quoted context omitted.

Docker desktop will run a virtual machine for you. But you can simply install docker engine in wsl or in a VM on mac exactly like you would on linux (you give up maybe automatic port forwarding from the VM to your host)

This. I run docker in WSL. I also do 100% of my development in WSL (for work, anyway). Windows is basically just my web browser.

Ironic username. As a die hard, WSL aint bad though. I just can't deal with an OS that automatically quarantines bittorrent clients, decides to override local administrator policies via windows updates and pops up ad notifications.

Re: I ditched Docker for Podman

#102

Post by osigurdson »

bzzzt wrote: post #47
chrisweekly wrote: post #18

Earlier quoted context omitted.

OrbStack looks pretty nice, BUT an $8/mo/user subscription? Blech.

It doesn't only look prettier, it also starts and works a lot faster. Switched a few years ago; at that time Docker desktop has a known issue of continually using 5% CPU on Mac which they didn't fix for years.

I don't understand why people need a gui for docker/podman.

Re: I ditched Docker for Podman

#103

Post by cpuguy83 »

osigurdson wrote: post #93
drzaiusx11 wrote: post #76

Still happily using Colima as a Docker Desktop for Mac replacement. It even allows mixed architecture containers in the same compose stack. What's podman gain me besides a half baked Docker compose implementation?

Keep using docker, who cares. The article is concerned about CVEs, etc, but this doesn't matter for development very much. If you use k8s for anything, podman might help you avoid remembering yet another iac format.

Concerned about cve's but doesn't pay attention to the massive list of cve's for rootless setups which have a much broader scope/impact.

Re: I ditched Docker for Podman

#104

Post by Hizonner »

I don't know how podman compares to docker in terms of performance, and I do know that rootless containers can be a real pain.

But Docker is simply a non-starter. It's based on a highly privileged daemon with an enormous, hyper-complicated attack surface. It's a fundamentally bad architecture, and as far as I've been able to tell, it also comes from a project that's always shown an "Aw, shucks" attitude toward security. Nobody should be installing that anywhere, not even if there weren't an alternative.

Re: I ditched Docker for Podman

#106

Post by osigurdson »

sc68cal wrote: post #57

I have been running Podman in production for a number of years now, and have been very happy with the results. Podman pods have been super useful, and the nature of my workload is such that we just run a full pod on every host, so it's actually removed the need for an orchestrator like Kubernetes. I manage everything via Ansible and it has been great.

Why not just use Kubernetes?

Re: I ditched Docker for Podman

#107

Post by devjab »

akerl_ wrote: post #51
nickjj wrote: post #46

Earlier quoted context omitted.

> On the plus side, any company I work for doesn't have to worry about licences. Win win! Was this a deal breaker for any company? I ask because the Docker Desktop paid license requirement is quite reasonable. If you have less than 250 employees and make less than $10 million in annual revenue it's free. If you have a dev team of 10 people and are extremely profitable to where you need licenses you'd end up paying $9…

The problem isn’t generally the cost, it’s the complexity. You end up having to track who has it installed. Hired 5 more people this week? How many of them will want docker desktop? Oh, we’ve maxed the licenses we bought? Time to re-open the procurement process and amend the purchase order.

> You end up having to track who has it installed. Hired 5 more people this week? How many of them will want docker desktop? Oh, we’ve maxed the licenses we bought? Time to re-open the procurement process and amend the purchase order.

I don't quite get this argument. How is that different from any piece of software that an employee will want in any sort of enterprise setting? From an IT operations perspective it is true that Docker Desktop on Windows is a little more annoying than something like an Adobe product, because Docker Desktop users need their local user to be part of their local docker security group on their specific machine. Aside from that I would argue that Docker Desktop is by far one of the easiest developer tools (and do note that I said developer tools) to track licenses for.

In non-enterprise setups I can see why it would be annoying but I suspect that's why it's free for companies with fewer than 250 people and 10 million in revenue.

Re: I ditched Docker for Podman

#108

Post by Aluminum0643 »

anilakar wrote: post #23
Tajnymag wrote: post #11

I've wanted to migrate multiple times. Unfortunately, it failed on multiple places. Firstly, podman had a much worse performance compared to docker on my small cloud vps. Can't really go into details though. Secondly, the development ecosystem isn't really fully there yet. Many tools utilizing Docker via its socket, fail to work reliably with podman. Either because the API differs or because of permission limitations…

SELinux-related permission errors are an endless nuisance with podman and quadlet. If you want to sandbox about anything it's easier to create a pod with full host permissions and necessary /dev/ files mounted, running a simple program that exposes minimal functionality over an isolated container network.

Udica, plus maybe ausearch | audit2allow -C, makes it easy to generate SELinux policies for containers (works great for me on RHEL10-like distros)

https://www.redhat.com/en/blog/generate-selinux-policies-con...

Re: I ditched Docker for Podman

#109

Post by kordlessagain »

firesteelrain wrote: post #49
Izmaki wrote: post #31

Earlier quoted context omitted.

None of your companies need to worry about licenses. Docker ENGINE is free and open source. Docker DESKTOP is a software suite that requires you to purchase a license to use in a company. But Docker Engine, the core component which works on Linux, Mac and Windows through WSL2, that is completely and 1000% free to use.

Podman is inside the Ubuntu WSL image. No need for docker at all

This is not correct, at least when looking at my screen:

(base) kord@DESKTOP-QPLEI6S:/mnt/wsl/docker-desktop-bind-mounts/Ubuntu/37c7f28..blah..blah$ podman

Command 'podman' not found, but can be installed with:

sudo apt install podman

Re: I ditched Docker for Podman

#110

Post by thinkingtoilet »

akerl_ wrote: post #51
nickjj wrote: post #46

Earlier quoted context omitted.

> On the plus side, any company I work for doesn't have to worry about licences. Win win! Was this a deal breaker for any company? I ask because the Docker Desktop paid license requirement is quite reasonable. If you have less than 250 employees and make less than $10 million in annual revenue it's free. If you have a dev team of 10 people and are extremely profitable to where you need licenses you'd end up paying $9…

The problem isn’t generally the cost, it’s the complexity. You end up having to track who has it installed. Hired 5 more people this week? How many of them will want docker desktop? Oh, we’ve maxed the licenses we bought? Time to re-open the procurement process and amend the purchase order.

Are you complaining about buying 5 licenses? It seems extremely easy to handle. It feels like sometimes people just want to complain.
Post reply on HN