Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker is dead? Podman – an alternative tool?

content.fme.de

Post reply on HN
Print view View original

111–120 of 183 posts

Re: Docker is dead? Podman – an alternative tool?

#111

Post by vocram »

stingraycharles wrote: post #99
smarx007 wrote: post #96

How did the intro get so many things wrong?! 1. Mirantis did not acquire Docker Inc., they only bought Docker Enterprise. See https://techcrunch.com/2019/11/13/mirantis-acquires-docker-e... and https://www.docker.com/blog/docker-enterprise-edition/ 2. k8s didn't remove dockershim for political reasons but because containerd was refactored out of Docker long time ago and k8s wanted to get rid of the extra layer. See h…

> The rate limits were mostly in place to deny corporate CI users access to the Hub free of charge and force them to pay or deploy a mirror. What I never understood is why they didn’t just properly handle this with mirrors like any package manager does; why is this a problem for docker, but not for yum / apt / etc? I have to admit that these rate limits have accelerated my migration to alternatives like quay.io

They opposed to add support to private mirrors in the software, probably to retain their monopolistic position

https://github.com/moby/moby/pull/34319

Re: Docker is dead? Podman – an alternative tool?

#112

Post by mekster »

jdoss wrote: post #39

I only use Podman for my workloads these days. Docker was always a headache for me on Linux. Podman allows me to quickly do whatever I want with containers and I can use systemd or a simple bash script to easily create services on my workstation or in production with Nomad with https://github.com/hashicorp/nomad-driver-podman I am super thankful for the team of developers that work on Podman. It has really come a lon…

What were the headaches?

Re: Docker is dead? Podman – an alternative tool?

#113

Post by mekster »

bdcravens wrote: post #21

> Podman currently only runs stably on Linux-based systems. Under Windows or MacOS it becomes a bit more demanding, although it is possible with detours. I think this is an area bearing improvement before most dev workflows can switch

Why do you need to run docker on Windows or Mac?

Re: Docker is dead? Podman – an alternative tool?

#114

Post by indymike »

KronisLV wrote: post #46
kristjansson wrote: post #25

Earlier quoted context omitted.

Runs docker in a VM for you, abstracts that away, confuses the hell out of new and old developers alike.

> Runs docker in a VM for you It depends: - the Hyper-V backend uses a VM for running the actual containers, which is a bit annoying because it just sits there and eats your RAM whenever it's on (technically you could enable dynamic memory for the VM, but i think it used to break) - the WSL2 backend uses the whole fancy new system that Microsoft came up with to, idk, attempt to embrace and extend Linux or something;…

Last year, our entire devlopment team switched to Linux for development. We ditched Mac and Windows. And we discovered something:

1. We were all spending 6-8 hours per week trying bending our host OS to work like Linux. Containers, package managers, compatibility layers, different autocompletes, etc... all do create work. All the adaptations to avoid running Linux also often don't work identically to the real thing (i.e. VM CPU & memory allocation vs. Linux container CPU & memory allocation, installing Postgres on MacOS vs Linux) so there's lots of little learning curves.

2. We spent a lot of time learning how to do things in Windows and MacOS that did not apply to production. Now all the learning "how to make x work" applies to development and production, too.

Incidentally, running Podman or Docker on Linux is a much better experience that the simulation via VM that exists on Windows and MacOS. Another plus is that containers behave for developers like they will in production, leading to better decisions about using containers.

Re: Docker is dead? Podman – an alternative tool?

#115

Post by johnchristopher »

dhzhzjsbevs wrote: post #87
johnchristopher wrote: post #72

Earlier quoted context omitted.

> Permission issues with bind mounts just totally disappear when you go rootless. I have a problem with mounting a named foo in a container (at /foo) and bindfsing the underlying directory of that volume on ${HOME}/foo with create-for parameters so that when the host user touch files in it they are owned by host 1000:1000 but inside the container it's owned by 33:33. Volume foo really contains only a unix socket. Thi…

Change the ids of the user inside the container to match what's needed on the host or take a look at subuid's.

> Change the ids of the user inside the container to match what's needed on the host or take a look at subuid's.

Oh, I tried running the process in the container under a different uid but it complained about unprivileged user. Going the other way may do it, thanks. Although it requires more fiddling with stock images.

Re: Docker is dead? Podman – an alternative tool?

#116

Post by bornfreddy »

smarx007 wrote: post #96

How did the intro get so many things wrong?! 1. Mirantis did not acquire Docker Inc., they only bought Docker Enterprise. See https://techcrunch.com/2019/11/13/mirantis-acquires-docker-e... and https://www.docker.com/blog/docker-enterprise-edition/ 2. k8s didn't remove dockershim for political reasons but because containerd was refactored out of Docker long time ago and k8s wanted to get rid of the extra layer. See h…

Also:

> Instead of free use of Docker Desktop until now, this software suite is now available for rent after the transition phase until the end of January 2022, starting at $5 per user/month, provided it is for professional use.

> Here, Docker Desktop includes the Docker Engine, docker-cli, docker-compose and a credential helper, among others.

At least docker-compose (and probably also docker service + cli, since it is included in Debian) is FOSS. While they might be included in Docker Desktop, they are certainly available separately, so paying for the licence is in no way obligatory when using docker.

Re: Docker is dead? Podman – an alternative tool?

#117

Post by nickjj »

zbentley wrote: post #103
nickjj wrote: post #93

Earlier quoted context omitted.

> Are you saying that all files from your containers are owned by you as user? If so I will start investigating right now You can do this with Docker today without much fuss. Here's a bunch of web app examples (Flask, Rails, Django, Node, Phoenix) that run your containers as a non-root user which ensures any volume mounted files end up being set to your Docker host's user along with running your main process as a non…

That's fair, but that issue is more common than you think. Some folks use Linux desktop systems with multiple users: shared computers (family or university--not all lab environments have sane workstation user management, unfortunately), or a personal computer with multiple accounts for separation (e.g. a home and work user) both come to mind. And sure, UID remapping is available, but that's no longer in the realm of…

You can perform the step in my last paragraph to make it work in those cases. It would come down to introducing 2 new build args, making sure the user you create sets the uid:gid based on these values, defaulting to 1000:1000 so it works for most but allows you to override them by modifying 2 env variables in an .env file (you can configure docker-compose to set the build args with env vars).

If someone has a case where they are doing anything you described the above steps can be implemented in like 5 lines of code and 5 minutes. I didn't add it to my example apps because there's only been 1 or 2 requests for it over multiple years and I've never encountered it once, no one taking my Docker courses has ever hit a road block by it either.

Re: Docker is dead? Podman – an alternative tool?

#118

Post by skrtskrt »

mekster wrote: post #110
lapser wrote: post #85

Earlier quoted context omitted.

It is at least a year or so old. But there have been quite a few bugs, and iirc it was only at v4 where incompatible bugs have been ironed out. Not that it wasn't usable previously, you'd just run into a few issues.

> Not that it wasn't usable previously, you'd just run into a few issues. I don't like that definition of "usable". Compose v2.0 compatibility became available only since last month which was very late. If podman isn't for technical benefit, is this all about political decision for RH to govern container ecosystem on their own instead of dealing with docker?

I can understand the aversion to Red Hat control but the desire to use Podman is obviously arising from the concern about Docker control of the ecosystem.

Re: Docker is dead? Podman – an alternative tool?

#119

Post by eriksjolund »

teekert wrote: post #76
qbasic_forever wrote: post #29

Rootless podman is my first choice for using containers now, it works fantastically well in my experience. It's so much nicer to have all my container related stuff like volumes, configs, the control socket, etc. in my home directory and standard user paths vs. scattered all over the system. Permission issues with bind mounts just totally disappear when you go rootless. It's so much easier and better than the root pr…

Are you saying that all files from your containers are owned by you as user? If so I will start investigating right now. It is so super annoying to download something with nzbget for example and then having to go through sudo to get to your downloaded files. It is indeed my major gripe with my docker compose setup atm. Or just messing with a html file in the nginx docker bind mount, ugh! If podman solves that I’m goi…

The --uidmap and --gidmap options can map your regular user on the host to any specific user inside the container.

These options may look to be a bit complicated to use, but as soon as you understand how rootless Podman maps UIDs and GIDs it will be pretty straight forward.

I wrote two troubleshooting tips about how to use them:

https://github.com/containers/podman/blob/main/troubleshooti...

https://github.com/containers/podman/blob/main/troubleshooti...

Re: Docker is dead? Podman – an alternative tool?

#120

Post by RyEgswuCsn »

gnfurlong wrote: post #98
RyEgswuCsn wrote: post #95

Earlier quoted context omitted.

No it’s not. File written from inside the container into a mounted volume as root will be owned by root outside the container (uid 0, to be specific; doesn’t matter what the user is named). Edit: I might have misunderstood parent, who might be referring to Podman attempting to manage the uid mapping.

The parent comment is still talking about rootless podman (and really just user namespaces). Root in the container is absolutely mapped to the user executing podman outside the container. If it mapped to root outside the container, you could just use podman to create setuid scripts owned by root for very trivial privelege escalation.

Yes I think you are right --- I was mistaken. Docker without the rootless operate in the way I described.
Post reply on HN