Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ditched Docker for Podman

codesmash.dev

Post reply on HN
Print view View original

111–120 of 670 posts

Re: I ditched Docker for Podman

#111

Post by matesz »

Hizonner wrote: post #104

I don't know how podman compares to docker in terms of performance, and I do know that rootless containers can be a real pain. But Docker is simply a non-starter. It's based on a highly privileged daemon with an enormous, hyper-complicated attack surface. It's a fundamentally bad architecture, and as far as I've been able to tell, it also comes from a project that's always shown an "Aw, shucks" attitude toward securi…

Rootless containers are a pain but only on mac, otherwise it’s just pure upside.

Re: I ditched Docker for Podman

#112

Post by catlifeonmars »

hallway_monitor wrote: post #96
politelemon wrote: post #73

Earlier quoted context omitted.

Use an LLM is not a solution. It's effectively telling you to switch your brain off and hope nothing goes wrong in the future. In reality things do go wrong and any conversation should be done with a good understanding of the system involved.

While I agree with this concept, I don't think it is applicable here. Docker compose files and k8s yaml are basically just two different syntaxes, saying the same thing. Translating from one syntax to another is one of the best use cases for an LLM in my opinion. Like anything else you should read it and understand it after the machine has done the busy work.

I bet there’s already a conversion library for it. Translating from one syntax to another _reliably_ should be done with a dedicated library. That being said, I don’t disagree that using an LLM can be helpful to generate code to do the same.

Re: I ditched Docker for Podman

#113

Post by iainmerrick »

xhrpost wrote: post #55
Izmaki wrote: post #31

Earlier quoted context omitted.

None of your companies need to worry about licenses. Docker ENGINE is free and open source. Docker DESKTOP is a software suite that requires you to purchase a license to use in a company. But Docker Engine, the core component which works on Linux, Mac and Windows through WSL2, that is completely and 1000% free to use.

From the official docs: >This section describes how to install Docker Engine on Linux, also known as Docker CE. Docker Engine is also available for Windows, macOS, and Linux, through Docker Desktop. https://docs.docker.com/engine/install/ I'm not an expert but everything I read online says that Docker runs on Linux so with Mac you need a virtual environment like Docker Desktop, Colima, or Podman to run it.

If you're already paying for Macs, is paying for Docker Desktop really a big problem?

Re: I ditched Docker for Podman

#114

Post by cpuguy83 »

kdumont wrote: post #4

Both podman and docker have pretty poor error handling in my experience. It depends on the error, but for me it often comes down to a docker compose misconfiguration, resource, permissions, etc. In docker always find the errors quite difficult to trace back to root cause. In podman you get a python a stack trace. I wish both projects would assert different assumptions/requirements at runtime and report errors/warning…

Do you have an example?

Re: I ditched Docker for Podman

#115

Post by tannhaeuser »

me: great can target POSIX for stuff

them: not so fast here's glib

me: great can use debian for stuff

them: not so fast, here's rpm

me: great can use docker for "abstracting" over Linux diversity

them: not so fast, here's podman

Re: I ditched Docker for Podman

#116

Post by Cyph0n »

stingraycharles wrote: post #19
raquuk wrote: post #5

The "podman generate systemd" command from the article is deprecated. The alternative are Podman Quadlets, which are similar to (docker-)compose.yaml, but defined in systemd unit files.

Which actually makes a lot of sense, to hand over the orchestration / composing to systemd, since it’s not client server API calls (like with docker) anymore but actual userland processes.

Yep. It works even better on a declarative distro like NixOS because you can define and extend your systemd services (including containers) from a single config.

Taking this further (self-plug), you can automatically map your Compose config into a NixOS config that runs your Compose project on systemd!

https://github.com/aksiksi/compose2nix

Re: I ditched Docker for Podman

#117

Post by privatelypublic »

diarrhea wrote: post #60

One challenge I have come across is mapping multi-UID containers to a single host user. By default, root in the container maps to the user running the podman container on the host. Over the years, applications have adopted patterns where containers run as non-root users, for example www-data aka UID 33 (Debian) or just 1000. Those no longer map to your own user on the host, but subordinate IDs. I wish there was an ea…

Have you looked at idmapped mounts? I don't think it'll fix everything (only handles FS remapping, not kernel calls that are user permissioned)

Re: I ditched Docker for Podman

#118

Post by fkyoureadthedoc »

nickjj wrote: post #46
t43562 wrote: post #21

To provide 1 contrary opinion to all the others saying they have a problem: Podman rocks for me! I find docker hard to use and full of pitfalls and podman isn't any worse. On the plus side, any company I work for doesn't have to worry about licences. Win win!

> On the plus side, any company I work for doesn't have to worry about licences. Win win! Was this a deal breaker for any company? I ask because the Docker Desktop paid license requirement is quite reasonable. If you have less than 250 employees and make less than $10 million in annual revenue it's free. If you have a dev team of 10 people and are extremely profitable to where you need licenses you'd end up paying $9…

At my job going through procurement for something like Docker Desktop when there are free alternatives is not worth it.

It takes forever, so long that I'll forget that I asked for something. Then later when they do get around to it, they'll take up more of my time than it's worth on documentation, meetings, and other bullshit (well to me it's bullshit, I'm sure they have their reasons). Then when they are finally convinced that yes a Webstorm license is acceptable, they'll spend another inordinate amount of time trying to negotiate some deal with Jetbrains. Meanwhile I gave up 6 months ago and have been paying the $5 a month myself.

Re: I ditched Docker for Podman

#119

Post by firesteelrain »

kordlessagain wrote: post #109
firesteelrain wrote: post #49

Earlier quoted context omitted.

Podman is inside the Ubuntu WSL image. No need for docker at all

This is not correct, at least when looking at my screen: (base) kord@DESKTOP-QPLEI6S:/mnt/wsl/docker-desktop-bind-mounts/Ubuntu/37c7f28..blah..blah$ podman Command 'podman' not found, but can be installed with: sudo apt install podman

Hmm maybe it’s what our admins provided to us then. I actually have never run it at home only airgapped

Re: I ditched Docker for Podman

#120

Post by devjab »

sc68cal wrote: post #66
tomrod wrote: post #2

Most of my containers end up on k8s clusters as pods. What else would one use podman or docker for beyond local dev or maybe running a local containerized service?

Someone has to manage your kubernetes environment. Depending on the nature of your workload, it may not be worth running kubernetes and instead just run everything via podman on your hosts. It really depends on how much investment you have in Kubernetes YAMLs.

I suspect a lot of places pour them into Azure Kubernetes Services and Azure Container Apps for this exact reason. I assume other cloud provices have similar services.

Though as someone who's used a lot of Azure infrastructure as code with Bicep and also done the K8s YAML's I'm not sure which is more complicated at this point to be honest. I suspect that depends on your k8s setup of course.

Post reply on HN