Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker is dead? Podman – an alternative tool?

content.fme.de

Post reply on HN
Print view View original

121–130 of 183 posts

Re: Docker is dead? Podman – an alternative tool?

#121

Post by sureglymop »

znpy wrote: post #55
stingraycharles wrote: post #53

Earlier quoted context omitted.

There’s podman-compose which does what you want, but is a community maintained script. There’s also the ability for podman to run as a system service, and provide an OCI compatible container API. This then integrates seamlessly with the actual docker-compose. See: https://www.redhat.com/sysadmin/podman-docker-compose

You can point the official docker-compose at podman now! I do that! It's 99.999% compatible as the podman people basicaly reimplemented all the docker daemon APIs. It sometimes lags a bit behind, because sometime docker implements new stuff... But for usage with docker-compose it has worked flawlessly for me. EDIT: you can also export the podman unix socket via socat, i also tried it to run a rootless docker runtime…

Wow that sounds amazing! Thanks for the information.

Re: Docker is dead? Podman – an alternative tool?

#122

Post by sureglymop »

lapser wrote: post #84
capableweb wrote: post #74

Earlier quoted context omitted.

How does that work in practice? Podman is changing the permission bits of files that are synced between the host and the container? If I create a file with certain permission bits in the container, I'd expect the file to be 100% identical when pulling it over to the host, but maybe that's just "legacy" thinking coming from my docker experience? What about copying files directly between containers, would that change t…

The permissions (rwx) don't change, but the uid/gid is mapped. E.g. uid 0 is the running user outside the container, by uid 1 will be mapped to 100000 (configurable), and say 5000 inside the container is mapped to 105000. I don't remember the exact mapping but it works roughly like that.

Oh, that sounds great! Thank you, that was the information i wanted.

Re: Docker is dead? Podman – an alternative tool?

#123

Post by lesam »

bornfreddy wrote: post #116
smarx007 wrote: post #96

How did the intro get so many things wrong?! 1. Mirantis did not acquire Docker Inc., they only bought Docker Enterprise. See https://techcrunch.com/2019/11/13/mirantis-acquires-docker-e... and https://www.docker.com/blog/docker-enterprise-edition/ 2. k8s didn't remove dockershim for political reasons but because containerd was refactored out of Docker long time ago and k8s wanted to get rid of the extra layer. See h…

Also: > Instead of free use of Docker Desktop until now, this software suite is now available for rent after the transition phase until the end of January 2022, starting at $5 per user/month, provided it is for professional use. > Here, Docker Desktop includes the Docker Engine, docker-cli, docker-compose and a credential helper, among others. At least docker-compose (and probably also docker service + cli, since it…

Yeah, the main benefit of docker desktop is packaging up a nice Linux VM on Mac/Windows, plus some UI features. There’s a reason ’Docker Desktop for Linux’ came so much later.

Re: Docker is dead? Podman – an alternative tool?

#124

Post by skrtskrt »

mekster wrote: post #112
jdoss wrote: post #39

I only use Podman for my workloads these days. Docker was always a headache for me on Linux. Podman allows me to quickly do whatever I want with containers and I can use systemd or a simple bash script to easily create services on my workstation or in production with Nomad with https://github.com/hashicorp/nomad-driver-podman I am super thankful for the team of developers that work on Podman. It has really come a lon…

What were the headaches?

Not the poster, but I have to reboot at least one a day to clear up Docker networking/DNS gremlins.

I thought moving to Linux from Mac would make Docker better due to the lower resource usage but I would guess the fact that it’s isolated in a VM in Mac is why I never had network issues there

Re: Docker is dead? Podman – an alternative tool?

#125

Post by slim »

forty wrote: post #106
stingraycharles wrote: post #99

Earlier quoted context omitted.

> The rate limits were mostly in place to deny corporate CI users access to the Hub free of charge and force them to pay or deploy a mirror. What I never understood is why they didn’t just properly handle this with mirrors like any package manager does; why is this a problem for docker, but not for yum / apt / etc? I have to admit that these rate limits have accelerated my migration to alternatives like quay.io

By default container images are not signed (there is notary, but it's not commonly used - maybe notary V2 will change that - and I think the signature changes depending on the registry it's hosted on anyway?) which make it inconvenient to mirror. Now, why are we still producing new package formats without mandatory signatures (containers, npm, cargo, etc) is not really clear to me. I guess everyone must think "those…

There's also the conspiracy : "it's the CIA who infiltrated docker to get access on every server in the world" ;)

Re: Docker is dead? Podman – an alternative tool?

#126

Post by the8472 »

phoronixrly wrote: post #90
the8472 wrote: post #64

Earlier quoted context omitted.

The problem with rootless is that you don't get a native network stack since setting up bridges and veth devices still requires some elevated capabilities. But instead of running full root this could be outsourced to a helper executable with some caps set (a narrower version of suid). > Permission issues with bind mounts just totally disappear when you go rootless. Recent kernel versions have gained uid mapping capab…

TBH I don't want to expose the native network stack to containers

If your concern is kernel attack surface then I have bad news for you. Inside the container's network namespace it's still using standard syscalls. Only on the host side it takes a detour through userspace. So you get all the downsides, none of the native performance and very few upsides. It only benefits firewalls that still assume a machine has a single network interface without bridging/natting/forwarding.

Re: Docker is dead? Podman – an alternative tool?

#128

Post by zamalek »

jordemort wrote: post #11

Why not both? Since Podman 4.1 came out with full Compose 2.x compatibility, I'm running Podman on Docker's socket, but using Docker's CLI to talk to it, so that I can use the buildx and compose CLI plugins. It works great, Docker's CLI doesn't seem to have any clue that it's talking to not-Docker. I even have VSCode's Docker extension and Remote Containers working this way.

On my system I have a very small `docker` script that selectively calls either `podman` or `buildah bud` depending on the first arg. The CLIs are completely compatible.

Re: Docker is dead? Podman – an alternative tool?

#129

Post by zamalek »

iknownothow wrote: post #40

It's okay to stick with Docker if it works for us right? There's nothing fundamentally wrong with it right? At the moment Podman is just more work for us because I and other devs don't have years of of experience and intuitions about Podman like we have with Docker. I'd rather just focus on business problems rather than another migration.

If you're using it commercially, you are licensed right?

Re: Docker is dead? Podman – an alternative tool?

#130

Post by BossingAround »

mekster wrote: post #107
gigatexal wrote: post #23

Earlier quoted context omitted.

Wow did not know about full compose support going to check it out now.

That took a while... Although I don't see what benefit I get by going podman when docker works fine and I don't really care about theoretical rootless security enhancement.

Can I use Docker on my company projects, or can I use it for personal use only? I was under the impression that Docker doesn't allow professional use with the unpaid license, though I might have gotten it wrong.
Post reply on HN