Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quadlets might make me finally stop using docker-compose

major.io

Post reply on HN
Print view View original

131–140 of 212 posts

Re: Quadlets might make me finally stop using docker-compose

#131

Post by vimax »

contravariant wrote: post #73

> you’ll see a WantedBy line. This is a great place to set up container dependencies. In this example, the container that runs caddy (a web server) can’t start until Wordpress is up and running. Either this must be some systemd weirdness that I thankfully haven't had to deal with until now, or I'm misunderstanding something. Did I understand correctly you don't specify which services you need but rather which ones de…

Systems scans all of the unit files initially, and topologically sorts them to find the best start ordering for all services. Unit files are rescanned only when you run systems daemon-reload.

One of its main design goals is a fast system startup, to do that it does need know the dependency ordering of all services.

Re: Quadlets might make me finally stop using docker-compose

#132

Post by dbrgn »

patrec wrote: post #88
dathinab wrote: post #82

Earlier quoted context omitted.

> Is software supposed to update without administrator supervision yes proper CI is a thing, and containers not being updated is actually quite a bit of an issue in the current software industry especially if combined with custom registries auto update is quite a neet thing oh also it's a SystemD feature to let SystemD manage your containers so why are you asking if it works without SystemD?

Updating your custom registry with new upstream dep versions after testing in CI with the all services you care about is fine. But the OP seems to just blindly pull the newest wordpress images from upstream or am I missing something? How is this meant to work reliably? I guess given wordpress's security record taking breaking your site from time to time is preferable to your site being broken into from time to time.

I think you're mixing up some things. If you run the image "docker.io/wordpress:6.3.1", then the container will be updated when the image with that tag (6.3.1) is being re-built (which is a best practice, because that's the only way how you get security updates for the libraries in the base image). The tag is just a pointer to the latest image hash.

Many Docker images also provide "semantic version tags". Wordpress does too, so if you run the image "docker.io/wordpress:6.3", you will get the latest 6.3.x version.

It's up to you (and the image publisher) to decide when to auto-update, and when manual intervention is necessary.

Of course this requires trusting the publisher of that image. But even if you build your own images, you still trust the base image. It's turtles all the way down.

Re: Quadlets might make me finally stop using docker-compose

#133

Post by [deleted] »

whalesalad wrote: post #129
fariszr wrote: post #127

I don't see how this is anything like compose. With quadlets you have to create a file for each container and deal with creating volumes and so on. Whereas with Docker it's one file, one command and you're done, you don't have to deal with anything else.

For anything other than a hello world type project a compose file will fall over kinda quick. I would much prefer to (ahem) compose smaller things together and systemd is great for that.

[deleted]

Re: Quadlets might make me finally stop using docker-compose

#134

Post by dbrgn »

aorth wrote: post #76
v3ss0n wrote: post #46

Earlier quoted context omitted.

What worse is , it screws up the firewall rules. Podman avoid that so , quadlets should be fine? Podman supposed to be drop-in replacement for docker but - last try (4 months ago) of podman to run our development docker containers fails to build so i think Podman is still far away from docker replacement.

> What worse is , it screws up the firewall rules. Yes! And it has a hard dependency on iptables, which I have removed from all my servers long ago in favor of nftables. Grrrrrr.

That's not the case (anymore). I run a NixOS based router with nftables (no iptables installed at all), and podman works just fine. It simply adds its NAT rules to nftables (unless you tell it not to).

As far as I know, this was introduced with the new networking stack (netavark).

Re: Quadlets might make me finally stop using docker-compose

#135

Post by rastapasta42 »

whalesalad wrote: post #129
fariszr wrote: post #127

I don't see how this is anything like compose. With quadlets you have to create a file for each container and deal with creating volumes and so on. Whereas with Docker it's one file, one command and you're done, you don't have to deal with anything else.

For anything other than a hello world type project a compose file will fall over kinda quick. I would much prefer to (ahem) compose smaller things together and systemd is great for that.

Lolol have been running compose in dev & prod for 7 years - still the best tool around.

Re: Quadlets might make me finally stop using docker-compose

#136

Post by Riverheart »

whalesalad wrote: post #129
fariszr wrote: post #127

I don't see how this is anything like compose. With quadlets you have to create a file for each container and deal with creating volumes and so on. Whereas with Docker it's one file, one command and you're done, you don't have to deal with anything else.

For anything other than a hello world type project a compose file will fall over kinda quick. I would much prefer to (ahem) compose smaller things together and systemd is great for that.

In what way? Docker-compose files are composable. I can specify several compose files that layer functionality or have different behavior and tie it together with make. You can also set defaults and override with environment variables using bash syntax.

Re: Quadlets might make me finally stop using docker-compose

#137

Post by alexlarsson »

INTPenis wrote: post #101
runiq wrote: post #91

Earlier quoted context omitted.

Nah, we got that already. Quadlet can handle k8s manifests. https://man.archlinux.org/man/quadlet.5.en#Kube_units_%5BKub...

Yes but when is someone going to add logic on top of this to make it a full blown distributed container orchestrator? Could it be done with systemd and dbus? Can dbus be distributed among several systems like mmc on Windows? I have no idea, just some questions that popped into my head lately.

https://github.com/containers/bluechi

Re: Quadlets might make me finally stop using docker-compose

#138

Post by all2 »

whalesalad wrote: post #129
fariszr wrote: post #127

I don't see how this is anything like compose. With quadlets you have to create a file for each container and deal with creating volumes and so on. Whereas with Docker it's one file, one command and you're done, you don't have to deal with anything else.

For anything other than a hello world type project a compose file will fall over kinda quick. I would much prefer to (ahem) compose smaller things together and systemd is great for that.

I've been kinda partial to helm charts (on a k8s cluster). Standing up services is not awful. Have you used helm or similar? What do you think of these kind of tools?

Re: Quadlets might make me finally stop using docker-compose

#139

Post by jacooper »

misnome wrote: post #130
jacooper wrote: post #66

Earlier quoted context omitted.

Docker has native rootless support. But networking is a joke like podman.

FWIW podman 4's netavark has solved most of the pain points I encountered with podman's rootless networking. Containers can actually find each other now.

Does it propagate source IPs now? Both IPv4 and IPv6

Re: Quadlets might make me finally stop using docker-compose

#140

Post by alexlarsson »

toyg wrote: post #89
contravariant wrote: post #73

> you’ll see a WantedBy line. This is a great place to set up container dependencies. In this example, the container that runs caddy (a web server) can’t start until Wordpress is up and running. Either this must be some systemd weirdness that I thankfully haven't had to deal with until now, or I'm misunderstanding something. Did I understand correctly you don't specify which services you need but rather which ones de…

I think it's a bit of a Podman quirk. From what I understand, podman used (and is probably still able) to generate systemd .service files. These files do have Requires and After commands, to state which other services they expect. However, Podman has since moved to using the .container file for systemd "units", which was meant to represent an transient , disposable instance but in practice reproduces a lot of what .s…

This are standard systemd service file syntax and standard systemd directives. Quadlet forwards everything but the [container] section directly to the generated service file.
Post reply on HN