Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transitioning from Docker to Podman

developers.redhat.com

Post reply on HN
Print view View original

221–230 of 278 posts

Re: Transitioning from Docker to Podman

#221

Post by SEJeff »

aruggirello wrote: post #188
dariusj18 wrote: post #152

Earlier quoted context omitted.

I think governments prefer redhat because they are consistent and they accept gobs of cash to promise security patches to software that are past their support window.

I don't know about the gobbles of cash, but I'm pretty sure Canonical supports Ubuntu releases way past EOL for paying customers - they call it the ESM (Extended Security Maintenance), which 'provides important security fixes for the kernel and the most essential user space packages in Ubuntu'.

Depends on your definition of support I suppose. Redhat employs so many more low level engineers they can generally get you a z stream patch or something to fix a legitimate bug. Canonical is an exceptional marketing company, but I've found their engineering to be lacking when it comes to enterprise. As someone who's worked as a linux monkey for companies who pay Canonical for support and for companies who pay Redhat for support, I've always found the Redhat support to actually solve the root cause. When we filed what we thought were legitimate bugs with Canonical, the common response was just to "upgrade to the latest version of Ubuntu". When we asked them to confirm that doing so actually fixed our problems we just got crickets.

Re: Transitioning from Docker to Podman

#222

Post by coldtea »

tannhaeuser wrote: post #191
zelly wrote: post #126

It's compatible with cgroups v2 unlike the standard Docker. If you're using Fedora, you have to add a kernel parameter to Grub to use cgroups v1 instead. RedHat seems to be pushing a standard ecosystem for Linux: systemd, Wayland, SELinux, GNOME, and now maybe podman. I've been on Linux for a while; it's a welcome change from all the fragmentation I'm used to. Whereas others try to work around the kernel and implemen…

> RedHat just goes with what Linux already has More like, Redhat/IBM defines what Linux has simply by paying most Linux devs, and of course they take advantage of it in userspace and sys management. cgroups/namespaces, systemd, gnome (and it's integration with systemd) plus others are two-sided swords: one one hand they create new functionality, but on the other hand the price to pay is concentrating Linux know-how i…

>and greatly diminishing portability of Linux apps vs other Unix O/Ses

Thank's god for that! An OS should build on its strenghts, not be a least common demoninator for portabillity's sake. If that was ok we might just as well just use one OS

Re: Transitioning from Docker to Podman

#224

Post by coldtea »

choeger wrote: post #29
ranadeep wrote: post #22

At my company, we run our CI/CD (Jenkins) using the Docker-in-Docker paradigm to facilitate easy maintainability of the CI itself and allow us to run containerized builds. When we shifted to RHEL 8, we attempted to move this over to Podman and it went miserably (this was back in November 2019). The main reason being is that podman-in-podman doesn't work and had bugs (at least back in Nov 2019). Maybe it fixed now but…

Maybe you are just too far into docker. I noticed that a lot of default workflows (needlessly) depended on docker running with privileges. One big reason for that seem to be Mac users that only know docker from inside a VM. However, if you think about what you're really needing for CI you will easily see that docker-in-docker gains you nothing. You can as well use plain docker (or podman). The same holds for privileg…

>One big reason for that seem to be Mac users that only know docker from inside a VM

That has not been the case for a good while now... Docker has been running directly on a hypervisor on the Mac.

Re: Transitioning from Docker to Podman

#225

Post by bogomipz »

wwright wrote: post #118
bogomipz wrote: post #108

Earlier quoted context omitted.

Your CI server running in a container that is itself executing Docker commands.

As mentioned elsewhere in the thread, this does not require DinD. You can connect to the host’s Docker daemon. (Other interfaces such as K8S are also much safer.)

Yes and I am one of those people who mentioned elsewhere that this does not require DinD. Please reread the question I am actually responding to which is a general questions "What kinds of tasks ...?" The parent is asking what 'problem is the DinD solution is solving for. You also can not connect to the host's Docker socket if you do not manage that host where Docker is running in the first place.

Re: Transitioning from Docker to Podman

#226

Post by bogomipz »

hinkley wrote: post #151
wwright wrote: post #118

Earlier quoted context omitted.

As mentioned elsewhere in the thread, this does not require DinD. You can connect to the host’s Docker daemon. (Other interfaces such as K8S are also much safer.)

Isn't exposing the host Docker daemon the security issue that people grouse about?

Yes it is. The Docker socket - /var/run/docker.sock is owned by root and so anyone that has access to it effectively has root on that host. User namespace mitigate this to some degree.

Re: Transitioning from Docker to Podman

#227

Post by Nullabillity »

sofixa wrote: post #215
ryan29 wrote: post #161

Earlier quoted context omitted.

I tried kaniko and didn't like it. Having build and push as part of the same job is frustrating and I view it as a sign that a CI system is built with the expectation of having everything happen post commit by shoveling money into a CI auto-scaler. I know there's `--no-push`, but that's a poor substitute for independent `build`, `tag`, `push` build steps IMO. Do you have any way of running / debugging locally with Gi…

> Having build and push as part of the same job is frustrating and I view it as a sign that a CI system is built with the expectation of having everything happen post commit by shoveling money into a CI auto-scaler No, the idea is to build and push images you can test directly afterwards in the same conditions. With cache and such, build times shouldn't be too long Gitlab CI just runs shell commands, it's pretty triv…

> Gitlab CI just runs shell commands, it's pretty trivial to pull the same image its using in the job, and run the same commands locally.

In fact, they already provide a utility for doing this: gitlab-runner exec[0].

[0]: https://docs.gitlab.com/runner/commands/#gitlab-runner-exec

Re: Transitioning from Docker to Podman

#228

Post by bonzini »

qiqitori wrote: post #80

Assuming that it's Red Hat's fault that there is no el8 package for Docker, I think Red Hat is really shooting themselves in the foot by not supporting Docker in RHEL8. (You can still install the el7 version of Docker on el8 by performing an enable/disable/enable/disable/... module dance, but... why isn't there just an el8 version?)

Red Hat ships podman for RHEL8, that's what the article is about.

Re: Transitioning from Docker to Podman

#229

Post by edwintorok »

If you are running podman rootless it will use the fuse-overlayfs driver which comes with various limitations and is much slower than Docker:

* you are limited to 1024 FDs for your entire container. So running make -j40 usually ends up with various errors due to running out of file descriptors. You can of course raise the limit for your own user, but this may not be trivial on a shared system.

* getting podman to obey a raised user FD limit is non-trivial on CentOS 8. podman is not well supported on CentOS, you need latest Fedora if you want the various bugs/limitations fixed.

* fuse-overlayfs is a single process for the entire container and quickly becomes the bottleneck for any IO intensive operation (e.g. don't try running AFL inside podman, it'll be way too slow and peg the CPU at 99% running fuse-overlayfs).

Fuse shouldn't be necessary though if I could just give it access to the files that my user has access to (of course you'd loose the snapshotting/committing ability), perhaps using -v would improve performance?

Using docker on CentOS 7 was a lot easier (and faster) than using podman on CentOS 8.

Re: Transitioning from Docker to Podman

#230

Post by tssva »

dariusj18 wrote: post #152
zelly wrote: post #126

It's compatible with cgroups v2 unlike the standard Docker. If you're using Fedora, you have to add a kernel parameter to Grub to use cgroups v1 instead. RedHat seems to be pushing a standard ecosystem for Linux: systemd, Wayland, SELinux, GNOME, and now maybe podman. I've been on Linux for a while; it's a welcome change from all the fragmentation I'm used to. Whereas others try to work around the kernel and implemen…

I think governments prefer redhat because they are consistent and they accept gobs of cash to promise security patches to software that are past their support window.

Governments also prefer Redhat because they early on and continuing today have shown a commitment to the market by investing in getting their products certified to meet government required standards including developing the required capabilities when not already available in the Linux ecosystem, developing documentation and software to assist deploying systems in a manner consistent with government security requirements and participating in conferences, working groups, interoperability tests and other government targeted or sponsored forums.

Some other Linux vendors now also do so but started much later and even now do so to a much lesser degrees.

Post reply on HN