Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ditched Docker for Podman

codesmash.dev

Post reply on HN
Print view View original

301–310 of 670 posts

Re: I ditched Docker for Podman

#301

Post by regularfry »

dec0dedab0de wrote: post #195
nickjj wrote: post #67

Earlier quoted context omitted.

A large company who is buying licenses for tools has to deal with this for many different things. Docker is not unique here. An IT department for a company of that size should have ironed out workflows and automated ways to keep tabs on who has what and who needs what. They may also be under various compliance requirements that expect due diligence to happen every quarter to make sure everything is legit from a licen…

It becomes a pain point when the IT team never heard of docker, all new licenses need to be approved by the legal department, and your manager is afraid to ask for any extra budget. Also, I don't want to have to troubleshoot why the docker daemon isn't running every time I need it

I'll see your "IT team never heard of docker" and raise you "security want to ban local containers because they allow uncontrolled binaries onto corporate hardware.". But that's not something podman solves...

Re: I ditched Docker for Podman

#302

Post by dev_l1x_be »

ethagnawl wrote: post #283
dev_l1x_be wrote: post #276

What is the current way of running a dokcer container as a systemd service? Is it podman?

Just create a unit file that starts/stops/restarts/etc. the container.

what do you mean exactly? What is the tool that you invoke? Or you use systemd's container executing ability?

Re: I ditched Docker for Podman

#303

Post by dktalks »

dktalks wrote: post #298
ghrl wrote: post #256

Earlier quoted context omitted.

I use OrbStack too and think it's great software, both for running containers and stuff like having a quick Alpine environment. However, I don't see the point of running Docker within Alpine. Wouldn't that defeat the optimizations they have done? What benefits do you get?

Many docker containers are optimized to run as Alpine on other systems. You get the benefit that it runs on Alpine itself.

edit: [1] https://old.reddit.com/r/docker/comments/e6u2pk/docker_noob_...

Re: I ditched Docker for Podman

#304

Post by galangalalgol »

marcel_hecko wrote: post #279
mixmastamyk wrote: post #268

Earlier quoted context omitted.

Sounds like you need to grant the user sufficient permissions. What else might go wrong?

It's mostly the subgid subuid mapping of ids between guest and host which is non trivial to understand in rootless envs. Add selinux in the mix....

What actual issues do you run into? We have selinux and rootless and I didn't notice the transition from docker as a user.

Re: I ditched Docker for Podman

#306

Post by dktalks »

dktalks wrote: post #299
classified wrote: post #227

Earlier quoted context omitted.

You mean, you let Docker containers run inside the OrbStack container, or how does that work?

No, you don't run the Docker containers run in OrbStack, you can spin up an Alpine instance and run all docker instance on it. The benefit is that, Alpine has access to all your local and network drives so you can use them. You can sandbox them as well. It's not a big learning curve, just a good VM with access to all drives but isolated to local only.

And you can run Docker inside OrbStack too, it is really good. But most of my containers are optimized Alpine containers so I prefer to run them on an OS they were built for and others in OrbStack.

Re: I ditched Docker for Podman

#307

Post by goku12 »

rcarmo wrote: post #100

Sorry, but I tried and just couldn’t get compose and networking to work the way I wanted - as well as permissions, volumes and a lot of other stuff…

Which compose? Podman-compose [1] wasn't fully up to date with the latest compose-spec [2] the last time I checked it. However, the docker-compose v2 [3] (the one in Go, not Python [4]) is compatible with the Podman engine [5] and works like a charm for me.

I have also had no issues with networking, permissions or volumes while running as non-root user. Are you simply facing issues setting it up, or are you hitting some bugs or missing features?

[1] https://github.com/containers/podman-compose

[2] https://compose-spec.io/

[3] https://github.com/docker/compose

[4] https://github.com/docker/compose/tree/v1

[5] https://www.devopsroles.com/how-to-use-docker-compose-with-p...

Re: I ditched Docker for Podman

#308

Post by Insanity »

miki123211 wrote: post #249

I've been dealing with setting up Podman for work over the last week or so, and I wouldn't wish that on my worst enemy. If you use rootless Podman on a Redhat-derived distribution (which means Selinux), along with a non-root user in your container itself, you're in for a world of pain.

We went through an org wide Docker -> Podman migration and it went _relatively_ smooth. Some hiccups along the way but nothing that the SysDev team couldn't overcome.

Re: I ditched Docker for Podman

#309

Post by jwildeboer »

miki123211 wrote: post #249

I've been dealing with setting up Podman for work over the last week or so, and I wouldn't wish that on my worst enemy. If you use rootless Podman on a Redhat-derived distribution (which means Selinux), along with a non-root user in your container itself, you're in for a world of pain.

Sure. Constructing the case to shoot yourself in the foot is not a big problem. But in reality things mostly just work. I’m happily running a bunch of services behind a (nginx) reverse proxy as rootless containers. Forgejo, the forgejo runner to build stuff, uptime-kuma and more on a bunch of RHEL10 machines with SELinux enabled.

Re: I ditched Docker for Podman

#310

Post by regularfry »

dice wrote: post #134
nickjj wrote: post #46

Earlier quoted context omitted.

> On the plus side, any company I work for doesn't have to worry about licences. Win win! Was this a deal breaker for any company? I ask because the Docker Desktop paid license requirement is quite reasonable. If you have less than 250 employees and make less than $10 million in annual revenue it's free. If you have a dev team of 10 people and are extremely profitable to where you need licenses you'd end up paying $9…

> Was this a deal breaker for any company? It is at the company I currently work for. We moved to Rancher Desktop or Podman (individual choice, both are Apache licensed) and blocked Docker Desktop on IT's device management software. Much easier than going through finance and trying to keep up with licenses.

Deal breaker for us too, now in my second org where that's been true.

It's not just that you need a licence now, it's that even if we took it to procurement, until it actually got done we'd be at risk of them turning up with a list of IP addresses and saying "are you going to pay for all of these installs, then?". It's just a stupid position to get into. The Docker of today might not have a record of doing that, but I wouldn't rule out them getting bought by someone like Oracle who absolutely, definitely would.

Post reply on HN