Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ditched Docker for Podman

codesmash.dev

Post reply on HN
Print view View original

311–320 of 670 posts

Re: I ditched Docker for Podman

#311

Post by dathinab »

rsyring wrote: post #262
dathinab wrote: post #255

Earlier quoted context omitted.

> Why wouldn't Podman make installing it easier? What else can they do then having a package for every distro? https://podman.io/docs/installation#installing-on-linux Including instructions to build from source (including for Debian and Ubuntu): https://podman.io/docs/installation#building-from-source I don't know about this specific case but Debian and or Ubuntu having outdated software is a common Debian/Ubuntu pro…

> What else can they do... They can do what Docker and many other software providers do that are committed to cross OS functionality. They could build packages for those OSes. Example: https://docs.docker.com/engine/install/ubuntu/#install-using... The install instructions you link to are relying on the OS providers to build/package Podman as part of their OS release process. But that is notoriously out-of-date. You…

> build/package Podman as part of their OS release process. But that is notoriously out-of-date.

providing duplicate/additional non official builds for other OS is

- undermining the OSes package curation

- confusing for the user

- cost additional developer time, which for most OSS is fairly limited

- for non vendorable system dependencies this additional dev time cost can be way higher in all kinds of surprising ways

- obfuscate if a Linux distro is in-cable of properly maintaining their packages

- lead to a splitting of the target OS specific eco system of software using this as a dependency

etc.

it's a lose lose lose for pretty much everyone involved

so as long as you don't have a have a monetary reason that you must do it (like e.g. docker has) it's in my personal opinion a very dump thing to do

I apologize for being a bit blunt but in the end why not use a Linux distribution which works with modern software development cycles?

Blaming others for problems with the OS you decided to use when there are alternatives seems not very productive.

Re: I ditched Docker for Podman

#312

Post by dakiol »

k4rli wrote: post #143
nickjj wrote: post #46

Earlier quoted context omitted.

> On the plus side, any company I work for doesn't have to worry about licences. Win win! Was this a deal breaker for any company? I ask because the Docker Desktop paid license requirement is quite reasonable. If you have less than 250 employees and make less than $10 million in annual revenue it's free. If you have a dev team of 10 people and are extremely profitable to where you need licenses you'd end up paying $9…

Docker Desktop is also (imo) useless and helps be ignorant. Most Mac users I see using it struggle to see the difference between "image" and "container". Complete lack of understanding. All the same stuff can easily be done from cli.

I cannot run docker in macos without docker desktop. I use the cli to manage images, containers, and everything else.

Re: I ditched Docker for Podman

#313

Post by strbean »

marcel_hecko wrote: post #279
mixmastamyk wrote: post #268

Earlier quoted context omitted.

Sounds like you need to grant the user sufficient permissions. What else might go wrong?

It's mostly the subgid subuid mapping of ids between guest and host which is non trivial to understand in rootless envs. Add selinux in the mix....

> subgid subuid mapping

trigger warning please D:

Re: I ditched Docker for Podman

#314

Post by znpy »

goku12 wrote: post #295
prmoustache wrote: post #275

Earlier quoted context omitted.

How so? I have been using exlusively podman on Fedora for the most part of the last 7 years or so.

That surprises me too. Podman is spearheaded by Redhat and Fedora/RHEL was one of the earliest distros to adopt it and phase out docker. Why wouldn't they have the selinux config figured out?

They have.

Most likely gp is having issues with volumes and hasn’t figured out how to mix the :z and :Z attribute to bind mounts. Or the containers are trying to do something that security-wise is a big no-no.

In my experience SELinux defaults have been much wiser than me and every time i had issues i ended up learning a better way to do what i wanted to do.

Other than that… it essentially just works.

Re: I ditched Docker for Podman

#315

Post by znpy »

miki123211 wrote: post #249

I've been dealing with setting up Podman for work over the last week or so, and I wouldn't wish that on my worst enemy. If you use rootless Podman on a Redhat-derived distribution (which means Selinux), along with a non-root user in your container itself, you're in for a world of pain.

Your issue is selinux then, not podman. It’s not correct to blame it on podman.

Re: I ditched Docker for Podman

#316

Post by cduzz »

radlad wrote: post #239
k4rli wrote: post #143

Earlier quoted context omitted.

Docker Desktop is also (imo) useless and helps be ignorant. Most Mac users I see using it struggle to see the difference between "image" and "container". Complete lack of understanding. All the same stuff can easily be done from cli.

I don't believe it's possible to run Docker on macOS without Docker Desktop (at least not without something like lima.) AFAIUI, Docker Desktop contains not just the GUI, but also the hypervisor layer. Is my understanding mistaken?

It's pretty easy to run docker on macos -- colima[1] is just a brew command away...

It runs qemu under the hood if you want to run x86 (or sparc or mips!) instead of arm on a newer mac.

[1]https://formulae.brew.sh/formula/colima

Re: I ditched Docker for Podman

#317

Post by codethief »

> With Podman, even if someone somehow escalates privileges inside a container to root level, they're still just an unprivileged user on the actual host.

As much as I like Podman (and I really do), Docker has supported rootless mode for a long time and it's not any harder to set up than Podman.

> Use podman-compose as a drop-in replacement

Oh, if only it were a drop-in replacement. There are so many ways in which it is not exactly compatible with docker-compose, especially when it comes to the network setup. I have wasted more hours on this than I can count.

Re: I ditched Docker for Podman

#318

Post by fernandotakai »

nickthegreek wrote: post #88
t43562 wrote: post #38

Earlier quoted context omitted.

On Mac we just switched to podman and didn't have anything to worry about.

Anyone have opinions on OrbStack for mac over these other alternatives?

orbstack is absolutely amazing. not only the docker side works much better than docker desktop but their lightweight linux vms are just beyond great.

i've been using an archlinux vm for everything development over the past year and a half and i couldn't be happier.

Re: I ditched Docker for Podman

#319

Post by BinaryIgor »

I certainly like demon-less architecture; much simpler and there are less potential security issues and no single point of failure.

The one thing I don't necessarily agree:

"Privileged ports in rootless mode not working? Good! That's security working as intended. A reverse proxy setup is a better architecture anyway."

I usually use Ngix as a reverse proxy - why not have it set up in the exact same way as the rest of your apps? That's a simplicity advantage. So with Podman, I would just run this one exact container in root mode - that's still better than all of them, but quite.

I am not a fan of docker-compose - a classic example of a tool trying to do too much for me, so the lack of something similar in Podman is not a drawback for me :)

Not sure about tooling around logs and monitoring though - there is plenty for Docker.

Post reply on HN