Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ditched Docker for Podman

codesmash.dev

Post reply on HN
Print view View original

361–370 of 670 posts

Re: I ditched Docker for Podman

#361

Post by chrisweekly »

elliottr1234 wrote: post #176
jbverschoor wrote: post #25

Earlier quoted context omitted.

vs $11 for docker? blech

Honestly just the debug shell alone is worth a good amount of $. You can remotely run shell commands on your deployed docker container and install packages that are not available in the base image without modifying the base image which can be a life saver. https://docs.orbstack.dev/features/debug Let alone the local resource monitor, increased, performance, automated local domains (no more complicated docker network…

it does sound pretty compelling

Re: I ditched Docker for Podman

#362

Post by madeofpalk »

rglover wrote: post #322

I may be the odd man out, but after getting unbelievably stressed out by containers, k8s, etc., I couldn't believe how zen just spinning up a new VPS and bootstrapping it with a bash script was. That combined with systemd scripts can get you relatively far without all of the (cognitive) overhead. The best part? Whenever there's an "uh oh," you just SSH in to a box, patch it, and carry on about your business.

> you just SSH in to a box, patch it

Oh god. I can’t imagine how I could build reliably software if this is what I was doing. How do you know what “patches” are needed to run your software?

Re: I ditched Docker for Podman

#364

Post by gm678 »

ThatMedicIsASpy wrote: post #355
miki123211 wrote: post #249

I've been dealing with setting up Podman for work over the last week or so, and I wouldn't wish that on my worst enemy. If you use rootless Podman on a Redhat-derived distribution (which means Selinux), along with a non-root user in your container itself, you're in for a world of pain.

SELinux has good errors and all I usually need is :z and :Z on mounts

Can confirm, have been doing exactly what GP says is a world of pain with no problems as soon as I learned what `:z` and `:Z` do and why they might be needed.

A good reference answer: https://unix.stackexchange.com/questions/651198/podman-volum...

TL;DR: lowercase if a file from the host is shared with a container or a volume is shared between multiple containers. Uppercase in the same scenario if you want the container to take an exclusive lock on the volumes/files (very unlikely).

Re: I ditched Docker for Podman

#365

Post by unethical_ban »

leoc wrote: post #77

To bikeshed a little, "Why I Ditched Docker for Podman, And Why You Should Too" would be better than the current headline of "Why I Ditched Docker for Podman (And You Should Too)": the "you should too" part is after all the main message of the article, not a side-point.

The HN title was altered from the exact title to a modified title that changes the meaning. I don't understand why.

Re: I ditched Docker for Podman

#366

Post by oooyay »

Aurornis wrote: post #233
nickjj wrote: post #67

Earlier quoted context omitted.

A large company who is buying licenses for tools has to deal with this for many different things. Docker is not unique here. An IT department for a company of that size should have ironed out workflows and automated ways to keep tabs on who has what and who needs what. They may also be under various compliance requirements that expect due diligence to happen every quarter to make sure everything is legit from a licen…

> An IT department for a company of that size should have ironed out workflows and automated ways to keep tabs on who has what and who needs what. They may also be under various compliance requirements that expect due diligence to happen every quarter to make sure everything is legit from a licensing perspective. Correct, but every additional software package and each additional license adds more to track. Every new…

> Correct, but every additional software package and each additional license adds more to track.

This is going to differ company to company but since we're narrowing it to large companies I disagree. Usually there's a TPM that tracks license distribution and usage. Most companies provide that kind of information as part of their licensing program (and Docker certainly does.)

> Every new software license requires legal to review it.

Yes, but this is like 90% of what legal does - contract review. It's also what managers do but more on the negotiation end. Most average software engineers probably don't realize it but a lot of cloud services, even within a managed cloud provider like AWS, require contract and pricing negotiation.

> These centralized departments add up all of the license and SaaS costs and it shows up as one big number, which executives start pushing to decrease. When you let everyone get a license for everything they might need, it gets out of control quickly (many startups relearn this lesson in their growth phase)

As I said earlier, I can't speak for other companies but at large companies I've worked at this just simply isn't true. There's metrics for when the software isn't being used because the corporation is financially incentivized to shrink those numbers or consolidate on software that achieves similar goals. They're certainly individually tracked fairly far up the chain even if they do appear as a big number somewhere.

Re: I ditched Docker for Podman

#367

Post by johannes1234321 »

0cf8612b2e1e wrote: post #282
dec0dedab0de wrote: post #195

Earlier quoted context omitted.

It becomes a pain point when the IT team never heard of docker, all new licenses need to be approved by the legal department, and your manager is afraid to ask for any extra budget. Also, I don't want to have to troubleshoot why the docker daemon isn't running every time I need it

I have personally given up trying to get a $25 product purchased through official channels. The process can make everything painful.

Congrats, the process fulfilled it's purpose. Another small cost saved :)

Re: I ditched Docker for Podman

#368

Post by pkulak »

Nextgrid wrote: post #281
miki123211 wrote: post #249

I've been dealing with setting up Podman for work over the last week or so, and I wouldn't wish that on my worst enemy. If you use rootless Podman on a Redhat-derived distribution (which means Selinux), along with a non-root user in your container itself, you're in for a world of pain.

I've never seen the benefit of rootless. Either the machine is a single security domain, in which case running as root is no issue, or it's not and you need actual isolation in which case run VMs with Firecracker/Kata containers/etc. Rootless is indeed a world of pain for dubious security promises.

Rootless is nice because if you mount some directory in, all the files don't end up owned by root. You can get around that by custom building every image so the user has your user id, but that's a pain.

Re: I ditched Docker for Podman

#369

Post by rglover »

TrainedMonkey wrote: post #329
rglover wrote: post #322

I may be the odd man out, but after getting unbelievably stressed out by containers, k8s, etc., I couldn't believe how zen just spinning up a new VPS and bootstrapping it with a bash script was. That combined with systemd scripts can get you relatively far without all of the (cognitive) overhead. The best part? Whenever there's an "uh oh," you just SSH in to a box, patch it, and carry on about your business.

Containers and container orchestrators are complex tools. The constant cost of using them is pretty high compared to bash scripts. However the scale / maintenance factor is significantly lower, so for a 100 boxes simplicity of bash scripts might still win out over the containers. At 1000 machines it is highly likely that simplest and least maintenance overall solution will be using an orchestrator.

That's what I found out, though: the footprint doesn't matter. I did have to write a simple orchestration system, but it's literally just me provisioning a VPS, bootstrapping it with deps, and pulling the code/installing its dependencies. Short of service or hardware limits, this can work for an unlimited number of servers.

I get the why most people think they need containers, but it really seems only suited for hyper-complex (ironically, Google) deployments with thousands of developers pushing code simultaneously.

Re: I ditched Docker for Podman

#370

Post by gm678 »

kiney wrote: post #252
rsyring wrote: post #236

Earlier quoted context omitted.

Additionally, there aren't even any trusted repos out there building/publishing a .deb for it. The ones that I could find when I searched last were all outdated or indicated they were not going to keep moving forward. I could get over this. But, IMO, it lends itself to asking the "why" question. Why wouldn't Podman make installing it easier? And the only thing that makes sense to me is that RedHat doesn't want their…

debian trixie has podman 5 packages in official repos. Good chance thqt those work on ubuntu

Also on Ubuntu 25.04, which I updated a homeserver too despite it not being LTS just for the easy access to Podman 5. Once Ubuntu 26.04 comes out the pain described by some sibling comments should end. Podman 4 is a workable version but 5.0 is where I'd say it really became a complete replacement for Docker and quadlets fully matured.
Post reply on HN