391–400 of 670 posts
I ditched Docker and Podman for FreeBSD Jails :) More here: - https://vermaden.wordpress.com/2023/06/28/freebsd-jails-cont... - https://vermaden.wordpress.com/2025/04/11/freebsd-jails-secu... - https://vermaden.wordpress.com/2025/04/08/are-freebsd-jails-... - https://vermaden.wordpress.com/2024/11/22/new-jless-freebsd-...
Earlier quoted context omitted.
> build/package Podman as part of their OS release process. But that is notoriously out-of-date. providing duplicate/additional non official builds for other OS is - undermining the OSes package curation - confusing for the user - cost additional developer time, which for most OSS is fairly limited - for non vendorable system dependencies this additional dev time cost can be way higher in all kinds of surprising ways…
> cost additional developer time, which for most OSS is fairly limited Mostly agree. But something like Podman w/ RedHat behind it is unlikely to be limited in the same way a lot of community OSS projects are. Unfortunately, I disagree with just about every other point you made but don't think it's worth responding point-by-point. In short, I think a project having dedicated builds for popular OSes is a win-win for j…
sure I agree that where it's easily doable (like e.g. ripgrep) having non distro specific builds is a must have
But sadly this doesn't fully work for podman AFIK as it involves a lot of subtle interactions with things which aren't consistently setup across Linux distros with probably the worst offender being the Linux security modules system (e.g. SELinux, AppArmor etc.). But thinking about probably sooner or later you probably could have a mostly OS independent postman setup (limited to newer OS versions). Or to be more specific 3 one with SELinux one with AppArmor and neither with neither, so I guess maybe not :/
Linux gets a new privilege escalation exploit like once a month. If something would break out of the Docker daemon, it will break out of your own user account just fine. Using a non-root app does not make you secure, regardless of whatever containerization feature claims to add security in your own user namespace. On top of all that, Docker has a rootless mode. https://docs.docker.com/engine/security/rootless/
The only things that will make your system secure are 1) hardening every component in the entire system, or 2) virtualization. No containers are secure. That's why cloud providers all use mini-VMs to run customer containers (e.g. AWS Fargate) or force the customer to manage their own VMs that run the containers.
I tried to use podman, but that was largely a waste of time and I reverted to Docker. I don't have time going through docs to figure out why something that supposed to work is not working.
Earlier quoted context omitted.
Ironic username. As a die hard, WSL aint bad though. I just can't deal with an OS that automatically quarantines bittorrent clients, decides to override local administrator policies via windows updates and pops up ad notifications.
All my personal machines run linux. At work my choices are Mac or Windows. If Macs were still x86_64 I might choose that and run a VM, but I have no interest in learning the pitfalls of cross arch emulation or dealing with arm64 linux distro for a development machine.
If you're building really arch-specific stuff, then I could see not wanting to go there, but Rosetta support is pretty much seamless. It's just slower.
You are going to have to pry Docker from my cold dead hands. Podman is a failed reverse-engineering of cherry-picked so-called "good" parts of Docker.
What part of podman is not working for you?
Earlier quoted context omitted.
> On the plus side, any company I work for doesn't have to worry about licences. Win win! Was this a deal breaker for any company? I ask because the Docker Desktop paid license requirement is quite reasonable. If you have less than 250 employees and make less than $10 million in annual revenue it's free. If you have a dev team of 10 people and are extremely profitable to where you need licenses you'd end up paying $9…
The problem isn’t generally the cost, it’s the complexity. You end up having to track who has it installed. Hired 5 more people this week? How many of them will want docker desktop? Oh, we’ve maxed the licenses we bought? Time to re-open the procurement process and amend the purchase order.
Earlier quoted context omitted.
True; I conflate the two often. The EC2s run on an IAM image, same as production does, which before was a docker image.
Arguably it would still be beneficial to use container images when building your AMIs (vs installing use apt or copying your binaries), since using container images still solves the "How do I get my software to the destination?" and the "How do I run my software and give it the parameters it needs?" problems in a universal way.
Earlier quoted context omitted.
If you're already paying for Macs, is paying for Docker Desktop really a big problem?
I think the point is that Docker Desktop for macOS is bad.