Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Red Hat to contribute container tech (Podman, bootc, ComposeFS...) to CNCF

redhat.com

Post reply on HN
Print view View original

41–50 of 89 posts

Re: Red Hat to contribute container tech (Podman, bootc, ComposeFS...) to CNCF

#41

Post by Cyph0n »

kuratkull wrote: post #17

Podman actually works really well. Out-of-the-box virtually-no-configuration-needed rootless containers. It's also usable via docker-compose with a single env variable. (podman-compose wasn't up to par for us) We've been using it for a couple of years running and managing hundreds of containers per server - no feeling of flakiness whatsoever. It's virtually zeroconf and even supports GPUs for those who need it. It's…

+1, Podman is great. I have been running it for a while on NixOS.

But Compose doesn’t mesh well with the overall NixOS configuration system. So I ended up building a custom tool that can convert your existing Compose project into a NixOS config.

Re: Red Hat to contribute container tech (Podman, bootc, ComposeFS...) to CNCF

#42

Post by xelamonster »

mmh0000 wrote: post #10
2OEH8eoCRo0 wrote: post #7

Earlier quoted context omitted.

That's my take as well. Red Hat's design choices fit into Linux much more neatly. Docker has always been rubbish with late cgroups v2 support, punching holes in my firewall, no rootless, etc.

> punching holes in my firewall I teach various Linux training courses. One of which is Containers. It always shocks several people per-class how Docker just blatantly ignores and rewrites existing firewall rules. And there's no real option to prevent that unless you want to manually configure ALL network routing. For me personally, that was one of the big issues the pushed me over to Podman. Also, Docker's insistenc…

You might just be convincing me to switch, I generally love docker and compose but the firewall thing still blows my mind and that there still just is not a solution.

My workaround has been to bind all docker port forwards to localhost and only ever expose them externally via reverse proxy. Which is annoying because that means I can't run the reverse proxy itself in docker.

Re: Red Hat to contribute container tech (Podman, bootc, ComposeFS...) to CNCF

#43

Post by nolist_policy »

bombela wrote: post #22
kuratkull wrote: post #17

Podman actually works really well. Out-of-the-box virtually-no-configuration-needed rootless containers. It's also usable via docker-compose with a single env variable. (podman-compose wasn't up to par for us) We've been using it for a couple of years running and managing hundreds of containers per server - no feeling of flakiness whatsoever. It's virtually zeroconf and even supports GPUs for those who need it. It's…

The IO through fuse-overlay is performance limiting though. It's almost half the speed as overlay directly for layers with many tiny files. Note that Linux allows you to mount overlay within a user namespace if you are root within the user namespace. In other words, if you are root within a container; even though it is not root on the host; Linux accepte ton mount overlay filesystems (most filesystems are not allowed…

You may need to do

  podman system reset
The Linux kernel only gained unprivileged overlay recently. Kernel fuse and fuse-overlay are incompatible so you need to wipe everything.

You may need to set

  [storage]
  
  driver = "overlay"
in storage conf as well.

https://docs.podman.io/en/stable/markdown/podman-system-rese...

Re: Red Hat to contribute container tech (Podman, bootc, ComposeFS...) to CNCF

#44

Post by zamalek »

kuratkull wrote: post #17

Podman actually works really well. Out-of-the-box virtually-no-configuration-needed rootless containers. It's also usable via docker-compose with a single env variable. (podman-compose wasn't up to par for us) We've been using it for a couple of years running and managing hundreds of containers per server - no feeling of flakiness whatsoever. It's virtually zeroconf and even supports GPUs for those who need it. It's…

I vastly prefer it to Docker, especially buildah over buildx. Instead of inventing yet-another-dsl buildah allows you to simply use shell scripts (though it does also support dockerfiles). Another thing buildah is really good at is not doing much automatically: you can really optimize layers if you care to.

The Podman ecosystem has given me a strong disliking of the Docker ecosystem, so I'm also rooting for it.

Re: Red Hat to contribute container tech (Podman, bootc, ComposeFS...) to CNCF

#45

Post by anticorporate »

vbezhenar wrote: post #28

Is CNCF new Apache foundation? Looks like everyone dumps their stuff there. Does not look promising. Am I missing something? Probably RedHat paid salary to podman developers, but who will pay salary to them now?

I'm sure Red Hat will continue to pay Podman developers, just like they continue to pay developers for the other upstream projects that are hosted at CNCF (like Kubernetes).

I'm we can all think of some projects "abandoned" to foundations through the years, but in general, I'd call getting core infrastructure out of the control of a single company and into a place with more transparent and democratic governance a good thing.

Re: Red Hat to contribute container tech (Podman, bootc, ComposeFS...) to CNCF

#46

Post by mattgreenrocks »

kuratkull wrote: post #17

Podman actually works really well. Out-of-the-box virtually-no-configuration-needed rootless containers. It's also usable via docker-compose with a single env variable. (podman-compose wasn't up to par for us) We've been using it for a couple of years running and managing hundreds of containers per server - no feeling of flakiness whatsoever. It's virtually zeroconf and even supports GPUs for those who need it. It's…

Dumb question: is it rootless for users on something like macOS?

I'd love to get the benefits of Docker without the battery drain and the Docker software, but I'm not sure if Podman would help much with either.

Re: Red Hat to contribute container tech (Podman, bootc, ComposeFS...) to CNCF

#47

Post by LilBytes »

pphysch wrote: post #25
RcouF1uZ4gsC wrote: post #6

Reading about Keycloak and how long it is taking to patch critical vulnerabilities, I wonder is CNCF becoming how Apache was - where abandoned open source software goes to die.

Hopefully the Keycloak thing will spur more competition. I looked at some alternatives and settled on Keycloak because it was "obviously" the mature and hardened solution. Well, clearly not.

Zitadel is worth a look, we're replacing Keycloak with it currently.

Re: Red Hat to contribute container tech (Podman, bootc, ComposeFS...) to CNCF

#48

Post by spockz »

jeppester wrote: post #13
spockz wrote: post #9

Earlier quoted context omitted.

I’ve been using it on my Fedora server because I make myself. I think all functionality and syntax is covered. However, the user feedback and TUI of docker-compose is way nicer (interactive at least). Also, podman compose does seem to recreate containers that do not need to be recreated in more cases than I have noticed docker compose do.

You can run the standalone version for docker-compose against podman. You just need to have the podman.socket systemd service running.

Yes indeed. I have that on other systems as well. But I try to keep both around to notice these kind of differences. (I’m working on tooling that relies on docker compose files so I like to see how it behaves in different setups.)

Re: Red Hat to contribute container tech (Podman, bootc, ComposeFS...) to CNCF

#49

Post by goalieca »

mattgreenrocks wrote: post #46
kuratkull wrote: post #17

Podman actually works really well. Out-of-the-box virtually-no-configuration-needed rootless containers. It's also usable via docker-compose with a single env variable. (podman-compose wasn't up to par for us) We've been using it for a couple of years running and managing hundreds of containers per server - no feeling of flakiness whatsoever. It's virtually zeroconf and even supports GPUs for those who need it. It's…

Dumb question: is it rootless for users on something like macOS? I'd love to get the benefits of Docker without the battery drain and the Docker software, but I'm not sure if Podman would help much with either.

On macOS it creates a centos VM to run containers in. Rootless simply means that the root user in a container maps to the runner outside and not as the actual system root.

Edit: .. because the runner is not needing to run as root

Post reply on HN