Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ditched Docker for Podman

codesmash.dev

Post reply on HN
Print view View original

451–460 of 670 posts

Re: I ditched Docker for Podman

#451

Post by secondcoming »

nickjj wrote: post #46
t43562 wrote: post #21

To provide 1 contrary opinion to all the others saying they have a problem: Podman rocks for me! I find docker hard to use and full of pitfalls and podman isn't any worse. On the plus side, any company I work for doesn't have to worry about licences. Win win!

> On the plus side, any company I work for doesn't have to worry about licences. Win win! Was this a deal breaker for any company? I ask because the Docker Desktop paid license requirement is quite reasonable. If you have less than 250 employees and make less than $10 million in annual revenue it's free. If you have a dev team of 10 people and are extremely profitable to where you need licenses you'd end up paying $9…

Yes. Our company no longer allows use of Docker Desktop

Re: I ditched Docker for Podman

#452

Post by vbezhenar »

mrighele wrote: post #42

> If your Docker Compose workflow is overly complex, just convert it to Kubernetes YAML. We all use Kubernetes these days, so why even bother about this? I find that kubernetes yaml are a lot more complex than docker compose. And while I do, no, not everybody uses kubernetes.

I disagree with you on that. Kubernetes YAML is on the same level of complexity as docker compose and sometimes even easier.

But verbosity - yeah, kubernetes is absolutely super-verbose. Some 100-line docker-compose could easily end up as 20 yamls of 50 lines each. kubectl really needs some sugar to convert yamls from simple form to verbose and back.

Re: I ditched Docker for Podman

#453

Post by gucci-on-fleek »

rsyring wrote: post #236
awoimbee wrote: post #220

The main issue is podman support on Ubuntu. Ubuntu ships outdated podman versions that don't work out of the box. So I use podman v5, GitHub actions uses podman v3, and my coworkers on Ubuntu use docker. So now my script must work with old podman, recent podman and docker

Additionally, there aren't even any trusted repos out there building/publishing a .deb for it. The ones that I could find when I searched last were all outdated or indicated they were not going to keep moving forward. I could get over this. But, IMO, it lends itself to asking the "why" question. Why wouldn't Podman make installing it easier? And the only thing that makes sense to me is that RedHat doesn't want their…

They publish statically-linked binaries on GitHub [0], so to install it, you just need to download and unpack a single file. But you don't get any automatic updates like you would if they provided an apt repository.

[0]: https://github.com/containers/podman/releases

Re: I ditched Docker for Podman

#454

Post by s_ting765 »

amclennon wrote: post #418
0xbadcafebee wrote: post #393

If "security" is the reason you're switching to Podman, I have some bad news. Linux gets a new privilege escalation exploit like once a month. If something would break out of the Docker daemon, it will break out of your own user account just fine. Using a non-root app does not make you secure, regardless of whatever containerization feature claims to add security in your own user namespace. On top of all that, Docker…

> That's why cloud providers all use mini-VMs to run customer containers (e.g. AWS Fargate) or force the customer to manage their own VMs that run the containers. This is only partially true. Google's runtime (gvisor) does not share a kernel with the host machine, but still runs inside of a container.

Google cloud dropped gVisor in favor of micro VMs.

https://cloud.google.com/blog/products/serverless/cloud-run-...

Re: I ditched Docker for Podman

#455

Post by dec0dedab0de »

axlee wrote: post #264
dec0dedab0de wrote: post #195

Earlier quoted context omitted.

It becomes a pain point when the IT team never heard of docker, all new licenses need to be approved by the legal department, and your manager is afraid to ask for any extra budget. Also, I don't want to have to troubleshoot why the docker daemon isn't running every time I need it

>It becomes a pain point when the IT team never heard of docker Where do you work ? Is that even possible in 2025?

I work at a cool place now that is well aware of it, but in 2023 I worked at a very large insurance company with over a thousand people in IT. Some of the gatekeepers were not aware of docker. Luckily another team had set up Openshift, but then the approval process for using it was a nightmare.

Re: I ditched Docker for Podman

#456

Post by carwyn »

amclennon wrote: post #418
0xbadcafebee wrote: post #393

If "security" is the reason you're switching to Podman, I have some bad news. Linux gets a new privilege escalation exploit like once a month. If something would break out of the Docker daemon, it will break out of your own user account just fine. Using a non-root app does not make you secure, regardless of whatever containerization feature claims to add security in your own user namespace. On top of all that, Docker…

> That's why cloud providers all use mini-VMs to run customer containers (e.g. AWS Fargate) or force the customer to manage their own VMs that run the containers. This is only partially true. Google's runtime (gvisor) does not share a kernel with the host machine, but still runs inside of a container.

Second generation moved away from gVisor:

https://cloud.google.com/blog/products/serverless/cloud-run-...

Re: I ditched Docker for Podman

#457

Post by spicyusername »

jeffhuys wrote: post #399
spicyusername wrote: post #126

Earlier quoted context omitted.

Arguably it would still be beneficial to use container images when building your AMIs (vs installing use apt or copying your binaries), since using container images still solves the "How do I get my software to the destination?" and the "How do I run my software and give it the parameters it needs?" problems in a universal way.

In what way does you mean this? I’ve built two jobs for the preview envs: DeployEnvironment (runs the terraform stuff that starts the ec2/makes s3 buckets/creates api gateway/a lot of other crap) and then ProvisionEnvironment (zips the local copy of the branch and rsyncs it to the environment, and some other stuff). I build the .env file in ProvisionEnvironment, which accounts for the parameters. I’d love to get your…

Using a container image as your "artifact" is often a good approach to distributing your software.

    zips the local copy of the branch and rsyncs it to the environment, and some other stuff
This would happen in your Dockerfile, and then the process of actually "installing" your application is just docker run (or kubectl apply, etc), which is an industry standard requiring no specialized knowledge about your application (since that is abstracted away in your Dockerfile).

You're basically splitting the process of building and distributed your application into: write the software, build the image, deploy the image.

Everyone who uses these tools, which is most people by this point, will understand these steps. Additionally, any framework, cloud provider, etc that speaks container images, like ECS, Kubernetes, Docker Desktop, etc can manage your deployments for you, since they speak container images. Also, the API of your container image (e.g. the environment variables, entrypoint flags, and mounted volumes it expects) communicate to those deploying your application what things you expect for them to provide during deployment.

Without all this, whoever or whatever is deploying your application has to know every little detail and you're going to spend a lot of time writing custom workflows to hook into every different kind of infrastructure you want to deploy to.

Re: I ditched Docker for Podman

#458

Post by jselysianeagle »

janjongboom wrote: post #445
Shog9 wrote: post #430

Earlier quoted context omitted.

Reproducibility? No. Not having to regularly rebuild the whole dev environment because I need to work on one particular Python app once a quarter and its build chain reliably breaks other stuff? Priceless.

This false sense of reproducability is why I funded https://docs.stablebuild.com/ some years ago. It lets you pin stuff in dockerfiles that are normally unpinnable like OS package repos, docker hub tags and random files on the internet. So you can go back to a project a year from now and actually get the same container back again.

Isn't this problem usually solved by building an actual image for your specific application, tagging that and pushing to some docker repo? At least that's how it's been at placec I've worked at that used docker. What am I missing?

Re: I ditched Docker for Podman

#459

Post by gucci-on-fleek »

idoubtit wrote: post #59

I also ditched docker when I could. In my experience... Podman with pods is a better experience than docker-compose. It's easy to interactively create a pod and add containers to it. The containers ports will behave as if they were on the same machine. Then `podman generate kube` and you have a yaml file that you can run with `podman kube play`. Rootless networking is very slow unless you install `passt`. With Debian…

> Rootless networking is very slow unless you install `passt`.

If the software that you're running inside the container supports it, you can use socket activation [0] to get native performance.

[0]: https://github.com/containers/podman/blob/main/docs/tutorial...

Re: I ditched Docker for Podman

#460

Post by throwaway0236 »

lucyjojo wrote: post #174
nickjj wrote: post #46

Earlier quoted context omitted.

> On the plus side, any company I work for doesn't have to worry about licences. Win win! Was this a deal breaker for any company? I ask because the Docker Desktop paid license requirement is quite reasonable. If you have less than 250 employees and make less than $10 million in annual revenue it's free. If you have a dev team of 10 people and are extremely profitable to where you need licenses you'd end up paying $9…

for reference a jp dev will be paid around $50,000. most of the world will probably be in the 10k-50k range except a few places (switzerland, luxembourg, usa?). atlassian and google and okta and ghe and this and that (claude code?). that eventually starts to stack up.

I think you are underestimating the salaries in other "developed" countries, but you are right that US salaries are much higher than any other country (especially in Silicon Valley)

You have a valid point in that many HN commentators seem to live in a bubble where spending thousands of dollars on a developer for "convenience" is seen as a no-brainer. They often work in companies that don't make a profit, but are funded by huge VC investments. I don't blame them, as it is a valid choice given the circumstances. If you have the money, why not? But they may start thinking differently if the flow of VC money slows down.

It's similar to how some wealthy people buy a private jet. Their time is valuable, and the cost seems justified (at least if you don’t care about the environmental impact).

I believe that frugality is actually the default mode of business, but many companies in SV are protected from the consequences by the VCs.

Post reply on HN