Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ditched Docker for Podman

codesmash.dev

Post reply on HN
Print view View original

471–480 of 670 posts

Re: I ditched Docker for Podman

#471

Post by gucci-on-fleek »

rsyring wrote: post #257

I believe rootless containers require Linux user namespaces which have historically been the source of many vulnerabilities: https://news.ycombinator.com/item?id=43517734 I'm conflicted about whether or not it's better to run a root daemon that can launch unprivileged non-root containers or run rootless containers launched by a non-root user. Anyone have thoughts or more definitive resources they could point to that…

All containers use user namespaces, but only rootless containers require unprivileged user namespaces. Unprivileged user namespaces didn't have a great security record for the first few years, but vulnerabilities are relatively rare these days.

Running podman with SELinux enforcing (the default) and with "--security-opt=no-new-privileges" combined with running applications as non-root inside their containers should further reduce the security risk. You could also disable unprivileged user namespaces inside the containers if you want, which would mean that exploiting unprivileged user namespaces would first require arbitrary code execution on the host.

Re: I ditched Docker for Podman

#472

Post by pvtmert »

I mean I get the overall benefits of having rootless and all, but the premise of security in this article is a bit misleading.

Obviously having a daemon running as root is larger attack surface than a program running as the user.

Going to the github.com/containers/podman/releases, the latest release is actually addressing a security risk that involves overwriting files of the host.

    # v5.6.1 (Latest)
    ## Security
    - This release addresses CVE-2025-9566, where Kubernetes YAML run by podman play kube containing ConfigMap and Secret volumes can use crafted symlinks to overwrite content on the host.
As always, the most secure computer is the one that is unplugged & turned off.

Re: I ditched Docker for Podman

#473

Post by brikym »

giamma wrote: post #138

I am still on an x86 Mac. When Docker Desktop changed licensing I tried to switch to Podman and it was a disaster, Podman was brand new and despite many blog posts that claimed it was the perfect replacement it did not work for me, and I have very simple requirements. So I ended up using Rancher Desktop instead, which was also very unstable but better. Fast forward 1 year, Rancher was pretty good and Podman still did…

I had some issues with Colima (mac) and switched to Orbstack which fixed everything.

Re: I ditched Docker for Podman

#474

Post by pvtmert »

esseph wrote: post #63
mrighele wrote: post #42

> If your Docker Compose workflow is overly complex, just convert it to Kubernetes YAML. We all use Kubernetes these days, so why even bother about this? I find that kubernetes yaml are a lot more complex than docker compose. And while I do, no, not everybody uses kubernetes.

Having an LLM function as a translation layer from docker compose to k8s yaml works really well. On another note, podman can generate k8s yaml for you, which is a nice touch and easy way to transition.

Both (K8s and Compose) are well defined schemas, hence the conversation is mere mapping via search & replace. Bunch of `sed` statements could do that, LLM is an overkill for the job.

Meanwhile, kompose.io exists, which is exactly what it does (but with Go templates as far as I can tell)

Re: I ditched Docker for Podman

#475

Post by pvtmert »

esseph wrote: post #213
IHLayman wrote: post #123

Earlier quoted context omitted.

You don’t need an LLM for this. Use `kubectl` to create a simple pod/service/deployment/ingress/etc, run `kubectl get -o yaml > foo.yaml` to bring it back to your machine in yaml format, then edit the `foo.yaml` file in your favorite editor, adding the things you need for your service, and removing the things you don’t, or things that are automatically generated. As others have said, depending on an LLM for this is a…

> You don't need an LLM for this I guess that depends on how many you need to do BTW, I'm talking about docker/compose files. kubectl doesn't have a conversion there. When converting from podman, it's super simple. Docker would be wise to release their own similar tool. compose syntax isn't that complex, nor would it take advtange of many k8s features out of the box, but it's a good start for a small team looking to…

Why would docker should create such tool in the first place? It's the job of the target/destination to provide compatibility layer. In this case, Kubernetes already does with kompose.io tool.

kompose: https://kubernetes.io/docs/tasks/configure-pod-container/tra...

Also, technically docker-compose was the first orchestration tool compared to Kubernetes. Expecting former to provide a translation layer for the latter is rather unorthodox. It is usually the latter tool provides certain compatibility features for former tools...

Re: I ditched Docker for Podman

#476

Post by amclennon »

carwyn wrote: post #456
amclennon wrote: post #418

Earlier quoted context omitted.

> That's why cloud providers all use mini-VMs to run customer containers (e.g. AWS Fargate) or force the customer to manage their own VMs that run the containers. This is only partially true. Google's runtime (gvisor) does not share a kernel with the host machine, but still runs inside of a container.

Second generation moved away from gVisor: https://cloud.google.com/blog/products/serverless/cloud-run-...

Ah, today I learned

Re: I ditched Docker for Podman

#477

Post by pvtmert »

stryan wrote: post #379
mdaniel wrote: post #228

Earlier quoted context omitted.

I do believe you about the "updated" part, and that's a constant hazard with linking to "latest" or "main" of anything. But I don't know why you'd then change the actual file in the URL, since the original comment was citing "podman-systemd.unit.5.html" https://docs.podman.io/en/v5.6.1/markdown/podman-systemd.uni... > and you've chosen to cite quadlet.7

Not OP but "podman-systemd.unit.5" used to be the primary Quadlet documentation (a remnant of when it was podman-generate-systemd perhaps?) with every Quadlet file type (.container, .volume, .network, etwc) documented on one page. The new docs split that out into separate podman-container/volume/etc.unit(5) pages, with quadlet.7 being the index page. So they're still linking to the same documentation, just the organi…

Not podman user (but currently trying to install to give it a shot), this comment stream shows how even the documentation "randomly disappearing" on a project that claims in production-ready or stable state. (Or lack thereof)

On the contrary, docker documentation *is* stable, I had bookmarks from 10-years ago on the *latest* editions, that still work today. The final link may have changed, but at least, there is a redirect (or a text showing that has been moved) instead of plain 404/not-found.

This is a crucial part of the quality applications offer. There might've been 100s of podmans probably since Docker was launched more than 10 years ago, but none came close to maintain high-quality of documentation and user-interface (ie. cli commands, switches). Especially in the backward-compatible way.

Re: I ditched Docker for Podman

#478

Post by const_cast »

rcv wrote: post #466
sroerick wrote: post #427

Earlier quoted context omitted.

The best CI/CD pipeline I ever used was my first freelance deployment using Django. I didn't have a clue what I was doing and had to phone a friend. We set up a git post receive hook which built static files and restarted httpd on a git receive. Deployment was just 'git push live master'. While I've used Docker a lot since then, that remains the single easiest deployment I've ever had. I genuinely don't understand wh…

> I genuinely don't understand what docker brings to the table. I mean, I get the value prop. But it's really not that hard to set up http on vanilla Ubuntu (or God forbid, OpenBSD) and not really have issues. Sounds great if you're only running a single web server or whatever. My team builds a fairly complex system that's comprised of ~45 unique services. Those services are managed by different teams with slightly d…

[flagged]

Re: I ditched Docker for Podman

#479

Post by champtar »

ttul wrote: post #415

Back in 2001/2002, I was charged with building a WiFi hotspot box. I was a fan of OpenBSD and wanted to slim down our deployment, which was running on Python, to avoid having to copy a ton of unnecessary files to the destination systems. I also wanted to avoid dependency-hell. Naturally, I turned to `chroot` and the jails concept. My deployment code worked by running the software outside of the jail environment and m…

In OpenWrt there is ujail, you give it an ELF (or multiple) to run, it'll parse them to find all the libraries they need, then it creates a tmpfs and mount bind read only the required files. https://github.com/openwrt/procd/blob/dafdf98b03bfa6014cd94f...

Re: I ditched Docker for Podman

#480

Post by Eduard »

gucci-on-fleek wrote: post #453
rsyring wrote: post #236

Earlier quoted context omitted.

Additionally, there aren't even any trusted repos out there building/publishing a .deb for it. The ones that I could find when I searched last were all outdated or indicated they were not going to keep moving forward. I could get over this. But, IMO, it lends itself to asking the "why" question. Why wouldn't Podman make installing it easier? And the only thing that makes sense to me is that RedHat doesn't want their…

They publish statically-linked binaries on GitHub [0], so to install it, you just need to download and unpack a single file. But you don't get any automatic updates like you would if they provided an apt repository. [0]: https://github.com/containers/podman/releases

how come there is no podman Linux installer?
Post reply on HN