Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ditched Docker for Podman

codesmash.dev

Post reply on HN
Print view View original

511–520 of 670 posts

Re: I ditched Docker for Podman

#511

Post by Shog9 »

sroerick wrote: post #506
Shog9 wrote: post #430

Earlier quoted context omitted.

Reproducibility? No. Not having to regularly rebuild the whole dev environment because I need to work on one particular Python app once a quarter and its build chain reliably breaks other stuff? Priceless.

I know this pain, and Docker absolutely makes sense for this use case, but I feel like we would both agree that this is a duct tape and bubble gum solution? Though a totally justifiable one

Oh sure. 20 years ago I used VMs and that was also a duct tape solution. I'd have hoped for a proper solution by now, but a lighter hack works too

Re: I ditched Docker for Podman

#512

Post by sroerick »

rcv wrote: post #466
sroerick wrote: post #427

Earlier quoted context omitted.

The best CI/CD pipeline I ever used was my first freelance deployment using Django. I didn't have a clue what I was doing and had to phone a friend. We set up a git post receive hook which built static files and restarted httpd on a git receive. Deployment was just 'git push live master'. While I've used Docker a lot since then, that remains the single easiest deployment I've ever had. I genuinely don't understand wh…

> I genuinely don't understand what docker brings to the table. I mean, I get the value prop. But it's really not that hard to set up http on vanilla Ubuntu (or God forbid, OpenBSD) and not really have issues. Sounds great if you're only running a single web server or whatever. My team builds a fairly complex system that's comprised of ~45 unique services. Those services are managed by different teams with slightly d…

OK, this seems like an absolutely valid use case. Big enterprise microservice architecture, I get it. If you have islands of dev teams, and a dedicated CI/CD dev ops team, then this makes more sense.

But this puts you in a league with some pretty advanced deployment tools, like high level K8, Ansible, cloud orchestration work, and nobody thinks those tools are really that appropriate for the majority of devteams.

People are out here using docker for like... make install.

Re: I ditched Docker for Podman

#513

Post by lmm »

jselysianeagle wrote: post #458
janjongboom wrote: post #445

Earlier quoted context omitted.

This false sense of reproducability is why I funded https://docs.stablebuild.com/ some years ago. It lets you pin stuff in dockerfiles that are normally unpinnable like OS package repos, docker hub tags and random files on the internet. So you can go back to a project a year from now and actually get the same container back again.

Isn't this problem usually solved by building an actual image for your specific application, tagging that and pushing to some docker repo? At least that's how it's been at placec I've worked at that used docker. What am I missing?

What do you do when you then actually need to make a change to your application (e.g. a 1-liner fix)? Edit the binary image?

Re: I ditched Docker for Podman

#514

Post by lmm »

cduzz wrote: post #316
radlad wrote: post #239

Earlier quoted context omitted.

I don't believe it's possible to run Docker on macOS without Docker Desktop (at least not without something like lima.) AFAIUI, Docker Desktop contains not just the GUI, but also the hypervisor layer. Is my understanding mistaken?

It's pretty easy to run docker on macos -- colima[1] is just a brew command away... It runs qemu under the hood if you want to run x86 (or sparc or mips!) instead of arm on a newer mac. [1] https://formulae.brew.sh/formula/colima

> colima[1] is just a brew command away...

Which would be great if it worked reliably, or had any documentation at all for when it breaks. But it doesn't and it doesn't.

Re: I ditched Docker for Podman

#515

Post by lmm »

t43562 wrote: post #38
connicpu wrote: post #35

Earlier quoted context omitted.

There's no need if all your devs use desktop Linux as their primary devices like we do where I work :)

On Mac we just switched to podman and didn't have anything to worry about.

Really? We switched 6+ months ago and I'm still dealing with all the little broken corners that keep cropping up.

Re: I ditched Docker for Podman

#516

Post by lmm »

goldman7911 wrote: post #172
t43562 wrote: post #21

To provide 1 contrary opinion to all the others saying they have a problem: Podman rocks for me! I find docker hard to use and full of pitfalls and podman isn't any worse. On the plus side, any company I work for doesn't have to worry about licences. Win win!

You only have to worry about licences if you use Docker DESKTOP. Why not use RANCHER Desktop? I have been using it by years. Tested it in Win11 and Linux Mint. I can have even a local kubernetes.

Low-quality UX (e.g. you have to switch tabs and switch back if you ever want to see the current state of your containers, because it loads it once when you open the tab and never updates, and doesn't even give you a button to refresh it), lack of documentation, behavioural changes that happen silently (e.g. it autoupdates which changes the VM hostname, so the thing that was working yesterday doesn't work today and you have no idea why) and general flakiness.

Re: I ditched Docker for Podman

#517

Post by master_crab »

znpy wrote: post #315
miki123211 wrote: post #249

I've been dealing with setting up Podman for work over the last week or so, and I wouldn't wish that on my worst enemy. If you use rootless Podman on a Redhat-derived distribution (which means Selinux), along with a non-root user in your container itself, you're in for a world of pain.

Your issue is selinux then, not podman. It’s not correct to blame it on podman.

It’s always selinux. I’m surprised parent didn’t figure that out

Re: I ditched Docker for Podman

#518

Post by lmm »

mbreese wrote: post #297
Nextgrid wrote: post #281

Earlier quoted context omitted.

I've never seen the benefit of rootless. Either the machine is a single security domain, in which case running as root is no issue, or it's not and you need actual isolation in which case run VMs with Firecracker/Kata containers/etc. Rootless is indeed a world of pain for dubious security promises.

One of the major use cases was multi-user HPC systems. Because they can be complicated, it’s not uncommon for bioinformatics data analysis programs to be distributed as containers. Large HPC clusters are multi-tennant by nature, so running these containers needs to be rootless. There are existing tools that fill this gap (Singularity/Apptainer). But, there is always friction when you have to use a specialized tool ve…

> Large HPC clusters are multi-tennant by nature, so running these containers needs to be rootless.

I can't see how any kind of sensible security evaluation process would reach that conclusion. If you trust your users you don't need rootless, if you don't trust your users rootless containers aren't good enough. I suspect people do rootless because it seems easy and catches a few accidental mistakes rather than it being a legitimate security measure.

Re: I ditched Docker for Podman

#519

Post by AlphaSite »

sroerick wrote: post #512
rcv wrote: post #466

Earlier quoted context omitted.

> I genuinely don't understand what docker brings to the table. I mean, I get the value prop. But it's really not that hard to set up http on vanilla Ubuntu (or God forbid, OpenBSD) and not really have issues. Sounds great if you're only running a single web server or whatever. My team builds a fairly complex system that's comprised of ~45 unique services. Those services are managed by different teams with slightly d…

OK, this seems like an absolutely valid use case. Big enterprise microservice architecture, I get it. If you have islands of dev teams, and a dedicated CI/CD dev ops team, then this makes more sense. But this puts you in a league with some pretty advanced deployment tools, like high level K8, Ansible, cloud orchestration work, and nobody thinks those tools are really that appropriate for the majority of devteams. Peo…

Having a reproducible dev environment is great when everyone’s laptop is different and may be running different OSes, libraries, runtimes, etc.

Also docker has the network effect. If there was a good light weight tool that was better enough people would absolutely use it.

But it doesn’t exist.

In an ideal world it wouldn’t exist, but we don’t live there.

Re: I ditched Docker for Podman

#520

Post by lmm »

brennyb wrote: post #416
politelemon wrote: post #73

Earlier quoted context omitted.

Use an LLM is not a solution. It's effectively telling you to switch your brain off and hope nothing goes wrong in the future. In reality things do go wrong and any conversation should be done with a good understanding of the system involved.

"Using an IDE is not a solution" same arguments, same counter arguments. An abstraction being leaky does not mean it's useless. You will always need to drop down a layer occasionally, but there's value in not having to live on the lower layer all the time.

The difference being that when your IDE makes a mistake you can understand and debug it, and maybe even patch it to fix it (or failing that at least understand what triggers it and work around it).
Post reply on HN