I keep seeing Podman mentioned as a Docker alternative, but I'm unclear on when the juice is worth the squeeze. For someone doing typical web development (Node.js/Python services, Postgres, Redis), what specific problems would Podman solve that Docker doesn't? Is this more about security/compliance or are there developer experience benefits too?
I ditched Docker for Podman
531–540 of 670 posts
Re: I ditched Docker for Podman
#532Earlier quoted context omitted.
I disagree with you on that. Kubernetes YAML is on the same level of complexity as docker compose and sometimes even easier. But verbosity - yeah, kubernetes is absolutely super-verbose. Some 100-line docker-compose could easily end up as 20 yamls of 50 lines each. kubectl really needs some sugar to convert yamls from simple form to verbose and back.
We have about 30 services running in 4 environments, including dev. I desperately want a better kustomize that removes most of the boilerplate and adds linting (like, every process should have a ram limit, but no cpu limit). I estimate about 75% of the lines of YAML are redundant.
Have you thought about using jsonnet? It has a good library for k8s (https://jsonnet-libs.github.io/k8s-libsonnet/). I like how I don’t need to worry about white spaces and how I can use functions to reduce boilerplate. For an example environment: https://github.com/ThatFave/homelab
Re: I ditched Docker for Podman
#533I keep seeing Podman mentioned as a Docker alternative, but I'm unclear on when the juice is worth the squeeze. For someone doing typical web development (Node.js/Python services, Postgres, Redis), what specific problems would Podman solve that Docker doesn't? Is this more about security/compliance or are there developer experience benefits too?
At a high level, Docker and Podman implement the same standard for containers, but my understanding is that Podman implements more of said standard (more/newer features) and in a more standards compliant way.
This can be a good or a bad thing—good because it's better, but bad because the popularity of Docker sometimes means things aren't compatible and require some tweaking to get running.
Re: I ditched Docker for Podman
#534Earlier quoted context omitted.
We have about 30 services running in 4 environments, including dev. I desperately want a better kustomize that removes most of the boilerplate and adds linting (like, every process should have a ram limit, but no cpu limit). I estimate about 75% of the lines of YAML are redundant.
Have you thought about using jsonnet? It has a good library for k8s ( https://jsonnet-libs.github.io/k8s-libsonnet/ ). I like how I don’t need to worry about white spaces and how I can use functions to reduce boilerplate. For an example environment: https://github.com/ThatFave/homelab
Is that intended to be a good example? There's still tons of duplication between the environments.
Kustomize eliminates the vast majority of the duplication (i.e. a unique fact about the cluster being expressed in more than one place), it's just the boilerplate that's annoying.
Re: I ditched Docker for Podman
#535Earlier quoted context omitted.
You can use the real compose (Go) with Podman now. The Python clone is not your only option.
Well, is this Podman's "service mode" also fully compatible with Docker Compose file functionality though?
Looks like the compose `watch` option is not yet supported[1]. Huge blocker for adoption in local development.
Re: I ditched Docker for Podman
#536Earlier quoted context omitted.
Have you thought about using jsonnet? It has a good library for k8s ( https://jsonnet-libs.github.io/k8s-libsonnet/ ). I like how I don’t need to worry about white spaces and how I can use functions to reduce boilerplate. For an example environment: https://github.com/ThatFave/homelab
Is that intended to be a good example? There's still tons of duplication between the environments. Kustomize eliminates the vast majority of the duplication (i.e. a unique fact about the cluster being expressed in more than one place), it's just the boilerplate that's annoying.
Not a good one, no. I am currently in the process of rewriting this, so that I eliminate duplicate code. The language has the potential, I am still in the process of learning. I also dislike boilerplate, but I think my example is still better than pure yaml.
Re: I ditched Docker for Podman
#537Earlier quoted context omitted.
> I genuinely don't understand what docker brings to the table. I mean, I get the value prop. But it's really not that hard to set up http on vanilla Ubuntu (or God forbid, OpenBSD) and not really have issues. For me, as an ex-ops, the value proposition is to be able to package a complex stack made of one or more db, several services and tools (ours and external), + describe the interface of these services with the s…
OK, I completely agree with this. That said, I'm not a nix guy, but to me, intuitively NixOS wins for this use case. It seems like you could either A. Use declarative OS installs across deployments B. Put your app into a container which sometimes deploys it's own kernel and then sometimes doesn't and this gets pushed to a third party cloud registry, or you can set up your own registry, and then this container runs on…
you can actually declare containers directly in Nix. they use the same config/services/packages machinery as you'd use to declare a system config. and then you can embed them in the parent machine's config, so they all come online and talk to each other with the right endpoints and volumes and such.
or you can use the `build(Layered)Image` to declaratively build an oci image with whatever inside it. I think you can mix and match the approaches.
but yes I'm personally a big fan of Nix's solution to the "works on my machine" problem. all the reproducibility without the clunkiness of having to shell into a special dev container, particularly great for packaging custom tools or weird compilers or other finnicky things that you want to use, not serve.
Re: I ditched Docker for Podman
#538Back in 2001/2002, I was charged with building a WiFi hotspot box. I was a fan of OpenBSD and wanted to slim down our deployment, which was running on Python, to avoid having to copy a ton of unnecessary files to the destination systems. I also wanted to avoid dependency-hell. Naturally, I turned to `chroot` and the jails concept. My deployment code worked by running the software outside of the jail environment and m…
The best CI/CD pipeline I ever used was my first freelance deployment using Django. I didn't have a clue what I was doing and had to phone a friend. We set up a git post receive hook which built static files and restarted httpd on a git receive. Deployment was just 'git push live master'. While I've used Docker a lot since then, that remains the single easiest deployment I've ever had. I genuinely don't understand wh…
QEMU used a similar CI for its website before switching to Gitlab pages:
https://gist.github.com/bonzini/1abbbdec739e77503945a3605e0e...
Re: I ditched Docker for Podman
#539Earlier quoted context omitted.
> I genuinely don't understand what docker brings to the table. I mean, I get the value prop. But it's really not that hard to set up http on vanilla Ubuntu (or God forbid, OpenBSD) and not really have issues. Sounds great if you're only running a single web server or whatever. My team builds a fairly complex system that's comprised of ~45 unique services. Those services are managed by different teams with slightly d…
OK, this seems like an absolutely valid use case. Big enterprise microservice architecture, I get it. If you have islands of dev teams, and a dedicated CI/CD dev ops team, then this makes more sense. But this puts you in a league with some pretty advanced deployment tools, like high level K8, Ansible, cloud orchestration work, and nobody thinks those tools are really that appropriate for the majority of devteams. Peo…
15 years ago i has a customer who ran a dozen different services on one machine, php, python, and others. a single dev team. upgrading was a nightmare. you upgraded one service, it broke another. we hadn't yet heard about docker, and used proxmox. but the principle is the same. this is definitely not just big enterprise.
Re: I ditched Docker for Podman
#540Earlier quoted context omitted.
Having a reproducible dev environment is great when everyone’s laptop is different and may be running different OSes, libraries, runtimes, etc. Also docker has the network effect. If there was a good light weight tool that was better enough people would absolutely use it. But it doesn’t exist. In an ideal world it wouldn’t exist, but we don’t live there.
> Having a reproducible dev environment is great when everyone’s laptop is different and may be running different OSes, libraries, runtimes, etc. Docker and other containerization solved the “it works on my machine” issue
almost. there is still an issue with selinux. i just had that case. because the client develops with selinux turned off, the docker containers don't run on my machine if i have selinux turned on.