Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ditched Docker for Podman

codesmash.dev

Post reply on HN
Print view View original

561–570 of 670 posts

Re: I ditched Docker for Podman

#561

Post by iainmerrick »

chrisweekly wrote: post #261
iainmerrick wrote: post #113

Earlier quoted context omitted.

If you're already paying for Macs, is paying for Docker Desktop really a big problem?

I think the point is that Docker Desktop for macOS is bad.

Oh! I wasn’t trying to make a big point except that paying for software isn’t necessarily a bad thing, and if you’re already invested in Macs you’re presumably OK with paying good money for good products.

Having used Docker Desktop on a Mac myself, it seems... fine? It does the job well enough, and it’s part of the development rather than production flow so it doesn’t need to be perfect, just unobtrusive.

Re: I ditched Docker for Podman

#562

Post by zmmmmm »

lmm wrote: post #513
jselysianeagle wrote: post #458

Earlier quoted context omitted.

Isn't this problem usually solved by building an actual image for your specific application, tagging that and pushing to some docker repo? At least that's how it's been at placec I've worked at that used docker. What am I missing?

What do you do when you then actually need to make a change to your application (e.g. a 1-liner fix)? Edit the binary image?

you append it to the end of the docker file so that the previous image is still valid with its cached build steps

Re: I ditched Docker for Podman

#563

Post by zmmmmm »

cyberpunk wrote: post #432
mgkimsal wrote: post #335

Earlier quoted context omitted.

Every single developer is running 'uncontrolled source code' on corporate hardware every single day.

The defence isn't against malicious developers writing evil code, but some random third party container launched via a curl | bash which mounts ~/ into it and posts all your ssh keys to some server in china... Or whatever. Or so I was told when I made the monumental mistake of trying to fight such a policy once. So now we just have a don't ask don't tell kind of gig going on. I don't really know what the solution is,…

> some random third party container launched via a curl | bash which mounts ~/ into it and posts all your ssh keys to some server in china

it's pretty stupid because the same curl | bash that could have done that could have just posted the same contents directly to the internet without the container. The best chance you actually have is to do as much development as possible inside a sealed environment like ... a container where at least you have some way to limit visibility of partially trusted code of your file system.

Re: I ditched Docker for Podman

#564

Post by pbd »

arcfour wrote: post #533
pbd wrote: post #531

I keep seeing Podman mentioned as a Docker alternative, but I'm unclear on when the juice is worth the squeeze. For someone doing typical web development (Node.js/Python services, Postgres, Redis), what specific problems would Podman solve that Docker doesn't? Is this more about security/compliance or are there developer experience benefits too?

At a high level, Docker and Podman implement the same standard for containers, but my understanding is that Podman implements more of said standard (more/newer features) and in a more standards compliant way. This can be a good or a bad thing—good because it's better, but bad because the popularity of Docker sometimes means things aren't compatible and require some tweaking to get running.

fair enough. thanks.

Re: I ditched Docker for Podman

#565

Post by tasuki »

sroerick wrote: post #427
ttul wrote: post #415

Back in 2001/2002, I was charged with building a WiFi hotspot box. I was a fan of OpenBSD and wanted to slim down our deployment, which was running on Python, to avoid having to copy a ton of unnecessary files to the destination systems. I also wanted to avoid dependency-hell. Naturally, I turned to `chroot` and the jails concept. My deployment code worked by running the software outside of the jail environment and m…

The best CI/CD pipeline I ever used was my first freelance deployment using Django. I didn't have a clue what I was doing and had to phone a friend. We set up a git post receive hook which built static files and restarted httpd on a git receive. Deployment was just 'git push live master'. While I've used Docker a lot since then, that remains the single easiest deployment I've ever had. I genuinely don't understand wh…

> We set up a git post receive hook which built static files and restarted httpd on a git receive. Deployment was just 'git push live master'.

I still do that for all my personal projects! One of the advantages of docker is that you don't have to rebuild the thing on each deployment target.

Re: I ditched Docker for Podman

#566

Post by eptcyka »

nickjj wrote: post #67
akerl_ wrote: post #51

Earlier quoted context omitted.

The problem isn’t generally the cost, it’s the complexity. You end up having to track who has it installed. Hired 5 more people this week? How many of them will want docker desktop? Oh, we’ve maxed the licenses we bought? Time to re-open the procurement process and amend the purchase order.

A large company who is buying licenses for tools has to deal with this for many different things. Docker is not unique here. An IT department for a company of that size should have ironed out workflows and automated ways to keep tabs on who has what and who needs what. They may also be under various compliance requirements that expect due diligence to happen every quarter to make sure everything is legit from a licen…

A large company has to deal with many different things, some of the things are intrinsic to the business, some are not. When push comes to shove, business will try to relieve itself of the latter so it can focus on the former.

Re: I ditched Docker for Podman

#567

Post by antihero »

sroerick wrote: post #427
ttul wrote: post #415

Back in 2001/2002, I was charged with building a WiFi hotspot box. I was a fan of OpenBSD and wanted to slim down our deployment, which was running on Python, to avoid having to copy a ton of unnecessary files to the destination systems. I also wanted to avoid dependency-hell. Naturally, I turned to `chroot` and the jails concept. My deployment code worked by running the software outside of the jail environment and m…

The best CI/CD pipeline I ever used was my first freelance deployment using Django. I didn't have a clue what I was doing and had to phone a friend. We set up a git post receive hook which built static files and restarted httpd on a git receive. Deployment was just 'git push live master'. While I've used Docker a lot since then, that remains the single easiest deployment I've ever had. I genuinely don't understand wh…

> Is the reproducibility of docker really worth the added overhead of managing containers, docker compose, and running daemons on your devbox 24/7?

Yes. Everything on my box is ephemeral and can be deleted and recreated or put on another box with little-to-no thought. Infrastructure-as-code means my setup is immutable and self-documented.

It's a little more time to set up initially, but now I know exactly what is running.

I don't really understand the 24/7 comment, now that it is set up there's very very little maintenance. Sometimes an upgrade might go askew but that is rare.

Any change to it is recorded as a git commit, I don't have to worry about logging what I've done ever because it's done for me.

Changes are handled by a GitHub action, all I have to do to change what is running is commit a file, and the infra will update itself.

I don't use docker-compose, I use a low-overhead microk8s single-node cluster that I don't think about at all really, I just have changes pushed to it directly with Pulumi (in a real environment I'd use something like ArgoCD) and everything just works nicely. Ingress to services is done through Cloudflare tunnels so I don't even have to port-forward or think about NAT or anything like this.

To update my personal site, I just do a git commit/push, the it's CI/CD builds builds a container and then updates the Pulumi config in the other repo to point to the latest hash, which then kicks off an action in my infra repo to do a Pulumi apply.

Currently it runs on Ubuntu but I'm thinking of using Talos (though it's still nice to be able to just SSH to the box and mess around with files).

I'm not sure why people struggle with this, or the benefits of this approach, so much? It seems like a lot of complexity if you're inexperienced, but if you've been working with computers for a long time, it isn't particularly difficult—there are far more complicated things that computers do.

I could throw the box (old macbook) in a lake and be up and running with every service on a new box in an hour or so. Or I could run it on the cloud. Or a VPS, or metal, or whatever really, it's a completely portable setup.

Re: I ditched Docker for Podman

#568

Post by zelphirkalt »

znpy wrote: post #314
goku12 wrote: post #295

Earlier quoted context omitted.

That surprises me too. Podman is spearheaded by Redhat and Fedora/RHEL was one of the earliest distros to adopt it and phase out docker. Why wouldn't they have the selinux config figured out?

They have. Most likely gp is having issues with volumes and hasn’t figured out how to mix the :z and :Z attribute to bind mounts. Or the containers are trying to do something that security-wise is a big no-no. In my experience SELinux defaults have been much wiser than me and every time i had issues i ended up learning a better way to do what i wanted to do. Other than that… it essentially just works.

I personally like the verbose notation for docker volumes in docker compose files, where source and target are separate attributes in the YAML file. Not all munged into one long string, and unable to specify the type of mount explicitly. But that notation does not support stating the :z or :Z. I am running a Debian most of the time to develop and had no issue with the docker bind mounts, but on Fedora Selinux messed things up and I would get strange permission denied errors in the container for bind mounted config files. So I would have to change my docker compose file just for Fedora and Selinux. I think I even tried it with one of z: or Z:, but still Selinux interfered. At some point I had the choice of burning many more hours into configuring Selinux, disable Selinux, or reinstall docker as root. Since the Fedora OS is merely a VM, I chose to install Docker as root.

My point is: If figuring things out with podman is similar to my experience, I understand why people don't want to do that. Do they have a definitive page dedicated to setting up Selinux for podman, that is well maintained and guaranteed to solve all Selinux issues, and allows me to use bind mounts with readonly permission?

Re: I ditched Docker for Podman

#569

Post by zelphirkalt »

gm678 wrote: post #364
ThatMedicIsASpy wrote: post #355

Earlier quoted context omitted.

SELinux has good errors and all I usually need is :z and :Z on mounts

Can confirm, have been doing exactly what GP says is a world of pain with no problems as soon as I learned what `:z` and `:Z` do and why they might be needed. A good reference answer: https://unix.stackexchange.com/questions/651198/podman-volum... TL;DR: lowercase if a file from the host is shared with a container or a volume is shared between multiple containers. Uppercase in the same scenario if you want the contai…

How do I make it :ro then? For example it is a good practice to mount config files as readonly. But if I have to use :z, I think I cannot use :ro?

Re: I ditched Docker for Podman

#570

Post by zelphirkalt »

znpy wrote: post #315
miki123211 wrote: post #249

I've been dealing with setting up Podman for work over the last week or so, and I wouldn't wish that on my worst enemy. If you use rootless Podman on a Redhat-derived distribution (which means Selinux), along with a non-root user in your container itself, you're in for a world of pain.

Your issue is selinux then, not podman. It’s not correct to blame it on podman.

Although it would be podman's job to explain how to set up Selinux, to avoid issues with it (and not just "disable it" as the answer). That is, if they list themselves as available for OS with Selinux.
Post reply on HN