Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ditched Docker for Podman

codesmash.dev

Post reply on HN
Print view View original

571–580 of 670 posts

Re: I ditched Docker for Podman

#571

Post by zelphirkalt »

preisschild wrote: post #344
thyristan wrote: post #294

Earlier quoted context omitted.

Yes, but the reason for that pain is SElinux. The first, second and third law of RedHat sysadmin work is "disable SElinux".

> The first, second and third law of RedHat sysadmin work is "disable SElinux". Must not be a good sysadmin then. SELinux improves the security and software like podman can be relatively easily be made to work with it. I use podman on my Fedora Workstation with selinux set to enforce without issues

And now comes the part, where you link your guide how you set it up, please! I would like to try exactly that setup and OS. Have a Fedora VM here where I recently struggled with docker and Selinux.

Re: I ditched Docker for Podman

#572

Post by strzibny »

sroerick wrote: post #427
ttul wrote: post #415

Back in 2001/2002, I was charged with building a WiFi hotspot box. I was a fan of OpenBSD and wanted to slim down our deployment, which was running on Python, to avoid having to copy a ton of unnecessary files to the destination systems. I also wanted to avoid dependency-hell. Naturally, I turned to `chroot` and the jails concept. My deployment code worked by running the software outside of the jail environment and m…

The best CI/CD pipeline I ever used was my first freelance deployment using Django. I didn't have a clue what I was doing and had to phone a friend. We set up a git post receive hook which built static files and restarted httpd on a git receive. Deployment was just 'git push live master'. While I've used Docker a lot since then, that remains the single easiest deployment I've ever had. I genuinely don't understand wh…

I know well what you are talking about since I did something similar, but I finally moved to Docker with Kamal (except one project I still have to move). The advantage of Docker's reproducibility is to have a peace of mind when comes to rollbacks and running exact versions due to system dependencies. If anyone is curious I wrote Kamal Handbook to help people adopt Kamal which I think brings all the niceness to Docker deployment so it's not annoying.

Re: I ditched Docker for Podman

#573

Post by mpawelski »

goldman7911 wrote: post #172
t43562 wrote: post #21

To provide 1 contrary opinion to all the others saying they have a problem: Podman rocks for me! I find docker hard to use and full of pitfalls and podman isn't any worse. On the plus side, any company I work for doesn't have to worry about licences. Win win!

You only have to worry about licences if you use Docker DESKTOP. Why not use RANCHER Desktop? I have been using it by years. Tested it in Win11 and Linux Mint. I can have even a local kubernetes.

I concur. My company is using Rancher Desktop on Windows machines. No problems. As long as you use don't care about GUI, and just use CLI dommands ("docker" , "docker compose" ).

Re: I ditched Docker for Podman

#574

Post by gausswho »

zelphirkalt wrote: post #569
gm678 wrote: post #364

Earlier quoted context omitted.

Can confirm, have been doing exactly what GP says is a world of pain with no problems as soon as I learned what `:z` and `:Z` do and why they might be needed. A good reference answer: https://unix.stackexchange.com/questions/651198/podman-volum... TL;DR: lowercase if a file from the host is shared with a container or a volume is shared between multiple containers. Uppercase in the same scenario if you want the contai…

How do I make it :ro then? For example it is a good practice to mount config files as readonly. But if I have to use :z, I think I cannot use :ro?

:ro,z

Re: I ditched Docker for Podman

#575

Post by zelphirkalt »

gausswho wrote: post #574
zelphirkalt wrote: post #569

Earlier quoted context omitted.

How do I make it :ro then? For example it is a good practice to mount config files as readonly. But if I have to use :z, I think I cannot use :ro?

:ro,z

Ah, I never knew this is possible. Thank you!

Re: I ditched Docker for Podman

#577

Post by nickjj »

wiether wrote: post #450
nickjj wrote: post #46

Earlier quoted context omitted.

> On the plus side, any company I work for doesn't have to worry about licences. Win win! Was this a deal breaker for any company? I ask because the Docker Desktop paid license requirement is quite reasonable. If you have less than 250 employees and make less than $10 million in annual revenue it's free. If you have a dev team of 10 people and are extremely profitable to where you need licenses you'd end up paying $9…

> If you have a dev team of 10 people and are extremely profitable to where you need licenses you'd end up paying $9 a year per developer for the license. It doesn't quite change your argument, but where have you seen $9/year/dev? The only way I see a $9 figure is the $9/month for Docker Pro with a yearly sub, so it's 12*$9=$108/year/dev or $1080/year for your 10 devs team. Also it should be noted that Docker Pro is…

I can't speak for all companies but a few I've dealt with bought licenses exclusively for Docker Desktop access. They're not using private repos since they were invested in private registries through their cloud provider.

Re: I ditched Docker for Podman

#578

Post by jbverschoor »

elliottr1234 wrote: post #176
jbverschoor wrote: post #25

Earlier quoted context omitted.

vs $11 for docker? blech

Honestly just the debug shell alone is worth a good amount of $. You can remotely run shell commands on your deployed docker container and install packages that are not available in the base image without modifying the base image which can be a life saver. https://docs.orbstack.dev/features/debug Let alone the local resource monitor, increased, performance, automated local domains (no more complicated docker network…

Check out my tool https://github.com/jrz/container-shell

I basically use (orbstack) docker containers as light weight VM, easily accessible through multiple shells and they shutdown when nothing is running anymore.

I use them for development isolation? Or when I need to run some tool. It mounts the current directory, so your container is chrooted to that project.

Re: I ditched Docker for Podman

#579

Post by jbverschoor »

chrisweekly wrote: post #361
elliottr1234 wrote: post #176

Earlier quoted context omitted.

Honestly just the debug shell alone is worth a good amount of $. You can remotely run shell commands on your deployed docker container and install packages that are not available in the base image without modifying the base image which can be a life saver. https://docs.orbstack.dev/features/debug Let alone the local resource monitor, increased, performance, automated local domains (no more complicated docker network…

it does sound pretty compelling

See my other reply

Re: I ditched Docker for Podman

#580

Post by strken »

flyinglizard wrote: post #489
citizenpaul wrote: post #443

Earlier quoted context omitted.

It always amazes me how hostile most large companies are to paying for developer tools that have a trivial cost. Then they will approve the budget for some yay quartly profit party no one cares about that cost $100k for the venue rental alone. I do understand that this mostly is because management wants staff to be replaceable and disposable having specialty tools suggests that a person can be unique.

No, it's not because of that. It's because: 1. You want to control spend - there are budgets. 2. You want to control accounting - minimize the number of vendors you work with. Each billing needs to come with an invoice, these need to be managed, when a developer leaves you need to cancel their seat etc. It's a pain. 3. You want to control compliance - are these tools safe? Are they accessing sensitive data? Are they…

If you've got 30 developers then you've probably got, what, five or six teams? Your tech leads/senior engineers/whoever provides tech leadership at a team level are operating at a scale where they can go to the pub with your head of engineering/CTO/each other/the dude from finance who has a credit card and fit around a table.

I've worked at companies that size and the "war" involved putting time in the calendar of the head of engineering, asking how his son was, demoing the product we wanted for about two minutes and explaining the pain point it solved, then promising to get our legal team and the one security person to review it after he put the credit card in and before we used it in prod. When I worked somewhere larger it was much more difficult.

Post reply on HN