Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ditched Docker for Podman

codesmash.dev

Post reply on HN
Print view View original

621–630 of 670 posts

Re: I ditched Docker for Podman

#621

Post by mdaniel »

cduzz wrote: post #316
radlad wrote: post #239

Earlier quoted context omitted.

I don't believe it's possible to run Docker on macOS without Docker Desktop (at least not without something like lima.) AFAIUI, Docker Desktop contains not just the GUI, but also the hypervisor layer. Is my understanding mistaken?

It's pretty easy to run docker on macos -- colima[1] is just a brew command away... It runs qemu under the hood if you want to run x86 (or sparc or mips!) instead of arm on a newer mac. [1] https://formulae.brew.sh/formula/colima

As hair splitting, one can choose to use qemu or Virtualization.framework https://lima-vm.io/docs/config/vmtype/vz/ (I'm aware that's a link to Lima docs but ... https://github.com/abiosoft/colima/blob/v0.8.4/config/config...>)

Re: I ditched Docker for Podman

#622

Post by johnisgood »

em-bee wrote: post #539
sroerick wrote: post #512

Earlier quoted context omitted.

OK, this seems like an absolutely valid use case. Big enterprise microservice architecture, I get it. If you have islands of dev teams, and a dedicated CI/CD dev ops team, then this makes more sense. But this puts you in a league with some pretty advanced deployment tools, like high level K8, Ansible, cloud orchestration work, and nobody thinks those tools are really that appropriate for the majority of devteams. Peo…

15 years ago i has a customer who ran a dozen different services on one machine, php, python, and others. a single dev team. upgrading was a nightmare. you upgraded one service, it broke another. we hadn't yet heard about docker, and used proxmox. but the principle is the same. this is definitely not just big enterprise.

That is wild. I have been maintaining servers with many services and upgrading never broke anything, funnily enough: on Arch Linux. All the systems where an upgrade broke something were Ubuntu-based ones. So perhaps the issue was not so much about the services themselves, but the underlying Linux distribution and its presumably shitty package manager? I do not know the specifics so I cannot say, but in my case it was always the issue. Since then I do not touch any distribution that is not pacman-based, in fact, I use Arch Linux exclusively, with OpenBSD here and there.

Re: I ditched Docker for Podman

#623

Post by mdaniel »

jen20 wrote: post #526
CraigJPerry wrote: post #163

Docker is failing in that trap where they feel the need to try (and mostly fail so far) to add net-new value streams (e.g. mcp catalogue, a bunch of other stuff i immediately turned off that last time i installed it) rather than focus on the core value. It's not the case that they've maximised the utility of the core build / publish container nor the acquire / run container workflows and but they're prioritising fluf…

They have the second problem that `container` [1] will eat up a ton of their business when it ships properly in a month or two. [1]: https://github.com/apple/container

uh-huh, maybe for the corps that have a predictable hardware refresh schedule but I've never worked in such a place https://github.com/apple/container#:~:text=is%20supported%20...

Re: I ditched Docker for Podman

#624

Post by chuckadams »

BinaryIgor wrote: post #319

I certainly like demon-less architecture; much simpler and there are less potential security issues and no single point of failure. The one thing I don't necessarily agree: "Privileged ports in rootless mode not working? Good! That's security working as intended. A reverse proxy setup is a better architecture anyway." I usually use Ngix as a reverse proxy - why not have it set up in the exact same way as the rest of…

Allowing binding to a privileged port should be as simple as adding CAP_NET_BIND_SERVICE to the process, most likely in a systemd unit file or something . I still suggest using a reverse proxy like nginx or traefik, so add the capability to those. There's no reason for the proxy to run as root.

Re: I ditched Docker for Podman

#625

Post by sroerick »

Hizonner wrote: post #104

I don't know how podman compares to docker in terms of performance, and I do know that rootless containers can be a real pain. But Docker is simply a non-starter. It's based on a highly privileged daemon with an enormous, hyper-complicated attack surface. It's a fundamentally bad architecture, and as far as I've been able to tell, it also comes from a project that's always shown an "Aw, shucks" attitude toward securi…

I could not agree more with this, and I am baffled by most of the tech scene's complete ignorance of security in this regard

Re: I ditched Docker for Podman

#626

Post by sroerick »

rglover wrote: post #322

I may be the odd man out, but after getting unbelievably stressed out by containers, k8s, etc., I couldn't believe how zen just spinning up a new VPS and bootstrapping it with a bash script was. That combined with systemd scripts can get you relatively far without all of the (cognitive) overhead. The best part? Whenever there's an "uh oh," you just SSH in to a box, patch it, and carry on about your business.

I couldn't agree more.

It's really not that hard, folks are just trading Linux knowledge for CI/CD knowledge.

Its React but for DevOps

Re: I ditched Docker for Podman

#627

Post by fulafel »

Bnjoroge wrote: post #481
const_cast wrote: post #478

Earlier quoted context omitted.

[flagged]

what they described is a fairly common set up in damn near most enterprises

Enterprises are frequently antipattern zoos. If you have many teams you can use the modular monolith pattern instead of microservices, that way you have the separation but not the distributed system.

Re: I ditched Docker for Podman

#629

Post by racecar789 »

nickjj wrote: post #46
t43562 wrote: post #21

To provide 1 contrary opinion to all the others saying they have a problem: Podman rocks for me! I find docker hard to use and full of pitfalls and podman isn't any worse. On the plus side, any company I work for doesn't have to worry about licences. Win win!

> On the plus side, any company I work for doesn't have to worry about licences. Win win! Was this a deal breaker for any company? I ask because the Docker Desktop paid license requirement is quite reasonable. If you have less than 250 employees and make less than $10 million in annual revenue it's free. If you have a dev team of 10 people and are extremely profitable to where you need licenses you'd end up paying $9…

> you'd end up paying $9 a year per developer for the license

Correction: Docker Desktop is $9/month (not $9/year).

Re: I ditched Docker for Podman

#630

Post by goku12 »

chuckadams wrote: post #617
goku12 wrote: post #339

Earlier quoted context omitted.

> ... how to debug yet another layer of abstraction. > Remove layers, keep things simple. Due to the first line above, I'm not sure if I'm reading the second line correctly. But I'm going to assume that you're referring to the OCI image layers. I feel your pain. But honestly, I don't think that image layers are such a bad idea. It's just that the best practices for those layers are not well defined and some of the ea…

Quite an informative reply, but I think GP is referring to layers of abstraction in general, which IMHO puts it in "old man yells at cloud" territory.

Yep. There was always the risk that this essay was going to be pointless.
Post reply on HN