Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ditched Docker for Podman

codesmash.dev

Post reply on HN
Print view View original

631–640 of 670 posts

Re: I ditched Docker for Podman

#631

Post by thyristan »

zelphirkalt wrote: post #571
preisschild wrote: post #344

Earlier quoted context omitted.

> The first, second and third law of RedHat sysadmin work is "disable SElinux". Must not be a good sysadmin then. SELinux improves the security and software like podman can be relatively easily be made to work with it. I use podman on my Fedora Workstation with selinux set to enforce without issues

And now comes the part, where you link your guide how you set it up, please! I would like to try exactly that setup and OS. Have a Fedora VM here where I recently struggled with docker and Selinux.

Docker != podman. Entirely different.

With podman, RedHat made an effort to make SElinux work. With Docker, as third-party-software, no proper SElinux config was ever written. With Docker, there is no hope at all that you'd get SElinux to work.

With podman, there is hope, as long as all your containers and usecases are simple, "well-behaved" and preferrably also RedHat-based and SElinux-aware. In the easy cases, podman + SElinux will just work. But unfortunately, containers are the means to get crappy software running, where the developers were too lazy to do proper packaging/installation/configuration/integration. So most cases are not easy and will not work with SElinux, if you don't have infinite time to write your own config...

Re: I ditched Docker for Podman

#632

Post by wyoung2 »

figmert wrote: post #611
wyoung2 wrote: post #383

Earlier quoted context omitted.

Broadly, the claim that Podman is a drop-in replacement for Docker is true only for the simple cases, but people have developed assorted dependencies on Docker implementation details. Examples: 1. People hear about how great rootless is with Podman but then expect to be able to switch directly from rootful Docker to rootless Podman without changing anything. The only way that could work is if there was no difference…

For #2, it will also use docker compose v2 if available. Docker compose v2 is still a standalone binary even in the case of installing Docker (it's a plugin). As long as you download the v2 binary, put it in the correct location, the podman compose subcommand will invoke it.

My expanded version clarifies that, among other things:

https://tangentsoft.com/podman/wiki?name=Not%20a%20Drop-In%2...

Thanks!

Re: I ditched Docker for Podman

#633

Post by em-bee »

johnisgood wrote: post #622
em-bee wrote: post #539

Earlier quoted context omitted.

15 years ago i has a customer who ran a dozen different services on one machine, php, python, and others. a single dev team. upgrading was a nightmare. you upgraded one service, it broke another. we hadn't yet heard about docker, and used proxmox. but the principle is the same. this is definitely not just big enterprise.

That is wild. I have been maintaining servers with many services and upgrading never broke anything, funnily enough: on Arch Linux. All the systems where an upgrade broke something were Ubuntu-based ones. So perhaps the issue was not so much about the services themselves, but the underlying Linux distribution and its presumably shitty package manager? I do not know the specifics so I cannot say, but in my case it was…

i used "broken" generously. it basically means that for example for multiple php based services, we had to upgrade them all at once, which lead to a large downtime until everything was up and running again. services in containers meant that we could deal with them one at a time and dramatically reduce the downtime and complexity of the upgrade process.

Re: I ditched Docker for Podman

#634

Post by jen20 »

mdaniel wrote: post #623
jen20 wrote: post #526

Earlier quoted context omitted.

They have the second problem that `container` [1] will eat up a ton of their business when it ships properly in a month or two. [1]: https://github.com/apple/container

uh-huh, maybe for the corps that have a predictable hardware refresh schedule but I've never worked in such a place https://github.com/apple/container#:~:text=is%20supported%20...

Why does the hardware refresh schedule matter? What you appear to be referring to is the _operating system_ refresh schedule, which should be every year even at enterprises where corporate IT is problematic.

Re: I ditched Docker for Podman

#635

Post by johnisgood »

em-bee wrote: post #633
johnisgood wrote: post #622

Earlier quoted context omitted.

That is wild. I have been maintaining servers with many services and upgrading never broke anything, funnily enough: on Arch Linux. All the systems where an upgrade broke something were Ubuntu-based ones. So perhaps the issue was not so much about the services themselves, but the underlying Linux distribution and its presumably shitty package manager? I do not know the specifics so I cannot say, but in my case it was…

i used "broken" generously. it basically means that for example for multiple php based services, we had to upgrade them all at once, which lead to a large downtime until everything was up and running again. services in containers meant that we could deal with them one at a time and dramatically reduce the downtime and complexity of the upgrade process.

Oh, I see what you mean now, okay, that makes sense.

I would use containers too, in such cases.

Re: I ditched Docker for Podman

#636

Post by curt15 »

em-bee wrote: post #633
johnisgood wrote: post #622

Earlier quoted context omitted.

That is wild. I have been maintaining servers with many services and upgrading never broke anything, funnily enough: on Arch Linux. All the systems where an upgrade broke something were Ubuntu-based ones. So perhaps the issue was not so much about the services themselves, but the underlying Linux distribution and its presumably shitty package manager? I do not know the specifics so I cannot say, but in my case it was…

i used "broken" generously. it basically means that for example for multiple php based services, we had to upgrade them all at once, which lead to a large downtime until everything was up and running again. services in containers meant that we could deal with them one at a time and dramatically reduce the downtime and complexity of the upgrade process.

Would there still have been a problem if you were able to install multiple php versions side-by-side? HPC systems also have to manage multiple combinations of toolchains and environments and they typically use Modules[1] for that.

[1] https://hpc-wiki.info/hpc/Modules

Re: I ditched Docker for Podman

#637

Post by ttul »

bmgoau wrote: post #434
ttul wrote: post #415

Back in 2001/2002, I was charged with building a WiFi hotspot box. I was a fan of OpenBSD and wanted to slim down our deployment, which was running on Python, to avoid having to copy a ton of unnecessary files to the destination systems. I also wanted to avoid dependency-hell. Naturally, I turned to `chroot` and the jails concept. My deployment code worked by running the software outside of the jail environment and m…

First result on Google, 22k stars https://github.com/slimtoolkit/slim

Super cool looking project. I always thought this concept was useful and wondered why base Docker did not incorporate the same idea.

Re: I ditched Docker for Podman

#638

Post by throwmeaway222 »

sroerick wrote: post #509
throwmeaway222 wrote: post #485

Earlier quoted context omitted.

> I didn't have a clue what I was doing and had to phone a friend. > I genuinely don't understand what docker brings to the table. I think you invalidated your own opinion here

Sorry, sir, I didn't realize nobody should ever spend any time learning anything or, failing that, describe what happened to them during that time. I'm no neckbeard savant but I do have a dozen years of deploying web apps and also using Docker during that time, so I think I'm allowed to have an opinion. Go drink some warm milk, you will feel better.

You have 12 years of deployment experience and some of that using docker, would have been a more useful thing to say in your OC. I was literally just pointing out your argument was pretty weak - this context would have made it stronger.

Re: I ditched Docker for Podman

#639

Post by em-bee »

curt15 wrote: post #636
em-bee wrote: post #633

Earlier quoted context omitted.

i used "broken" generously. it basically means that for example for multiple php based services, we had to upgrade them all at once, which lead to a large downtime until everything was up and running again. services in containers meant that we could deal with them one at a time and dramatically reduce the downtime and complexity of the upgrade process.

Would there still have been a problem if you were able to install multiple php versions side-by-side? HPC systems also have to manage multiple combinations of toolchains and environments and they typically use Modules[1] for that. [1] https://hpc-wiki.info/hpc/Modules

probably not, but it wasn't just php, and also one of the goals was the ability to scale up. and so having each service in its own container meant that we could move them to different machines and add more machines as needed.

Re: I ditched Docker for Podman

#640

Post by lmm »

cduzz wrote: post #614
lmm wrote: post #514

Earlier quoted context omitted.

> colima[1] is just a brew command away... Which would be great if it worked reliably, or had any documentation at all for when it breaks. But it doesn't and it doesn't.

First, I guess I'll just invoke Sturgeon's law[1] -- almost all software, especially if you don't really understand it, is crap, and probably the software you understand is also crap, you're just used to it. Good software is pretty tricky to make. But second -- I use colima lots, on my home macs and my work macs, and it mostly just works. The profiles stuff is kinda annoying and I find myself accidentally running arm…

> almost all software, especially if you don't really understand it, is crap, and probably the software you understand is also crap, you're just used to it. Good software is pretty tricky to make.

Most software has issues, but Colima is noticeably worse than most software I've used. And the complete lack of documentation is definitely not normal.

Post reply on HN