I just use LXC, it's never failed me and has none of the hype.
Docker is dead? Podman – an alternative tool?
71–80 of 183 posts
Re: Docker is dead? Podman – an alternative tool?
#72Rootless podman is my first choice for using containers now, it works fantastically well in my experience. It's so much nicer to have all my container related stuff like volumes, configs, the control socket, etc. in my home directory and standard user paths vs. scattered all over the system. Permission issues with bind mounts just totally disappear when you go rootless. It's so much easier and better than the root pr…
> Permission issues with bind mounts just totally disappear when you go rootless.
I have a problem with mounting a named foo in a container (at /foo) and bindfsing the underlying directory of that volume on ${HOME}/foo with create-for parameters so that when the host user touch files in it they are owned by host 1000:1000 but inside the container it's owned by 33:33.
Volume foo really contains only a unix socket. This unix socket is shared between the host and the container for xdebug communication.
So, this doesn't work, the container process can't write/read the socket even though it can manipulate other files in the mounted volumes /foo and they appear as owned by 1000:1000 on the host and vice versa.
But if I mount the volume directly like that: ${HOME}/foo:/foo then it works and the container can write to the socket and the host and the container can communicate both ways.
Would rootless podman allow me to use a named volume ? Why doesn't it work like I think it should, is it because the unix socket lives in the kernel 'or something' ? Maybe it's a question for SO.
Re: Docker is dead? Podman – an alternative tool?
#73I just use LXC, it's never failed me and has none of the hype.
Lxc rocks. It is linux-only, though
Re: Docker is dead? Podman – an alternative tool?
#74Earlier quoted context omitted.
What about UID issues? I remember using it years ago and sometimes having permission issues in containers when mounting local files. How is that nowadays? I much prefer running this in a rootless manner also. What about docker compose? Is there an alternative for podman?
Yeah in my experience with rootless you don't need to worry about UID shenanigans anymore. Containers can do stuff as root (from their perspective at least) all they want but any files you bind mount into the container are still just owned/modified by your user account on the host system (not a root user bleeding through from the container).
How does that work in practice? Podman is changing the permission bits of files that are synced between the host and the container?
If I create a file with certain permission bits in the container, I'd expect the file to be 100% identical when pulling it over to the host, but maybe that's just "legacy" thinking coming from my docker experience?
What about copying files directly between containers, would that change the permissions as well?
Re: Docker is dead? Podman – an alternative tool?
#75Earlier quoted context omitted.
So you can use kubectl but it talks to podman and not to the api of a k8s cluster? Or does it have its own cli?
There's apparently a 'podman play kube' command that can take some k8s yaml like pod descriptions and instantiate them directly: https://docs.podman.io/en/latest/markdown/podman-play-kube.1... I hadn't heard of this until now but it sounds pretty nifty!
> There's apparently a 'podman play kube' command that can take some k8s yaml like pod descriptions and instantiate them directly
Wow that's a heck of a killer feature.
Once Podmam implements a replacement for Docker's docker swarm, Docker is effectively deprecated.
Re: Docker is dead? Podman – an alternative tool?
#76Rootless podman is my first choice for using containers now, it works fantastically well in my experience. It's so much nicer to have all my container related stuff like volumes, configs, the control socket, etc. in my home directory and standard user paths vs. scattered all over the system. Permission issues with bind mounts just totally disappear when you go rootless. It's so much easier and better than the root pr…
Are you saying that all files from your containers are owned by you as user? If so I will start investigating right now. It is so super annoying to download something with nzbget for example and then having to go through sudo to get to your downloaded files. It is indeed my major gripe with my docker compose setup atm.
Or just messing with a html file in the nginx docker bind mount, ugh!
If podman solves that I’m going all in tomorrow.
Re: Docker is dead? Podman – an alternative tool?
#77Rootless podman is my first choice for using containers now, it works fantastically well in my experience. It's so much nicer to have all my container related stuff like volumes, configs, the control socket, etc. in my home directory and standard user paths vs. scattered all over the system. Permission issues with bind mounts just totally disappear when you go rootless. It's so much easier and better than the root pr…
> Permission issues with bind mounts just totally disappear when you go rootless. I have a problem with mounting a named foo in a container (at /foo) and bindfsing the underlying directory of that volume on ${HOME}/foo with create-for parameters so that when the host user touch files in it they are owned by host 1000:1000 but inside the container it's owned by 33:33. Volume foo really contains only a unix socket. Thi…
It probably is a question for SO, where it would be best described with a script that sets up the minimum environment required to reproduce and the situation that you want to achieve. This description doesn't quite get me to an understanding of the problem, but that may be a personal issue.
Re: Docker is dead? Podman – an alternative tool?
#78I just use LXC, it's never failed me and has none of the hype.
Can you run OCI containers there?
Re: Docker is dead? Podman – an alternative tool?
#79Think it is rapidly moving towards being more of a data carrier/format rather than being dead per se. Half the time you're jamming it into some cloud service anyway where you have no idea what GCP/fly/aws is using under the hood to actually run it. Meaning this discussion is more relevant to the self-hosted context. In which case I'd say containerization isn't really security. So in my mind that residual risk of the…
Kind of a weird take, to be honest. If containerization is not security, them not running as root should be an absolutely critical first step for managing risk.
Re: Docker is dead? Podman – an alternative tool?
#80Earlier quoted context omitted.
Yeah in my experience with rootless you don't need to worry about UID shenanigans anymore. Containers can do stuff as root (from their perspective at least) all they want but any files you bind mount into the container are still just owned/modified by your user account on the host system (not a root user bleeding through from the container).
How does that work in practice? Podman is changing the permission bits of files that are synced between the host and the container? If I create a file with certain permission bits in the container, I'd expect the file to be 100% identical when pulling it over to the host, but maybe that's just "legacy" thinking coming from my docker experience? What about copying files directly between containers, would that change t…
>If I create a file with certain permission bits in the container, I'd expect the file to be 100% identical when pulling it over to the host
The permission bits are metadata on the fs, the file can still be identical.
Plus, how permissions on a file on the container be identical in the host, if e.g. the groups/users are different?