Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker is dead? Podman – an alternative tool?

content.fme.de

Post reply on HN
Print view View original

81–90 of 183 posts

Re: Docker is dead? Podman – an alternative tool?

#81

Post by magicalhippo »

djbusby wrote: post #14
Havoc wrote: post #6

Think it is rapidly moving towards being more of a data carrier/format rather than being dead per se. Half the time you're jamming it into some cloud service anyway where you have no idea what GCP/fly/aws is using under the hood to actually run it. Meaning this discussion is more relevant to the self-hosted context. In which case I'd say containerization isn't really security. So in my mind that residual risk of the…

I'm still in the VM all the things camp. Like, containers are neat but VMs have the same cheapness for me - that is deploy some VM per app. Like Docker per app. Many times these days I'm one VM for just one Docker package. (Can you tell VM is my favorite isolation method)

I'm quite new to this side of things. Could you shed some light on how I could get docker-like simplicity but in VMs?

Re: Docker is dead? Podman – an alternative tool?

#82

Post by KronisLV »

pjmlp wrote: post #65
KronisLV wrote: post #57

Earlier quoted context omitted.

It will probably never be the year of the Linux Desktop in the mainstream , despite many promising projects out there. But for personal usage, Linux is more than acceptable - if you can grokk all of its pain points, that is. Linus Tech Tips did a few videos on the topic recently, it was painful but understandable to watch. Personally, Ubuntu LTS (or equivalent boring long term support distro) or something with XFCE i…

Typing this on a Asus 1215B that was sold with a Linux distribution and has already had a couple of LTS distributions since 2009. Even though it was sold as Linux supported device, it had its own series of issues, with wlan driver being broken when Canonical decided to replace it for a less capable one taking 6 months to reach feature parity, nowadays GL is stuck at 3.3, although fxgl used to be able to do 4.1. And t…

Makes me think of what other laptops (or even just PC hardware in general) have some of the best support on *nix. Personally, in my experience most hardware has been passably okay, at least when compared with trying to run FreeBSD, though some required tweaking (such as touchpads).

I think Lenovo ThinkPad laptops have some of the best reputation in that regard, though the newer models can definitely be a bit on the pricey side.

Re: Docker is dead? Podman – an alternative tool?

#83

Post by lapser »

teekert wrote: post #76
qbasic_forever wrote: post #29

Rootless podman is my first choice for using containers now, it works fantastically well in my experience. It's so much nicer to have all my container related stuff like volumes, configs, the control socket, etc. in my home directory and standard user paths vs. scattered all over the system. Permission issues with bind mounts just totally disappear when you go rootless. It's so much easier and better than the root pr…

Are you saying that all files from your containers are owned by you as user? If so I will start investigating right now. It is so super annoying to download something with nzbget for example and then having to go through sudo to get to your downloaded files. It is indeed my major gripe with my docker compose setup atm. Or just messing with a html file in the nginx docker bind mount, ugh! If podman solves that I’m goi…

Root inside the container is the same as your user.

Re: Docker is dead? Podman – an alternative tool?

#84

Post by lapser »

capableweb wrote: post #74
qbasic_forever wrote: post #60

Earlier quoted context omitted.

Yeah in my experience with rootless you don't need to worry about UID shenanigans anymore. Containers can do stuff as root (from their perspective at least) all they want but any files you bind mount into the container are still just owned/modified by your user account on the host system (not a root user bleeding through from the container).

How does that work in practice? Podman is changing the permission bits of files that are synced between the host and the container? If I create a file with certain permission bits in the container, I'd expect the file to be 100% identical when pulling it over to the host, but maybe that's just "legacy" thinking coming from my docker experience? What about copying files directly between containers, would that change t…

The permissions (rwx) don't change, but the uid/gid is mapped. E.g. uid 0 is the running user outside the container, by uid 1 will be mapped to 100000 (configurable), and say 5000 inside the container is mapped to 105000. I don't remember the exact mapping but it works roughly like that.

Re: Docker is dead? Podman – an alternative tool?

#85

Post by lapser »

matsemann wrote: post #67
jordemort wrote: post #11

Why not both? Since Podman 4.1 came out with full Compose 2.x compatibility, I'm running Podman on Docker's socket, but using Docker's CLI to talk to it, so that I can use the buildx and compose CLI plugins. It works great, Docker's CLI doesn't seem to have any clue that it's talking to not-Docker. I even have VSCode's Docker extension and Remote Containers working this way.

Is the compose support recent? Tried earlier this year, and it was not nearly there. And I use docker compose stuff as remote interpreter in IntelliJ/Pycharm stuff, that didn't work well with podman when I tested. I don't really care what I use, I just want to be able to develop locally without spending days setting stuff up. Rootless or whatever means nothing to me. Docker compose have made that easy for lots of oth…

It is at least a year or so old. But there have been quite a few bugs, and iirc it was only at v4 where incompatible bugs have been ironed out. Not that it wasn't usable previously, you'd just run into a few issues.

Re: Docker is dead? Podman – an alternative tool?

#87

Post by dhzhzjsbevs »

johnchristopher wrote: post #72
qbasic_forever wrote: post #29

Rootless podman is my first choice for using containers now, it works fantastically well in my experience. It's so much nicer to have all my container related stuff like volumes, configs, the control socket, etc. in my home directory and standard user paths vs. scattered all over the system. Permission issues with bind mounts just totally disappear when you go rootless. It's so much easier and better than the root pr…

> Permission issues with bind mounts just totally disappear when you go rootless. I have a problem with mounting a named foo in a container (at /foo) and bindfsing the underlying directory of that volume on ${HOME}/foo with create-for parameters so that when the host user touch files in it they are owned by host 1000:1000 but inside the container it's owned by 33:33. Volume foo really contains only a unix socket. Thi…

Change the ids of the user inside the container to match what's needed on the host or take a look at subuid's.

Re: Docker is dead? Podman – an alternative tool?

#88

Post by tluyben2 »

LunaSea wrote: post #47
djbusby wrote: post #14

Earlier quoted context omitted.

I'm still in the VM all the things camp. Like, containers are neat but VMs have the same cheapness for me - that is deploy some VM per app. Like Docker per app. Many times these days I'm one VM for just one Docker package. (Can you tell VM is my favorite isolation method)

I don't think people mind using VMs rather than containers. The preference comes from the tool chain which is simpler for containers (even if you use Vagrant) and performance ( true or not, lots of people still have the sluggish VMs in mind.

> lots of people still have the sluggish VMs in mind.

I did, until trying firecracker.

Re: Docker is dead? Podman – an alternative tool?

#90

Post by phoronixrly »

the8472 wrote: post #64
qbasic_forever wrote: post #29

Rootless podman is my first choice for using containers now, it works fantastically well in my experience. It's so much nicer to have all my container related stuff like volumes, configs, the control socket, etc. in my home directory and standard user paths vs. scattered all over the system. Permission issues with bind mounts just totally disappear when you go rootless. It's so much easier and better than the root pr…

The problem with rootless is that you don't get a native network stack since setting up bridges and veth devices still requires some elevated capabilities. But instead of running full root this could be outsourced to a helper executable with some caps set (a narrower version of suid). > Permission issues with bind mounts just totally disappear when you go rootless. Recent kernel versions have gained uid mapping capab…

TBH I don't want to expose the native network stack to containers
Post reply on HN