Live data from Hacker News

Quadlets might make me finally stop using docker-compose

major.io

91–100 of 212 posts

Re: Quadlets might make me finally stop using docker-compose

#91
post #68

I started using quadlets for new system designs a month ago and I feel like I'm neck deep in it now. My conclusion is that there is absolutely no reason to stop using docker-compose if your developers are comfortable running one command, on one file, in one git root. Quadlets are basically docker compose, in systemd. They've finally done it, systemd has it all and now it even has docker compose. ;) That's really all…

The next step: systemkubed.

Nah, we got that already. Quadlet can handle k8s manifests.

https://man.archlinux.org/man/quadlet.5.en#Kube_units_%5BKub...

Re: Quadlets might make me finally stop using docker-compose

#92
post #69

> However, as with watchtower, that’s another external dependency. Docker compose is part of docker now, it's just another subcommand.

While you're technically correct, docker compose uses yet another process supervisor (the docker daemon) while systemd is already capable of doing that. This is probably what the author meant by 'external dependency' - not the need to install compose separately. Quadlet delegates the supervision to systemd daemon, eliminating this duplication of supervisor functionality. Kubelets in K8s also have similar duplication…

It unfortunately looks like Aurae is unmaintained at the moment.

Re: Quadlets might make me finally stop using docker-compose

#93

> you’ll see a WantedBy line. This is a great place to set up container dependencies. In this example, the container that runs caddy (a web server) can’t start until Wordpress is up and running. Either this must be some systemd weirdness that I thankfully haven't had to deal with until now, or I'm misunderstanding something. Did I understand correctly you don't specify which services you need but rather which ones de…

It's not how you would normally specify it, but it is an option: the normal usage for it in systemd is enabling and disabling which services start on boot: an enabled service usually gets set up as a dependency of the multi-user target which is what systemd starts on boot. (And you can get a list of dependencies from systemd if you want to debug anything: the WantedBy stuff just turns into some symbolic links in the filesystem if you want to inspect things manually)

I don't know why it's being used in that way for these containers. It'd be easier to just add a Wants line on Caddy.

Re: Quadlets might make me finally stop using docker-compose

#94
post #34

Earlier quoted context omitted.

> With quadlets, the only thing required is to drop a `.container` file in the right place and you end up with a container properly supervised by `systemd`. Is it? He defines a .network file in that butane config without it won't work. Not really obvious. I'm sure this has a use-case and it's nice to have but personally I'm not convinced. You can switch on user-namespaces in docker-daemon or even run docker itself ro…

.network is only required if you need a network, just like you define networks in docker compose for some containers to have one shared private network.

yeah spend some time on the docs for this and it's pretty straight forward - the article and the repo kind of omits this but it's also for a different usecase. Was just irritated when I wrote that comment. It's really some oci container to systemd shim system that uses podman.

Re: Quadlets might make me finally stop using docker-compose

#95
post #28

It's quite unfortunate that this article mixes up what's necessary for podman quadlets with coreOS concepts. With quadlets, the only thing required is to drop a `.container` file in the right place and you end up with a container properly supervised by `systemd`. And this of course also supports per-user rootless containers as described in [1]. [1]: https://www.redhat.com/sysadmin/quadlet-podman

I agree, and I think the author was unfortunately using coreOS because it's uncommon for cloud providers to have coreOS images nowadays, and therefore a good opportunity for him to slip in a referral code for VULTR. Is coreOS even maintained any more? I wouldn't expect it to be very secure if the most recent VM images were built in ~2020. Would love another writeup just using Ubuntu or some other bog-standard Linux d…

CoreOS was acquired by Red Hat, and now "Fedora CoreOS".offers similar concepts.

Conveniently, RH also invented both Podman and systemd.

Re: Quadlets might make me finally stop using docker-compose

#96

[flagged]

Yeah … this response is devoid of substance. What’s all this nonsense about “soy”? Why not critique the approach with what is better about your approach or docker-compose or whatever it is you use and talk about the merits.

It probably seems like I wrote the above as a one-off shit post to bag on OP for the lulz. But I did have a solid engineering basis for writing it.

The tools being better or worse isn't the issue I was getting at. Quadlets may well be an improvement on several fronts. But every tool / dependency / service / etc increases the cognitive burden of a project. That is one more component to have to learn for people who interact with it. One more expansion of the overall system to keep in mind (if such a feat is still possible.) One more increase in complexity - and that's quite a bad thing because complexity is harder to maintain.

When you always chase the latest and greatest things. You may end up with a collection of shiny tools that specialize in everything just the way you want it. But push it too far and you end up with designs that are unrecognizable to anyone with the skills you need. OSes, package managers, scripting languages, DBs, dev-ops, and cloud infrastructure approaches that no one recognizes. And when people want to be productive they're not going to be impressed by the dazzling number of obscure technologies being used. It will seem more like a red flag than anything.

There's a nice contrast you can make between web technology and templeos. Terry Davis built this operating system called templeos and part of his goals for building the OS were to keep it within a certain number of lines - lets say 25k. That means the entire kernel, file system drivers, graphics, editor, terminal, and compiler -- all have to fit within 25k. In other words every line had to count. Terry Davis hated bloated software and wanted to write an OS that had low resource usage. So templeos runs in 32 bits -- specifically using 32 bit register operations because they're faster. He built an entire language from scratch and all the tooling to run it. Templeos can build its entire kernel inside itself using his tooling and it does so within seconds. His tools don't even have a linker.

Now Terry knew something many programmers today don't: it's that when you keep things simple, when you include only what you need, and design in the simplest way possible, you can actually achieve better results. Terrys code is fast, it builds instantly, it has a low memory foot print, and its easy to maintain. Compare it to the web today. A multitude of ways to build, pack, combine, distribute, minimize, respond, push, pull... The web was never meant to be rocket science but somehow trying to keep up with modern web development feels like getting teeth pulled. If terry had of built the web it would look shitty like windows 95 but pages would load instantly, use almost no data, wouldn't need 8 gb of RAM to run chrome, and probably would encourage regular users to write code.

Complexity, bad. Simple, good.

Re: Quadlets might make me finally stop using docker-compose

#97
post #25
post #8

Earlier quoted context omitted.

I was confused by this article in the beginning, it does a pretty bad job at drawing a distinction between the pure quadlet example at the start and the example of using CoreOS to build and launch a VM that starts containers. The basic usage of podman quadlets is putting an `app.container` in `/etc/containers/systemd/` containing something like the first snippet and then starting the unit. For someone familiar with s…

I'm still not clear whether quadlets are a feature of Podman or systemd... The reliance on systemd is an issue on its own. Much has been said about its intrusion in all aspects of Linux, and I still prefer using distros without it. How can I use this on, say, Void Linux? Standalone Podman does work there, but I'm not familiar if there were some hacks needed to make it work with runit, and if more would be needed for…

"quadlets" are podman using systemd's extension mechanism [systemd.generator(7)] to create systemd services that invoke podman to run containers, based on the files you drop into /etc/containers/systemd.

Re: Quadlets might make me finally stop using docker-compose

#98

The syntax and examples in the article assumes usage of SystemD as service manager. Does it work on distros without SystemD too? Docker-compose does. I also do not understand separation of services to different files. Is it supposed to be more convenient? With docker-compose, the whole application stack is described in one file, before your eyes, within single yaml hierarchy. With quadlets, it's not. Lastly, I do not…

> Is software supposed to update without administrator supervision yes proper CI is a thing, and containers not being updated is actually quite a bit of an issue in the current software industry especially if combined with custom registries auto update is quite a neet thing oh also it's a SystemD feature to let SystemD manage your containers so why are you asking if it works without SystemD?

If you run only the software you wrote, then yes, it is useful feature. Otherwise I won't trust automated pulls of whatever other devs put into their public images, nor won't I trust them for following image versioning properly and not introducing some addition in minor version that would automatically expose my files to the internet if not configured explicitly. There is too much trust I don't want to put in auto-updates.

As for the SystemD dependency, in this case the quadlets can not even be compared to docker-compose, nor be a replacement to it. Docker-compose always was independent of init system, where as quadlets are strictly tied to SystemD-based distros. E.g. users of Alpine, Gentoo won't be able to replace their compose stacks with quadlets.

Re: Quadlets might make me finally stop using docker-compose

#100
post #18

Earlier quoted context omitted.

> I also miss the simplicity of compose, but for me running rootless is worth the tradeoff. To setup/tear down software dev environments deployed locally, the root/rootless discussion isn't really relevant. Ease of deployment and ease of use are critical though, and Docker is above all a development experience victory.

Relevant to who? The damage done with container escape is bigger on my machine than any production server I have access to. And there are a lot more packages running in my dev environment than on production servers. When it comes to security or convenience I always choose the first but I know most people wont. Podman-compose isn't as good as docker but it exists, and you can run docker-compose with podman as the runt…

> The damage done with container escape is bigger on my machine than any production server I have access to.

It's worth pointing out that if you're running on Fedora/RHEL then containers are confined to the container_t domain, with a unit per-container MCS label. SELinux policy will prevent a process that has broken out of its namespaces from being able to read/write files from the host or from other containers, or being able to kill or read the memory of or (I'm assuming, haven't checked) ptrace processes from the host or other containers.

Post reply on HN