Rootless Docker in a multi-user environment
1–10 of 50 posts
Re: Rootless Docker in a multi-user environment
#2How well does rootless docker work compared to rootless podman?
Re: Rootless Docker in a multi-user environment
#3I wonder why people aren't using Singularity containers instead which seem to be rootless by design.
Re: Rootless Docker in a multi-user environment
#4I wonder why people aren't using Singularity containers instead which seem to be rootless by design.
At the risk of showcasing my bubble: Lack of exposure; how many people even know what singularity is or how to use it? I know it's used in scientific HPC, but I don't see evidence of wider adoption.
Re: Rootless Docker in a multi-user environment
#5I wonder why people aren't using Singularity containers instead which seem to be rootless by design.
At the risk of showcasing my bubble: Lack of exposure; how many people even know what singularity is or how to use it? I know it's used in scientific HPC, but I don't see evidence of wider adoption.
Never heard of it. Podman or bust
Re: Rootless Docker in a multi-user environment
#6Related: If you are into this kind of thing and the extra fun that is GPUs + pydata, we have a 1mo or 2mo project around adding rootless to our GPU graph AI containers & packer flow. Ping build@graphistry.com .
Niche but a project we have been wanting for awhile. Base containers get OSS'd etc. This stuff is twisty!
Re: Rootless Docker in a multi-user environment
#7I still don't get why multi user. I haven't seen a multi user scenario that makes any sense for any Linux deploy in ages. Is this a shared prod server? Is it a shared Dev server? Why would those be multi user? For prod, why isnt it cattle where you don't ever SSH onto the server?
For Dev if you can't just run it all on your local machine why not do something like shipyard.build
Somebody tell me what im missing.
Re: Rootless Docker in a multi-user environment
#8I still don't get why multi user. I haven't seen a multi user scenario that makes any sense for any Linux deploy in ages. Is this a shared prod server? Is it a shared Dev server? Why would those be multi user? For prod, why isnt it cattle where you don't ever SSH onto the server? For Dev if you can't just run it all on your local machine why not do something like shipyard.build Somebody tell me what im missing.
Not docker specific, but there are still lots and lots of servers out there running multiple services. Especially in my home-lab! Each service runs under a service-specific user, sometimes with extra hardening applied by systemd. It's a tried-and-true method for gaining some semblance of security boundaries on a shared server without the additional administration overhead of kubernetes or similar.
A more relevant use case to industry might be a CI machine that you want to get better utilization out of. Easy, just start of multiple CI runners under different users. "Just use Kubernetes" I hear someone screaming? Well, sometimes you need CI on macOS.
Re: Rootless Docker in a multi-user environment
#9I wonder why people aren't using Singularity containers instead which seem to be rootless by design.
I think it is a few things together. The rootless and daemonless design leads to UX differences with Docker. Because of the differences, it isn't just a drop in replacement; porting applications can be a pain if they do anything weird (no network isolation, --containall isn't default and still is a bit different when on, etc). And Docker has a ton of momentum and usage.
Re: Rootless Docker in a multi-user environment
#10I still don't get why multi user. I haven't seen a multi user scenario that makes any sense for any Linux deploy in ages. Is this a shared prod server? Is it a shared Dev server? Why would those be multi user? For prod, why isnt it cattle where you don't ever SSH onto the server? For Dev if you can't just run it all on your local machine why not do something like shipyard.build Somebody tell me what im missing.
I run a multi-user Linux server. It's IBM POWER9 hardware and several of my friends in the open-source community who care about testing on something other than x86, or who are interested in different architectures or playing with its unique capabilities such as quad-precision floating point implemented in the hardware appreciate having shell access to it.