6 ms·

Any docker Podman corner cases that people have run into? I like the idea of rootless containers but I can do that ether easily by adding one line to my dockerf

Any docker Podman corner cases that people have run into? I like the idea of rootless containers but I can do that ether easily by adding one line to my dockerfile or adding a user flag when I run a docker container. What other advantages am I getting?

tick_tock_tick 6y ago
This isn't about root inside the container but rather it doesn't need root on the host system.
deleted 6y ago
[deleted]
pydry 6y ago
No need to run a daemon. Security is better.
- educar 6y ago
  If you lock down the docker user, is it a problem?
  - soraminazuki 6y ago
    The biggest issue lies not in the few lines in /etc/passwd or /etc/group, but rather the highly privileged process with a large attack surface that is the Docker daemon.
    - redis_mlc 6y ago
      Docker in production is the Dominion voting machine of the IT world. :)
fisxoj 6y ago
Generally, it's been pretty easy to transition for me, but I used to rely on things like the automatic nginx image that you need to mount the docker socket into so it can route traffic to containers when they come up. Since there's no daemon, there wasn't a way to do that. I think people are working on it, but I haven't tried recently. Work also uses a special docker RUN command that can use the host's ssh keyring to, eg. Install something from a private github repo. Doesn't seem to exist in podman.
- freedomben 6y ago
  I use that nginx image too, and it's the one thing that keeps me using docker for some small single-node setups. For basically everything else, Podman is a better experience. Now that I've discovered Podman can run K8s Pods (and now Deployments) I use it all the time. I don't know how I lived without it!
  - yjftsjthsd-h 6y ago
    > Podman can run K8s Pods (and now Deployments) That is amazing; thanks for pointing it out:)
choeger 6y ago
Not really corner cases, but compatibility from rootless podman to docker ends where privileges are needed, e.g., in the case of networking.
piaste 6y ago
Not sure if you count it as a corner case, but podman lacks a docker-compose equivalent - last I checked, a few months ago, there was only a community port project that still needed a lot of work.

tick_tock_tick 6y ago

This isn't about root inside the container but rather it doesn't need root on the host system.

deleted 6y ago

[deleted]

pydry 6y ago

No need to run a daemon. Security is better.

educar 6y ago
If you lock down the docker user, is it a problem?
- soraminazuki 6y ago
  The biggest issue lies not in the few lines in /etc/passwd or /etc/group, but rather the highly privileged process with a large attack surface that is the Docker daemon.
  - redis_mlc 6y ago
    Docker in production is the Dominion voting machine of the IT world. :)

fisxoj 6y ago

Generally, it's been pretty easy to transition for me, but I used to rely on things like the automatic nginx image that you need to mount the docker socket into so it can route traffic to containers when they come up. Since there's no daemon, there wasn't a way to do that. I think people are working on it, but I haven't tried recently. Work also uses a special docker RUN command that can use the host's ssh keyring to, eg. Install something from a private github repo. Doesn't seem to exist in podman.

freedomben 6y ago
I use that nginx image too, and it's the one thing that keeps me using docker for some small single-node setups. For basically everything else, Podman is a better experience. Now that I've discovered Podman can run K8s Pods (and now Deployments) I use it all the time. I don't know how I lived without it!
- yjftsjthsd-h 6y ago
  > Podman can run K8s Pods (and now Deployments) That is amazing; thanks for pointing it out:)

choeger 6y ago

Not really corner cases, but compatibility from rootless podman to docker ends where privileges are needed, e.g., in the case of networking.

piaste 6y ago

Not sure if you count it as a corner case, but podman lacks a docker-compose equivalent - last I checked, a few months ago, there was only a community port project that still needed a lot of work.