4 ms·

> I actually like the idea of Docker as a better systemd (or rather, the interface is better). No bespoke file format, programmable API, no need to google for t

> I actually like the idea of Docker as a better systemd (or rather, the interface is better). No bespoke file format, programmable API, no need to google for the right journalctl switches, and then of course the advantages of containers and images over processes and system packages. I’m not suggesting everything should be a container nor that docker is the ideal implementation, but it certainly points in the right direction. Docker was created to give an extra life for legacy applications depending on outdated packages, the concept of gluing all dependencies withing a compressed rootfs and shipping that, with low effort. Docker became popular because of that, but seems that did more harm than good for the ecosystem in terms of security, that why podman might have a great future. The docker interface is bad and comparing that with systemd is quite a stretch. ;) Anyhow, aren't systemd units ini files? The journalctl ships with man pages though. Aren't containers just processes with namespaces and cgroups?

mbakke 6y ago
How does podman improve on container ecosystem security?
- joana035 6y ago
  Check the first link in the "resources" section at the bottom of the article page.
  - mbakke 6y ago
    Right. I misread your comment to imply that podman improved on the "legacy applications depending on outdated packages" problem. I suppose a more secure runtime doesn't hurt.
throwaway894345 6y ago
> The docker interface is bad and comparing that with systemd is quite a stretch. ;) I don't know, systemctl is always a pain to interact with. The Docker CLI is pretty intuitive--you have different resources and different verbs for interacting with those resources. This includes logs. No need to use a separate (and confusing) tool nor dig through man pages. I'm of the philosophy that it's better for a tool to be intuitive than obscure-but-has-manpages. > Anyhow, aren't systemd units ini files? The journalctl ships with man pages though. I guess I meant that INI isn't a standard file format--different parsers behave differently, and structured data is often coded in strings in some bespoke format. > Aren't containers just processes with namespaces and cgroups? My mind isn't made up that containers are the ideal process unit, but I do like some things about them (and the container ecosystem more generally). That they come with their dependencies bundled is pretty nice, but I think the toolchain needs to improve to mitigate security concerns and so on. Something like Nix would be helpful, but Nix also has its own problems. Again, it's directionally correct. In any case, users don't need to be managing their own namespaces and cgroups.

mbakke 6y ago

How does podman improve on container ecosystem security?

joana035 6y ago
Check the first link in the "resources" section at the bottom of the article page.
- mbakke 6y ago
  Right. I misread your comment to imply that podman improved on the "legacy applications depending on outdated packages" problem. I suppose a more secure runtime doesn't hurt.

throwaway894345 6y ago

> The docker interface is bad and comparing that with systemd is quite a stretch. ;) I don't know, systemctl is always a pain to interact with. The Docker CLI is pretty intuitive--you have different resources and different verbs for interacting with those resources. This includes logs. No need to use a separate (and confusing) tool nor dig through man pages. I'm of the philosophy that it's better for a tool to be intuitive than obscure-but-has-manpages. > Anyhow, aren't systemd units ini files? The journalctl ships with man pages though. I guess I meant that INI isn't a standard file format--different parsers behave differently, and structured data is often coded in strings in some bespoke format. > Aren't containers just processes with namespaces and cgroups? My mind isn't made up that containers are the ideal process unit, but I do like some things about them (and the container ecosystem more generally). That they come with their dependencies bundled is pretty nice, but I think the toolchain needs to improve to mitigate security concerns and so on. Something like Nix would be helpful, but Nix also has its own problems. Again, it's directionally correct. In any case, users don't need to be managing their own namespaces and cgroups.