4 ms·

podman runs out of the box in normal user mode and doesn't require sudo.

archi42 6y ago
This. SO MUCH THIS. We use docker for our CI, which is mostly okay. But we devs don't have root on our workstations, so we can't just load the docker image and test stuff in the CI env. Enter podman: I've written a small perl wrapper around it and now everyone can just call `ci-chroot` to drop to a CI-equivalent shell. They can get virtual root (default) or normal user (--user), and the script takes care of everything (binding some useful folders, fetching/updating our internal image, starting/stopping the actual container and cleaning up,...). Only change necessary to our [Manjaro] environment was adding podman to the package list and a small bash script that generates the `/etc/sub{u,g}id` from our LDAP.
- eeZah7Ux 6y ago
  > we devs don't have root on our workstations What's the justification for this... while at the same time allowing the use of containers?
  - archi42 6y ago
    With root it's easy to mess up the system badly ("I'll just fix that small error") and/or let all systems slowly diverge. And if something fails on my workstation, it will fail on many others as well and needs a coordinated solution. Also, giving every dev root is a security liability, especially when there is absolutely no work reason that requires us to become root. So only a few "core IT" people have root access. I don't see how that contradicts the use of containers? When we only used docker for the CI we didn't have access to them, because escalating to root from within docker is still pretty easy. But with podman they're running with our privileges (and due to gid/uid mapping, I can run our installer "as root" in the container and see if it sets up everthing correctly - while in reality the process runs under my uid). Disclaimer: This is in a professional enviroment. At home I despise containers and prefer to have all my service installed and easily updated by the system's package manager.
    - AlphaSite 6y ago
      Why does it matter what happens to your machine? The big corp I work for has no issue with any of this so I genuinely don’t understand the motivation for this restriction. Your machine shouldn’t have anything important on it and if it does I’m not sure that root/non-root will protect you from that.
    - doliveira 6y ago
      Developing anything without root in your own machine these days must be an absolute nightmare. If I may ask, what stack are you using? I can imagine Java, but that's about it. Go, Python, Node, etc, all of them I've needed root access to test some packages, for instance. I would guess developers must be using a lot of "workarounds" without management's knowledge.
      - protomikron 6y ago
        For Python, you can get most packages as non-root via `pip install --user $package` - but you are right, you might need root if these packages depend on system libraries (that they often wrap). However, it maybe should not be a requirement. AFAIK nix allows you to install stuff as a normal user (and so does dnf on Fedora, but it depends on the package).
      - archi42 6y ago
        C++. And it's no problem :) I don't need privileged ports, and I don't need write access to the OS. Only thing that annoyed me was when I did some work on an internal web tool (php+js) and had no php-fpm & httpd. But by now I've got a container for that.
        doliveira 6y ago
        Well, I suppose if your dependencies are very locked down it might work in C++. I would guess, though, that having to change the prefix and default locations in all tarballs you download must be quite a pain. You can't install DEBs or any other tools either?
  - kohlerm 6y ago
    In big companies there isn't always a good justification for a restriction ;-)
    - mekster 6y ago
      With no courage to voice a concern, it's your problem to be strangled by such limitations or there's actually a valid concern that you're not aware of.
      - archi42 6y ago
        Queue "you don't know me" ;) if I was strangled, I would voice concern very much. But as noted several times, everything is setup so that we never need root. The only thing that was an issue, was docker for about a year (we used chroot before that). That's why I had the sysadmin install podman (no discussion necessary) and why I build a wrapper for super easy usage (which is globally available now). And please note that getting a CI like env is usually not necessary. I only need that exact env to prebuild things that should run in the CI, e.g. target-specific GCCs. And we can't upgrade the CI because some customers pay good money to have our product run on ancient Linux versions (safety critical industries, once something is certified, you use it a looooong time).
- pdimitar 6y ago
  I'm intrigued that you must run Manjaro and kind of want work with you because of it. :) Manjaro is great. Best Linux experience I've had so far. It's good that people recognize it.
  - archi42 6y ago
    It's just great. But I also like Arch@home.
    - pdimitar 6y ago
      I tried Arch but they are a bit too trigger-happy with the rolling releases and this has caused problems for me in the past. I recognize it's a minor pet peeve and would not try to convince anyone though. It's just that I found Manjaro's release policy more to my liking (and unwillingness to fix a broken installation which granted, was easy every time yet took time nonetheless).

This. SO MUCH THIS. We use docker for our CI, which is mostly okay. But we devs don't have root on our workstations, so we can't just load the docker image and test stuff in the CI env. Enter podman: I've written a small perl wrapper around it and now everyone can just call `ci-chroot` to drop to a CI-equivalent shell. They can get virtual root (default) or normal user (--user), and the script takes care of everything (binding some useful folders, fetching/updating our internal image, starting/stopping the actual container and cleaning up,...). Only change necessary to our [Manjaro] environment was adding podman to the package list and a small bash script that generates the `/etc/sub{u,g}id` from our LDAP.

eeZah7Ux 6y ago
> we devs don't have root on our workstations What's the justification for this... while at the same time allowing the use of containers?
- archi42 6y ago
  With root it's easy to mess up the system badly ("I'll just fix that small error") and/or let all systems slowly diverge. And if something fails on my workstation, it will fail on many others as well and needs a coordinated solution. Also, giving every dev root is a security liability, especially when there is absolutely no work reason that requires us to become root. So only a few "core IT" people have root access. I don't see how that contradicts the use of containers? When we only used docker for the CI we didn't have access to them, because escalating to root from within docker is still pretty easy. But with podman they're running with our privileges (and due to gid/uid mapping, I can run our installer "as root" in the container and see if it sets up everthing correctly - while in reality the process runs under my uid). Disclaimer: This is in a professional enviroment. At home I despise containers and prefer to have all my service installed and easily updated by the system's package manager.
  - AlphaSite 6y ago
    Why does it matter what happens to your machine? The big corp I work for has no issue with any of this so I genuinely don’t understand the motivation for this restriction. Your machine shouldn’t have anything important on it and if it does I’m not sure that root/non-root will protect you from that.
  - doliveira 6y ago
    Developing anything without root in your own machine these days must be an absolute nightmare. If I may ask, what stack are you using? I can imagine Java, but that's about it. Go, Python, Node, etc, all of them I've needed root access to test some packages, for instance. I would guess developers must be using a lot of "workarounds" without management's knowledge.
    - protomikron 6y ago
      For Python, you can get most packages as non-root via `pip install --user $package` - but you are right, you might need root if these packages depend on system libraries (that they often wrap). However, it maybe should not be a requirement. AFAIK nix allows you to install stuff as a normal user (and so does dnf on Fedora, but it depends on the package).
    - archi42 6y ago
      C++. And it's no problem :) I don't need privileged ports, and I don't need write access to the OS. Only thing that annoyed me was when I did some work on an internal web tool (php+js) and had no php-fpm & httpd. But by now I've got a container for that.
      - doliveira 6y ago
        Well, I suppose if your dependencies are very locked down it might work in C++. I would guess, though, that having to change the prefix and default locations in all tarballs you download must be quite a pain. You can't install DEBs or any other tools either?
- kohlerm 6y ago
  In big companies there isn't always a good justification for a restriction ;-)
  - mekster 6y ago
    With no courage to voice a concern, it's your problem to be strangled by such limitations or there's actually a valid concern that you're not aware of.
    - archi42 6y ago
      Queue "you don't know me" ;) if I was strangled, I would voice concern very much. But as noted several times, everything is setup so that we never need root. The only thing that was an issue, was docker for about a year (we used chroot before that). That's why I had the sysadmin install podman (no discussion necessary) and why I build a wrapper for super easy usage (which is globally available now). And please note that getting a CI like env is usually not necessary. I only need that exact env to prebuild things that should run in the CI, e.g. target-specific GCCs. And we can't upgrade the CI because some customers pay good money to have our product run on ancient Linux versions (safety critical industries, once something is certified, you use it a looooong time).
pdimitar 6y ago
I'm intrigued that you must run Manjaro and kind of want work with you because of it. :) Manjaro is great. Best Linux experience I've had so far. It's good that people recognize it.
- archi42 6y ago
  It's just great. But I also like Arch@home.
  - pdimitar 6y ago
    I tried Arch but they are a bit too trigger-happy with the rolling releases and this has caused problems for me in the past. I recognize it's a minor pet peeve and would not try to convince anyone though. It's just that I found Manjaro's release policy more to my liking (and unwillingness to fix a broken installation which granted, was easy every time yet took time nonetheless).