16 ms·

Podman: A tool for managing OCI containers and pods

421 points by mohanmcgeek 5y ago

sharmin123 5y ago
Let’s Secure WiFi Network and Prevent WiFi Hacking: https://www.hackerslist.co/lets-secure-wifi-network-and-prevent-wifi-hacking/ https://www.hackerslist.co/lets-secure-wifi-network-and-prev...
zz865 5y ago
Podman is great because we dont get root access on our boxes at work. One problem is someone still needs root access to install - or does anyone know if its possible to install as regular user?
- ask2sk 5y ago
  The following reply in GitHub addresses your question: >>that is more difficult to get as you'd need to install all dependencies in your home directory and prepare all the configuration files to use/point the right executables. We have nothing at the moment for bootstrapping podman and its dependencies from scratch for an unprivileged user. The easiest would be to install it on the system, but still use the unprivileged users for running the containers. https://github.com/containers/podman/issues/3100 https://github.com/containers/podman/issues/3100
- Klasiaster 5y ago
  I don't think this will work unless you have a range of user and group IDs allocated for your user. Those will be used for non-root in-container users. $ echo USERNAME:10000:65536 >> /etc/subuid $ echo USERNAME:10000:65536 >> /etc/subgid
  - akvadrako 5y ago
    Technically you don't need those if you always run your contains as a single user mapped to your real UID.
    - prpl 5y ago
      I know uid 0 in container will always map to uid outside the container (e.g. 1005), but I haven't tried e.g. uid 999 in the container to ensure it maps to uid outside of the container (again, 1005), does that work?
      - foresto 5y ago
        > I know uid 0 in container will always map to uid outside the container I don't think that's true. Have a look at Podman's --userns=keep-id and related options.
        prpl 5y ago
        ah yeah, I had forgot about that one specifically
proxysna 5y ago
Great replacement for docker. For personal use it is pretty much a drop-in replacement. I used it with hashicorp nomad, and so far had no issues at all. One thing that might be an issue for some is Docker-in-Docker thing is kinda broken. (was around 8-10 months ago, not sure about now.)
- easton 5y ago
  Looks like this was resolved in the last couple months: https://www.redhat.com/sysadmin/podman-inside-container https://www.redhat.com/sysadmin/podman-inside-container
- agravier 5y ago
  Can't replace the docker desktop app on a mac unfortunately
  - lpasselin 5y ago
    Tested podman to replace docker (the cli) on a mac yesterday Most of it works fine. They have an easy way to setup a vm now with `podman machine`: https://podman.io/getting-started/installation#macos https://podman.io/getting-started/installation#macos If you want the management GUI, install cockpit: https://github.com/cockpit-project/cockpit-podman https://github.com/cockpit-project/cockpit-podman Try podman, you'll be impressed.
  - Daegalus 5y ago
    there is also rancher desktop and minikube podman-env that will both work fine as alternatives to docker desktop.
SEJeff 5y ago
On macOS brew install podman; podman machine init; podman machine start; podman run ...
- cpach 5y ago
  Interesting… Will podman automatically create and launch a Linux VM where the containers will live?
  - esamatti 5y ago
    Seems like it ------- Podman is a tool for running Linux containers. You can do this from a MacOS desktop as long as you have access to a linux box either running inside of a VM on the host, or available via the network. Podman includes a command, podman machine that automatically manages VM’s. To start the Podman-managed VM: podman machine init podman machine start ------- from: https://podman.io/getting-started/installation https://podman.io/getting-started/installation
    - jhickok 5y ago
      Seems to have some issues creating the temp directories for the VM in an automated fashion (at least with the Homebrew package). But it will work with some tinkering.
- b3n4kh 5y ago
  It seems like podman machine is deprecated: https://www.redhat.com/sysadmin/replace-docker-podman-macos https://www.redhat.com/sysadmin/replace-docker-podman-macos
  - SEJeff 5y ago
    This is from the guy that leads the container team at Redhat: https://twitter.com/rhatdan/status/1433003250991706114?s=21 https://twitter.com/rhatdan/status/1433003250991706114?s=21
    - 5y ago
_red 5y ago
There are lots of cools aspects of podman, for the admin one the real nice things is its integration with systemd. podman generate systemd <containerid> to generate .service files which can then be launched via systemd.
- agilob 5y ago
  can you get journal logs from a pod? archive and limit logs size etc using existing systemd configuration?
  - _red 5y ago
    yes, via journalctl
- torvald 5y ago
  Neat, thanks for the tip!
- spicyusername 5y ago
  This is a super underrated feature. You can do some really cool things when you combine this with Ignition and Fedora CoreOS. Ignition has the ability to manage systemd units on boot. https://docs.fedoraproject.org/en-US/fedora-coreos/running-containers/#_introduction https://docs.fedoraproject.org/en-US/fedora-coreos/running-c... https://developers.redhat.com/blog/2020/03/12/how-to-customize-fedora-coreos-for-dedicated-workloads-with-ostree https://developers.redhat.com/blog/2020/03/12/how-to-customi... Automatically boot, bootstrap the OS, and run your containers via systemd, all driven by infrastructure-as-code ignition files. A much simpler edge or single-node container experience than using Kubernetes.
tifadg1 5y ago
I like podman, but is there any progress with monitoring solutions? cAdvisor image didn't work last I checked. What I need is a way for data to flow into prometheus.
- owaislone 5y ago
  Podman does support docker API so you can use something like the OpenTelemetry Collector to fetch metrics using the docker API and forward them to prometheus. Collector: https://github.com/open-telemetry/opentelemetry-collector-contrib https://github.com/open-telemetry/opentelemetry-collector-co... Docker receiver: https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/dockerstatsreceiver https://github.com/open-telemetry/opentelemetry-collector-co... Prometheus exporters: https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/exporter/prometheusremotewriteexporter https://github.com/open-telemetry/opentelemetry-collector-co... and https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/exporter/prometheusexporter https://github.com/open-telemetry/opentelemetry-collector-co... OpenTelemetry will soon support native Podman API as well.
  - hetspookjee 5y ago
    Not sure why you seem to receive downvotes. Seems like a pretty nice layout and comment. Anyone interested in explaining why you're receiving downvotes?
    - owaislone 5y ago
      I've seen anything that mentions the word "telemetry" automatically receive down votes on HN. People confuse it with companies collecting user-identifiable data from clients like apps/browsers.
aorth 5y ago
podman has been an amazing project to follow. Since early 2020 I've been using it for rootless containers with no daemon on my Linux development environment. Development pace is picking up and I get excited every time I get a notification from GitHub about a new tagged release. As a bonus, the podman-compose script https://github.com/containers/podman-compose/ https://github.com/containers/podman-compose/ is getting good too!
- gizdan 5y ago
  You do not need podman-compose, in fact it is quite inferior to docker-compose. Podman has added full docker-compose support, and in fact even the docker binary works with it. Rootfull works as of v3.0.0, rootless was added in 3.2.0. Rootless can be a bit buggy, but I believe they polished a lot of the issues for 3.3.0. Because they've re-implemented the docker api, it can actually work with any tool that uses docker's API.
  - jackhalford 5y ago
    > Podman has added full docker-compose support any pointers as to how this works?
    - rubenbe 5y ago
      IIRC it's emulating the docker socket and its API. As a consequence, you do need to have a podman daemon running. https://fedoramagazine.org/use-docker-compose-with-podman-to-orchestrate-containers-on-fedora/ https://fedoramagazine.org/use-docker-compose-with-podman-to... https://www.redhat.com/sysadmin/podman-docker-compose https://www.redhat.com/sysadmin/podman-docker-compose
    - gizdan 5y ago
      As rubenbe said, they implemented the docker API, thus you'll need to start a systemd socket. For rootless the steps are as simple as systemctl enable --now --user podman.socket export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock For rootfull just remove "--user" from the above command, and the socket is located at /var/podman/podman.sock Then you can run both docker and docker-compose commands. Traefik and other things that use the Docker API directly should be able to use it too. Any issues you can raise on the GitHub repo, they're a bunch of friendly folks and are pretty quick at addressing issues.
Anarch157a 5y ago
What I like most about it is that it can run as any user. There's no need for a daemon that starts as privileged user. Another benefit is that all images and container reside on a hidden directory in $HOME.
- tacobelllover99 5y ago
  Tell me you are a Dev without telling me you are a Dev
- judge2020 5y ago
  Docker also has a rootless mode as of 19.03: https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/
  - GordonS 5y ago
    Wow, how did I not know about this! Unless I'm missing something, the limitations mentioned in the docs don't seem too limiting. Is there anything that needs to be changed or watched out for in real life?
    - foresto 5y ago
      It requires a kernel that allows unprivileged user namespaces. Docker images that run as uid 0, which many of them do, could potentially exploit their way out of the container, since kernel code running as (actual or namespaced) uid 0 hasn't been extensively tested to be safe and bug-free. You might have to experiment with different "drivers" to get the overlay filesystem and cgroups components to work on any given host. (These are not hardware drivers, but something more like docker subsystem plugins.) By default, it expects a dbus user session, which a headless server might not have. You can either enable one or configure a different `cgroupdriver`.
      - staticassertion 5y ago
        TBH the Linux kernel isn't capable of providing an isolation boundary anyways, so while it's a meaningful regression if your assumption is "attacker in the container" I highly recommend using gVisor or Firecracker, or otherwise reducing the need to trust the Linux kernel for anything like resisting hostile local attackers.
rubyist5eva 5y ago
Is this being posted here because of Docker changing their terms of service for their Desktop app? Also the performance on macOS vs a parallels VM just running podman and forwarding ports is night and day. I switched to podman ages ago because I didn’t want a root daemon on my machine anymore, but the new pricing scheme is especiallly egregious.
- infogulch 5y ago
  This fact seems relevant to the discussion.
  - rubyist5eva 5y ago
    When I got the email notifiying me of the changes, I couldn't believe it...5 dollar per user for a basic wrapper around an open source tool? Are they serious with this?
- hda111 5y ago
  Doesn’t seem to be a fair comparison. Docker Desktop has access to your whole filesystem and can be used transparently in Terminal.app. This is were the bad performance results from.
xpressvideoz 5y ago
One thing I noticed when using podman was that it was slower than Docker. Perhaps due to its daemonless nature?
- geenat 5y ago
  Because rootless currently needs slirp4netns for IP resolution. Rootless Docker, when configured properly, is essentially the same speed.
- akvadrako 5y ago
  Generally it's slower because you can't use overlay mounts without root.
  - rhatdan 5y ago
    This is no longer true. As of kernel 5.13 podman can use rootless native overlay.
gootler 5y ago
Great, another piece of shit gonna be obsolete in a few years.
geenat 5y ago
More love needs to go into docker-compose for podman. https://github.com/containers/podman-compose https://github.com/containers/podman-compose
- jordemort 5y ago
  I've been using regular old docker-compose with podman since podman 3.2.0. You need to enable the podman socket, which kind of takes away some of the daemonless fun, but once you do that (and point your DOCKER_HOST at the appropriate location), you can "docker-compose up" and it will just work.
- ron0c 5y ago
  I used to think so until I started just using bash scripts in replacement of docker-compose files.
  - ageofwant 5y ago
    What is your bash depends_on: equivalent ? I like the idea of keeping it simple bash, but seems like it is a step back.
    - arve0 5y ago
      I’ve used wait-for-it with success. https://github.com/vishnubob/wait-for-it https://github.com/vishnubob/wait-for-it
    - ron0c 5y ago
      I had to look up what depends_on accomplishes, so maybe I'm missing something here, but wouldn't an If/then/else sort that out as well as give you more options?
  - lucb1e 5y ago
    Anecdotally, and perhaps keep in mind I'm quite skilled with bash, in school we had a few people managing their desktops with scripts. Set things like desktop preferences, ssh config, sometimes add a different desktop environment (we each had our own user and it worked with LDAP, so we roamed around and that's why this was useful). I was the only one using bash, some others in my year used Ansible. They seemed to be spending half of each afternoon trying to fix something in Ansible, also trying to use other people's scripts if I remember correctly, etc.; for me another preference was just another line of bash and it worked reliably given that the desktops were all the same OS. If you know bash already and you don't want to use it to reinvent a big wheel, yeah I would not hesitate to use it after seeing this struggle with more modern tools. Most of the Docker setup configs I see are already 60% bash commands strung together with backslashes on each line and broken syntax highlighting (because you're in a different file format).
KuiN 5y ago
Does Podman offer anything similar to Docker Swarm? I absolutely love Swarm mode (yet to find a simpler way of organising containers over a few small nodes), but do not want to deal with Docker the company.
- proxysna 5y ago
  sadly they do not provide anything like Swarm and suggest to use k8s.
- Iwan-Zotow 5y ago
  no, no orchestration, I believe use Kubernetes
  - caymanjim 5y ago
    Kubernetes is a huge leap in complexity for small deployments. You can simplify it with wrappers like minikube and k3s but there's still a learning curve. It'd be nice to have a simple free alternative to Swarm.
    - xfalcox 5y ago
      That would be Hashicorp Nomad.
      - linsomniac 5y ago
        Honest question: Is it Nomad? Because I've literally spent a couple hours watching Hashicorp videos on Nomad, and I know how to install and secure it, but I still have no idea what TF Nomad is/does. Maybe a distributed cron, that apparently has the ability to spin up a million containers? Edit because of downvote: No, really, I'm serious. Any references to how Nomad solves the Swarm/K8s problem, because I've spent my spare time this week trying to understand it and still don't know what Nomad even is.
        rob-olmos 5y ago
pletnes 5y ago
Does this work on WSL2 / win10? There’s nothing explicit in the readme.
- TrueDuality 5y ago
  It does not. Podman relies on kernel features that are not implemented in the WSL compatibility layer.
  - kapilvt 5y ago
    Wsl2 is running a Linux vm aka real kernel https://docs.microsoft.com/en-us/windows/wsl/compare-versions https://docs.microsoft.com/en-us/windows/wsl/compare-version...
  - gbraad 5y ago
    It does (WSL2). Have worked with them on making sure this works and is described. Tested on a fedora image and ubuntu
  - stephankoelle 5y ago
    We use wsl2 with podman, works good.
- woogley 5y ago
  Yes, the install instructions says WSL2 is fine: https://podman.io/getting-started/installation https://podman.io/getting-started/installation
INTPenis 5y ago
Also from that ecosystem, buildah. I started using buildah to build container images in CI jobs because then the job can run in an unprivileged container, unlike docker. At the time I only knew of kaniko that could do this but I preferred buildah for a number of reasons. Buildah is really awesome at multi stage builds because you can use it from bash.
- dolni 5y ago
  Buildah is what the Dockerfile could have been. Instead of using general-purpose shell scripting knowledge to produce images, we ended up with a custom instruction file, complete with its own quirks. I am not sure why everyone seems to think inventing their own domain-specific language is a good thing. It isn't.
- dengolius 5y ago
  Did you try https://github.com/werf/werf https://github.com/werf/werf ? Check authors blog with articles about werf https://blog.flant.com/tag/werf/ https://blog.flant.com/tag/werf/
- pidminusone 5y ago
  Buildkit has a daemonless / rootless mode nowadays.
- forty 5y ago
  I use kaniko a lot. Could you please expend on why you preferred buidah? (I'm happy with kaniko, and curious)
  - INTPenis 5y ago
    First of all I'm a Fedora user and podman/buildah have been recommended since Fedora switched to cgroupsv2. But also I prefer using open source projects from communities and companies who are based around open source. Google do contribute a lot to open source but they're primarily an ad company who want your data. So consider using buildah a type of boycott. ;) I use buildah privately whenever I need to quickly make an image to test something, it's so simple to use in bash. It's also very simple to add to existing images while you're testing it. So it was just natural to continue using it in CI pipelines. I only ever used one command for kaniko so I'll admit I know nothing of it, and that was 2 years ago. But buildah feels a lot more accessible because I learned all the different shell commands that correspond to the Containerfile format.
exabrial 5y ago
Ubiquiti, their UDM Pro, uses Podman to manage contains running configuration webapps for their router. Kinda cool :)
- lucb1e 5y ago
  The ubiquiti software, mainly the controller, is some of the worst I've ever seen. Bought one of their devices based on the recommendation of a friend, but never again. The controller is cordoned off now but I'm uneasy about the internet access it needs for updates. Also, with every update I need to wonder if it's going to nuke the config and factory reset the switch again (need remote hands when that happens). Then again, I have no experience with other "enterprise" switches. All I needed is one ~20-port switch that can do VLANs anyway, so perhaps I should find one with simple old serial control and I just plug that into one of the servers for remote management.
strzibny 5y ago
Podman is a great Docker alternative. That's why I already included it alongside Docker in https://deploymentfromscratch.com/ https://deploymentfromscratch.com/. It fits nicely in the world of systemd services where Podman let's you run the container just as you would run the containerized service directly. I hope the future will be bright and maybe we won't need Docker the runtime anymore.
whitepoplar 5y ago
How does Podman compare to LXD?
- mohanmcgeek 5y ago
  Application containers vs system containers. Lxd is a daemon for lxc, which last I checked was focused on creating system containers. This means it probably can't run OCI
- hda111 5y ago
  Both can run systemd in containers. Podman can be used for system containers. Podman can start containers without root privilege while LXD is a daemon that needs to run as root.
  - cassianoleal 5y ago
    LXD is, but LXC can run rootless containers just as well. In this sense, it's similar to running the Podman-compose daemon as root, but rootless containers on it.
- zekrioca 5y ago
  One can create a cluster of system containers with LXD, as opposed to local application containers (podman).
maweki 5y ago
From a previous discussion: One very interesting piece of tech coming from podman, is toolbox (https://github.com/containers/toolbox https://github.com/containers/toolbox). Basically throwaway (or keeparound) rootless containers with their own root directory but shared HOME. Install hundreds of dev-dependencies to build this one piece of software? Yeah, not gonna install those packages permanently. Spin up a toolbox, build it, install it in my home/.local. You have root in the container without having root in the host system. That takes care of a lot of issues as well. I basically no longer have development packages installed and run some applications with lots of dependencies out of toolboxes.
- nickstinemates 5y ago
  Sounds like a chroot with extra steps
  - detaro 5y ago
    That's a way to describe pretty much all container things in a superficial way.
    - scatters 5y ago
      It's not even superficial. A chroot is a limiting case of a container that only rebinds the filesystem; or, equally, a container is a chroot that also rebinds the user namespace, process namespace, networking, etc.
      - yakubin 5y ago
        Can you escape from a mount namespace? You can escape from a chroot.
        majewsky 5y ago
        You can change into an existing mount namespace, which is what commands like "docker exec" or "machinectl shell" do to execute a command within the mount namespace of an existing container. The container can do the same to escape its mount namespace, but it needs privileges to execute the respective namespace-changing syscall, and it needs to know which namespace to change into. I have an application in a Kubernetes-managed container which needs to do exactly this to access the host system (to open LUKS containers and mount their contents), so I have it run in privileged mode (i.e. with access to all syscalls) and give it the full host filesystem as a bind mount, so it can do: nsenter -m /host/proc/1/ns/mnt mount $DEV $PATH (The actual nsenter invocation is slightly more complicated, but that's the basic gist.) Side-note: Since there will inevitably be a comment along the lines of "but then what do you even need isolation for", I'm very explicitly using Kubernetes as a deployment mechanism only. Other pods within the same Kubernetes are strictly isolated, but this one deliberately runs with practically no isolation. But I still get the consistent environment that Kubernetes provides (rolling upgrades, log shipping, liveness probes, etc.).
debarshri 5y ago
Completely different topic, but I think it is related. Docker-in-Docker daemonless build systems have always fascinated me. I have tracking kaniko and buildkit lately. Buildkit can behave like kaniko in a daemonless mode. I was a big fan of kaniko but somehow to me it feels a bit dead. Few months back, I was trying do a PaaS like setup with multi-stage dockerfile, it failed terribly. Because of the way kaniko writes files in the host container, it would overwrite the files crashing the container. Sometimes, it would just hang and disk would get full. Did not face that issues with buildkit daemonless and just worked seamlessly.
kristianpaul 5y ago
Does it works with docker compose files? Thats why i still use docker these days tbh
- kitd 5y ago
  Not Compose specifically. It does use 'pods' though, which are the unit of deployment in Kubernetes. This makes porting your cluster into K8s (should you wish) very simple.
- _ix 5y ago
  In recent podman releases, yes. https://podman.io/blogs/2021/01/11/podman-compose.html https://podman.io/blogs/2021/01/11/podman-compose.html
yepthatsreality 5y ago
Glad podman exists (uninstalled docker and never looked back) and hoping more people write their guides/blogs using it instead of docker to break up the lock-in and single mindedness around containers.
2ion 5y ago
Our helpdesk will recommend Devs to switch to canonical multipass + podman on their mac dev machines, away from Docker Desktop for mac. Currently, the helpdesk is whipping up a provisioning package that includes scripts that make docker CLI and docker-compose work from the host system just as before (shimming & proxying to VM commands/tools). Windows users will just use WSL2.
- pojzon 5y ago
  The moment ppl got notification about Docker Desktop going to paid version only for corpo -> everyone freaked out. This will make ppl look for alternatives now.
  - Aeolun 5y ago
    Yeah, I’m just a poor enterprise developer, but now suddenly I cannot use docker desktop any more, and it was already a very PITA program.
    - thedougd 5y ago
      It will be the end of them.
lifty 5y ago
Another great Docker alternative from one of the containerd maintainers (Akihiro Suda) is https://github.com/containerd/nerdctl https://github.com/containerd/nerdctl. It supports compose as well.
EnigmaCurry 5y ago
Due to security concerns of enabling user namespaces[1], I don't run rootless podman containers any more, and my current podman use on my workstation is to run rootful podman containers inside a VM (KVM with virt-manager, actually running Proxmox, which does nested virtualization for podman VM[2].), and configures those containers as systemd services with ansible. I'd really rather just use docker-compose (or a 100% UI clone like podman-compose), but for me the whole point of using podman was to limit the API attack vector, and using the single process model, so introducing the docker API into podman isn't really what I wanted either. (podman-compose doesn't need the API but theres other reasons I haven't used that.) I think though, you can't really replace docker with podman (without docker API) in a general sense. You just have to treat it as its own container platform. It will work for certain docker containers you've tested reliably, but if you regularly test out random container stuff you will run into problems on a daily basis. But you can use podman for new container development (because you're the one implementing it and avoiding the problems) that will also be compatible with docker. Configuring Traefik on podman has been painful[3] because it relies upon docker labels for configuration discovery (you can still write a static config file without discovery, but gets tedious), and now that there is docker API support it works, maybe no one cares to have a true dockerless podman Traefik provider, but I think that would be neat, and can probably be written with the new providers plugins[4] [1] https://news.ycombinator.com/item?id=28393949 https://news.ycombinator.com/item?id=28393949 [2] https://blog.rymcg.tech/tags/proxmox https://blog.rymcg.tech/tags/proxmox [3] https://github.com/traefik/traefik/issues/5730 https://github.com/traefik/traefik/issues/5730 [4] https://github.com/traefik/pluginproviderdemo https://github.com/traefik/pluginproviderdemo
- KronisLV 5y ago
  > ...and my current podman use on my workstation is to run rootful podman containers inside a VM... This makes me feel that perhaps we're slowly moving in the direction of a full circle, to how Docker Toolbox worked inside of VirtualBox, at least on Windows: https://docs.docker.com/toolbox/ https://docs.docker.com/toolbox/ Here's an example of someone's experience with setting it up: https://medium.com/@peorth/using-docker-with-virtualbox-and-windows-10-b351e7a34adc https://medium.com/@peorth/using-docker-with-virtualbox-and-... The industry seems to be slowly advancing, with Podman, Docker with HyperV and now with WSL2 integration, all just to solve the hard permission and runtime problem, whereas the actual OCI standard and the tooling that Docker provides for getting things up and running (environment variables, resource limits, exposing ports etc., with a few warts here and there) was sufficient from the beginning for the most part. > I think though, you can't really replace docker with podman (without docker API) in a general sense. With this, i agree, but perhaps i've ended up with a different set of conclusions. Docker and the tools like it are good for deploying applications in a mostly reproducible way and essentially solving the dependency management issue in a sub-optimal yet passable way. Because of all of the tools solving this problem and it oftentimes being a chief concern for it being chosen, all else becomes secondary, short of pressing issues like exploits and such. To that end, Docker inside of a VM, with separate VMs for separate apps and separate clusters for separate environments seems like the least painful option - decent security, somewhat limited attack surface, not relying on just one technology to be secure (even Podman has its exploits), but with the wide support that Docker has. For example, you could have your project, which has a few front end containers, a few various services for the back end and a few databases, also in containers. You could essentially have 1 VM per environment with all of those running (development, testing, accept testing) in the less important deployments, but have as many VMs and servers as you need for the important ones (staging, production). Then, have separate container clusters (with something like Docker Swarm) for your development environments and the production ones and you should be good. Sometimes the path of least resistance isn't all that bad. At least until Podman is stable enough to be a daily driver, be it in 5 years, 10 years or never.
Macha 5y ago
I've been a bit disillusioned with podman recently for breakage reasons. The cgroups v2 migration for example have caused a lot of pods to break and require recreation and the error message for debugging this problems are not reported well. The docs are also not missing any detail that would help debug this kind of problems. The underlying runtime leaks through, but it feels like the podman docs don't want to document that, but they also don't point to anywhere where it is documented. So you end googling this issue, find people in the issue tracker having their issues closed because it's a problem with the runtime and then try to map the error you're seeing in podman to the other projects to google to see if there's any reported information.
- foresto 5y ago
  > The underlying runtime leaks through For those of us who have never used Podman or explored the depths of Docker, can you explain what you mean by that?
  - Macha 5y ago
    A recent example > $ podman start my_container > sd-bus call: Permission denied: OCI runtime permission denied error What on earth is an on OCI runtime? How are its permissions configured? Here's some issues with some random flags to configure: https://github.com/containers/podman/issues/6368 https://github.com/containers/podman/issues/6368 . How are these linked to podman? The devs know, where is this documented for Joe random user? Or another one I ran into: https://github.com/containers/podman/issues/7830 https://github.com/containers/podman/issues/7830 Again, here's some settings in files in /etc/containers to configure that might fix it? Where is this in the podman docs, or release notes? Just found my pods didn't start after an update one day and had to dig into github issues.
    - foresto 5y ago
      I see. So the criticism here is that Podman's error reporting is sometimes insufficient to explain an error triggered by systemd/cgroup changes. Docker has the same (class of) problem: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992486 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992486 It is indeed frustrating. I don't think I'll count it as a reason to avoid Podman, though, since Docker is no better.
unemphysbro 5y ago
I'm pretty new to virtualization, what're the pros/cons of podman vs docker in prod.?
k8s_Hero 5y ago
There's another tool that allows you to drill-down events in K8s on the pod level and even see pod logs in real time, all in one place: https://komodor.com/blog/new-pod-status-and-logs-dash-saves-time-and-unifies-execution/ https://komodor.com/blog/new-pod-status-and-logs-dash-saves-...

421 points by mohanmcgeek 5y ago

Let’s Secure WiFi Network and Prevent WiFi Hacking: https://www.hackerslist.co/lets-secure-wifi-network-and-prevent-wifi-hacking/ https://www.hackerslist.co/lets-secure-wifi-network-and-prev...

zz865 5y ago

Podman is great because we dont get root access on our boxes at work. One problem is someone still needs root access to install - or does anyone know if its possible to install as regular user?

ask2sk 5y ago
The following reply in GitHub addresses your question: >>that is more difficult to get as you'd need to install all dependencies in your home directory and prepare all the configuration files to use/point the right executables. We have nothing at the moment for bootstrapping podman and its dependencies from scratch for an unprivileged user. The easiest would be to install it on the system, but still use the unprivileged users for running the containers. https://github.com/containers/podman/issues/3100 https://github.com/containers/podman/issues/3100
Klasiaster 5y ago
I don't think this will work unless you have a range of user and group IDs allocated for your user. Those will be used for non-root in-container users. $ echo USERNAME:10000:65536 >> /etc/subuid $ echo USERNAME:10000:65536 >> /etc/subgid
- akvadrako 5y ago
  Technically you don't need those if you always run your contains as a single user mapped to your real UID.
  - prpl 5y ago
    I know uid 0 in container will always map to uid outside the container (e.g. 1005), but I haven't tried e.g. uid 999 in the container to ensure it maps to uid outside of the container (again, 1005), does that work?
    - foresto 5y ago
      > I know uid 0 in container will always map to uid outside the container I don't think that's true. Have a look at Podman's --userns=keep-id and related options.
      - prpl 5y ago
        ah yeah, I had forgot about that one specifically

proxysna 5y ago

Great replacement for docker. For personal use it is pretty much a drop-in replacement. I used it with hashicorp nomad, and so far had no issues at all. One thing that might be an issue for some is Docker-in-Docker thing is kinda broken. (was around 8-10 months ago, not sure about now.)

easton 5y ago
Looks like this was resolved in the last couple months: https://www.redhat.com/sysadmin/podman-inside-container https://www.redhat.com/sysadmin/podman-inside-container
agravier 5y ago
Can't replace the docker desktop app on a mac unfortunately
- lpasselin 5y ago
  Tested podman to replace docker (the cli) on a mac yesterday Most of it works fine. They have an easy way to setup a vm now with `podman machine`: https://podman.io/getting-started/installation#macos https://podman.io/getting-started/installation#macos If you want the management GUI, install cockpit: https://github.com/cockpit-project/cockpit-podman https://github.com/cockpit-project/cockpit-podman Try podman, you'll be impressed.
- Daegalus 5y ago
  there is also rancher desktop and minikube podman-env that will both work fine as alternatives to docker desktop.

SEJeff 5y ago

On macOS brew install podman; podman machine init; podman machine start; podman run ...

cpach 5y ago
Interesting… Will podman automatically create and launch a Linux VM where the containers will live?
- esamatti 5y ago
  Seems like it ------- Podman is a tool for running Linux containers. You can do this from a MacOS desktop as long as you have access to a linux box either running inside of a VM on the host, or available via the network. Podman includes a command, podman machine that automatically manages VM’s. To start the Podman-managed VM: podman machine init podman machine start ------- from: https://podman.io/getting-started/installation https://podman.io/getting-started/installation
  - jhickok 5y ago
    Seems to have some issues creating the temp directories for the VM in an automated fashion (at least with the Homebrew package). But it will work with some tinkering.
b3n4kh 5y ago
It seems like podman machine is deprecated: https://www.redhat.com/sysadmin/replace-docker-podman-macos https://www.redhat.com/sysadmin/replace-docker-podman-macos
- SEJeff 5y ago
  This is from the guy that leads the container team at Redhat: https://twitter.com/rhatdan/status/1433003250991706114?s=21 https://twitter.com/rhatdan/status/1433003250991706114?s=21
  - 5y ago

_red 5y ago

There are lots of cools aspects of podman, for the admin one the real nice things is its integration with systemd. podman generate systemd <containerid> to generate .service files which can then be launched via systemd.

agilob 5y ago
can you get journal logs from a pod? archive and limit logs size etc using existing systemd configuration?
- _red 5y ago
  yes, via journalctl
torvald 5y ago
Neat, thanks for the tip!
spicyusername 5y ago
This is a super underrated feature. You can do some really cool things when you combine this with Ignition and Fedora CoreOS. Ignition has the ability to manage systemd units on boot. https://docs.fedoraproject.org/en-US/fedora-coreos/running-containers/#_introduction https://docs.fedoraproject.org/en-US/fedora-coreos/running-c... https://developers.redhat.com/blog/2020/03/12/how-to-customize-fedora-coreos-for-dedicated-workloads-with-ostree https://developers.redhat.com/blog/2020/03/12/how-to-customi... Automatically boot, bootstrap the OS, and run your containers via systemd, all driven by infrastructure-as-code ignition files. A much simpler edge or single-node container experience than using Kubernetes.

tifadg1 5y ago

I like podman, but is there any progress with monitoring solutions? cAdvisor image didn't work last I checked. What I need is a way for data to flow into prometheus.

owaislone 5y ago
Podman does support docker API so you can use something like the OpenTelemetry Collector to fetch metrics using the docker API and forward them to prometheus. Collector: https://github.com/open-telemetry/opentelemetry-collector-contrib https://github.com/open-telemetry/opentelemetry-collector-co... Docker receiver: https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/dockerstatsreceiver https://github.com/open-telemetry/opentelemetry-collector-co... Prometheus exporters: https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/exporter/prometheusremotewriteexporter https://github.com/open-telemetry/opentelemetry-collector-co... and https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/exporter/prometheusexporter https://github.com/open-telemetry/opentelemetry-collector-co... OpenTelemetry will soon support native Podman API as well.
- hetspookjee 5y ago
  Not sure why you seem to receive downvotes. Seems like a pretty nice layout and comment. Anyone interested in explaining why you're receiving downvotes?
  - owaislone 5y ago
    I've seen anything that mentions the word "telemetry" automatically receive down votes on HN. People confuse it with companies collecting user-identifiable data from clients like apps/browsers.

aorth 5y ago

podman has been an amazing project to follow. Since early 2020 I've been using it for rootless containers with no daemon on my Linux development environment. Development pace is picking up and I get excited every time I get a notification from GitHub about a new tagged release. As a bonus, the podman-compose script https://github.com/containers/podman-compose/ https://github.com/containers/podman-compose/ is getting good too!

gizdan 5y ago
You do not need podman-compose, in fact it is quite inferior to docker-compose. Podman has added full docker-compose support, and in fact even the docker binary works with it. Rootfull works as of v3.0.0, rootless was added in 3.2.0. Rootless can be a bit buggy, but I believe they polished a lot of the issues for 3.3.0. Because they've re-implemented the docker api, it can actually work with any tool that uses docker's API.
- jackhalford 5y ago
  > Podman has added full docker-compose support any pointers as to how this works?
  - rubenbe 5y ago
    IIRC it's emulating the docker socket and its API. As a consequence, you do need to have a podman daemon running. https://fedoramagazine.org/use-docker-compose-with-podman-to-orchestrate-containers-on-fedora/ https://fedoramagazine.org/use-docker-compose-with-podman-to... https://www.redhat.com/sysadmin/podman-docker-compose https://www.redhat.com/sysadmin/podman-docker-compose
  - gizdan 5y ago
    As rubenbe said, they implemented the docker API, thus you'll need to start a systemd socket. For rootless the steps are as simple as systemctl enable --now --user podman.socket export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock For rootfull just remove "--user" from the above command, and the socket is located at /var/podman/podman.sock Then you can run both docker and docker-compose commands. Traefik and other things that use the Docker API directly should be able to use it too. Any issues you can raise on the GitHub repo, they're a bunch of friendly folks and are pretty quick at addressing issues.

Anarch157a 5y ago

What I like most about it is that it can run as any user. There's no need for a daemon that starts as privileged user. Another benefit is that all images and container reside on a hidden directory in $HOME.

tacobelllover99 5y ago
Tell me you are a Dev without telling me you are a Dev
judge2020 5y ago
Docker also has a rootless mode as of 19.03: https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/
- GordonS 5y ago
  Wow, how did I not know about this! Unless I'm missing something, the limitations mentioned in the docs don't seem too limiting. Is there anything that needs to be changed or watched out for in real life?
  - foresto 5y ago
    It requires a kernel that allows unprivileged user namespaces. Docker images that run as uid 0, which many of them do, could potentially exploit their way out of the container, since kernel code running as (actual or namespaced) uid 0 hasn't been extensively tested to be safe and bug-free. You might have to experiment with different "drivers" to get the overlay filesystem and cgroups components to work on any given host. (These are not hardware drivers, but something more like docker subsystem plugins.) By default, it expects a dbus user session, which a headless server might not have. You can either enable one or configure a different `cgroupdriver`.
    - staticassertion 5y ago
      TBH the Linux kernel isn't capable of providing an isolation boundary anyways, so while it's a meaningful regression if your assumption is "attacker in the container" I highly recommend using gVisor or Firecracker, or otherwise reducing the need to trust the Linux kernel for anything like resisting hostile local attackers.

rubyist5eva 5y ago

Is this being posted here because of Docker changing their terms of service for their Desktop app? Also the performance on macOS vs a parallels VM just running podman and forwarding ports is night and day. I switched to podman ages ago because I didn’t want a root daemon on my machine anymore, but the new pricing scheme is especiallly egregious.

infogulch 5y ago
This fact seems relevant to the discussion.
- rubyist5eva 5y ago
  When I got the email notifiying me of the changes, I couldn't believe it...5 dollar per user for a basic wrapper around an open source tool? Are they serious with this?
hda111 5y ago
Doesn’t seem to be a fair comparison. Docker Desktop has access to your whole filesystem and can be used transparently in Terminal.app. This is were the bad performance results from.

xpressvideoz 5y ago

One thing I noticed when using podman was that it was slower than Docker. Perhaps due to its daemonless nature?

geenat 5y ago
Because rootless currently needs slirp4netns for IP resolution. Rootless Docker, when configured properly, is essentially the same speed.
akvadrako 5y ago
Generally it's slower because you can't use overlay mounts without root.
- rhatdan 5y ago
  This is no longer true. As of kernel 5.13 podman can use rootless native overlay.

gootler 5y ago

Great, another piece of shit gonna be obsolete in a few years.

geenat 5y ago

More love needs to go into docker-compose for podman. https://github.com/containers/podman-compose https://github.com/containers/podman-compose

jordemort 5y ago
I've been using regular old docker-compose with podman since podman 3.2.0. You need to enable the podman socket, which kind of takes away some of the daemonless fun, but once you do that (and point your DOCKER_HOST at the appropriate location), you can "docker-compose up" and it will just work.
ron0c 5y ago
I used to think so until I started just using bash scripts in replacement of docker-compose files.
- ageofwant 5y ago
  What is your bash depends_on: equivalent ? I like the idea of keeping it simple bash, but seems like it is a step back.
  - arve0 5y ago
    I’ve used wait-for-it with success. https://github.com/vishnubob/wait-for-it https://github.com/vishnubob/wait-for-it
  - ron0c 5y ago
    I had to look up what depends_on accomplishes, so maybe I'm missing something here, but wouldn't an If/then/else sort that out as well as give you more options?
- lucb1e 5y ago
  Anecdotally, and perhaps keep in mind I'm quite skilled with bash, in school we had a few people managing their desktops with scripts. Set things like desktop preferences, ssh config, sometimes add a different desktop environment (we each had our own user and it worked with LDAP, so we roamed around and that's why this was useful). I was the only one using bash, some others in my year used Ansible. They seemed to be spending half of each afternoon trying to fix something in Ansible, also trying to use other people's scripts if I remember correctly, etc.; for me another preference was just another line of bash and it worked reliably given that the desktops were all the same OS. If you know bash already and you don't want to use it to reinvent a big wheel, yeah I would not hesitate to use it after seeing this struggle with more modern tools. Most of the Docker setup configs I see are already 60% bash commands strung together with backslashes on each line and broken syntax highlighting (because you're in a different file format).

KuiN 5y ago

Does Podman offer anything similar to Docker Swarm? I absolutely love Swarm mode (yet to find a simpler way of organising containers over a few small nodes), but do not want to deal with Docker the company.

proxysna 5y ago
sadly they do not provide anything like Swarm and suggest to use k8s.
Iwan-Zotow 5y ago
no, no orchestration, I believe use Kubernetes
- caymanjim 5y ago
  Kubernetes is a huge leap in complexity for small deployments. You can simplify it with wrappers like minikube and k3s but there's still a learning curve. It'd be nice to have a simple free alternative to Swarm.
  - xfalcox 5y ago
    That would be Hashicorp Nomad.
    - linsomniac 5y ago
      Honest question: Is it Nomad? Because I've literally spent a couple hours watching Hashicorp videos on Nomad, and I know how to install and secure it, but I still have no idea what TF Nomad is/does. Maybe a distributed cron, that apparently has the ability to spin up a million containers? Edit because of downvote: No, really, I'm serious. Any references to how Nomad solves the Swarm/K8s problem, because I've spent my spare time this week trying to understand it and still don't know what Nomad even is.
      - rob-olmos 5y ago

pletnes 5y ago

Does this work on WSL2 / win10? There’s nothing explicit in the readme.

TrueDuality 5y ago
It does not. Podman relies on kernel features that are not implemented in the WSL compatibility layer.
- kapilvt 5y ago
  Wsl2 is running a Linux vm aka real kernel https://docs.microsoft.com/en-us/windows/wsl/compare-versions https://docs.microsoft.com/en-us/windows/wsl/compare-version...
- gbraad 5y ago
  It does (WSL2). Have worked with them on making sure this works and is described. Tested on a fedora image and ubuntu
- stephankoelle 5y ago
  We use wsl2 with podman, works good.
woogley 5y ago
Yes, the install instructions says WSL2 is fine: https://podman.io/getting-started/installation https://podman.io/getting-started/installation

INTPenis 5y ago

Also from that ecosystem, buildah. I started using buildah to build container images in CI jobs because then the job can run in an unprivileged container, unlike docker. At the time I only knew of kaniko that could do this but I preferred buildah for a number of reasons. Buildah is really awesome at multi stage builds because you can use it from bash.

dolni 5y ago
Buildah is what the Dockerfile could have been. Instead of using general-purpose shell scripting knowledge to produce images, we ended up with a custom instruction file, complete with its own quirks. I am not sure why everyone seems to think inventing their own domain-specific language is a good thing. It isn't.
dengolius 5y ago
Did you try https://github.com/werf/werf https://github.com/werf/werf ? Check authors blog with articles about werf https://blog.flant.com/tag/werf/ https://blog.flant.com/tag/werf/
pidminusone 5y ago
Buildkit has a daemonless / rootless mode nowadays.
forty 5y ago
I use kaniko a lot. Could you please expend on why you preferred buidah? (I'm happy with kaniko, and curious)
- INTPenis 5y ago
  First of all I'm a Fedora user and podman/buildah have been recommended since Fedora switched to cgroupsv2. But also I prefer using open source projects from communities and companies who are based around open source. Google do contribute a lot to open source but they're primarily an ad company who want your data. So consider using buildah a type of boycott. ;) I use buildah privately whenever I need to quickly make an image to test something, it's so simple to use in bash. It's also very simple to add to existing images while you're testing it. So it was just natural to continue using it in CI pipelines. I only ever used one command for kaniko so I'll admit I know nothing of it, and that was 2 years ago. But buildah feels a lot more accessible because I learned all the different shell commands that correspond to the Containerfile format.

exabrial 5y ago

Ubiquiti, their UDM Pro, uses Podman to manage contains running configuration webapps for their router. Kinda cool :)

lucb1e 5y ago
The ubiquiti software, mainly the controller, is some of the worst I've ever seen. Bought one of their devices based on the recommendation of a friend, but never again. The controller is cordoned off now but I'm uneasy about the internet access it needs for updates. Also, with every update I need to wonder if it's going to nuke the config and factory reset the switch again (need remote hands when that happens). Then again, I have no experience with other "enterprise" switches. All I needed is one ~20-port switch that can do VLANs anyway, so perhaps I should find one with simple old serial control and I just plug that into one of the servers for remote management.

strzibny 5y ago

Podman is a great Docker alternative. That's why I already included it alongside Docker in https://deploymentfromscratch.com/ https://deploymentfromscratch.com/. It fits nicely in the world of systemd services where Podman let's you run the container just as you would run the containerized service directly. I hope the future will be bright and maybe we won't need Docker the runtime anymore.

whitepoplar 5y ago

How does Podman compare to LXD?

mohanmcgeek 5y ago
Application containers vs system containers. Lxd is a daemon for lxc, which last I checked was focused on creating system containers. This means it probably can't run OCI
hda111 5y ago
Both can run systemd in containers. Podman can be used for system containers. Podman can start containers without root privilege while LXD is a daemon that needs to run as root.
- cassianoleal 5y ago
  LXD is, but LXC can run rootless containers just as well. In this sense, it's similar to running the Podman-compose daemon as root, but rootless containers on it.
zekrioca 5y ago
One can create a cluster of system containers with LXD, as opposed to local application containers (podman).

maweki 5y ago

From a previous discussion: One very interesting piece of tech coming from podman, is toolbox (https://github.com/containers/toolbox https://github.com/containers/toolbox). Basically throwaway (or keeparound) rootless containers with their own root directory but shared HOME. Install hundreds of dev-dependencies to build this one piece of software? Yeah, not gonna install those packages permanently. Spin up a toolbox, build it, install it in my home/.local. You have root in the container without having root in the host system. That takes care of a lot of issues as well. I basically no longer have development packages installed and run some applications with lots of dependencies out of toolboxes.

nickstinemates 5y ago
Sounds like a chroot with extra steps
- detaro 5y ago
  That's a way to describe pretty much all container things in a superficial way.
  - scatters 5y ago
    It's not even superficial. A chroot is a limiting case of a container that only rebinds the filesystem; or, equally, a container is a chroot that also rebinds the user namespace, process namespace, networking, etc.
    - yakubin 5y ago
      Can you escape from a mount namespace? You can escape from a chroot.
      - majewsky 5y ago
        You can change into an existing mount namespace, which is what commands like "docker exec" or "machinectl shell" do to execute a command within the mount namespace of an existing container. The container can do the same to escape its mount namespace, but it needs privileges to execute the respective namespace-changing syscall, and it needs to know which namespace to change into. I have an application in a Kubernetes-managed container which needs to do exactly this to access the host system (to open LUKS containers and mount their contents), so I have it run in privileged mode (i.e. with access to all syscalls) and give it the full host filesystem as a bind mount, so it can do: nsenter -m /host/proc/1/ns/mnt mount $DEV $PATH (The actual nsenter invocation is slightly more complicated, but that's the basic gist.) Side-note: Since there will inevitably be a comment along the lines of "but then what do you even need isolation for", I'm very explicitly using Kubernetes as a deployment mechanism only. Other pods within the same Kubernetes are strictly isolated, but this one deliberately runs with practically no isolation. But I still get the consistent environment that Kubernetes provides (rolling upgrades, log shipping, liveness probes, etc.).

debarshri 5y ago

Completely different topic, but I think it is related. Docker-in-Docker daemonless build systems have always fascinated me. I have tracking kaniko and buildkit lately. Buildkit can behave like kaniko in a daemonless mode. I was a big fan of kaniko but somehow to me it feels a bit dead. Few months back, I was trying do a PaaS like setup with multi-stage dockerfile, it failed terribly. Because of the way kaniko writes files in the host container, it would overwrite the files crashing the container. Sometimes, it would just hang and disk would get full. Did not face that issues with buildkit daemonless and just worked seamlessly.

kristianpaul 5y ago

Does it works with docker compose files? Thats why i still use docker these days tbh

kitd 5y ago
Not Compose specifically. It does use 'pods' though, which are the unit of deployment in Kubernetes. This makes porting your cluster into K8s (should you wish) very simple.
_ix 5y ago
In recent podman releases, yes. https://podman.io/blogs/2021/01/11/podman-compose.html https://podman.io/blogs/2021/01/11/podman-compose.html

yepthatsreality 5y ago

Glad podman exists (uninstalled docker and never looked back) and hoping more people write their guides/blogs using it instead of docker to break up the lock-in and single mindedness around containers.

2ion 5y ago

Our helpdesk will recommend Devs to switch to canonical multipass + podman on their mac dev machines, away from Docker Desktop for mac. Currently, the helpdesk is whipping up a provisioning package that includes scripts that make docker CLI and docker-compose work from the host system just as before (shimming & proxying to VM commands/tools). Windows users will just use WSL2.

pojzon 5y ago
The moment ppl got notification about Docker Desktop going to paid version only for corpo -> everyone freaked out. This will make ppl look for alternatives now.
- Aeolun 5y ago
  Yeah, I’m just a poor enterprise developer, but now suddenly I cannot use docker desktop any more, and it was already a very PITA program.
  - thedougd 5y ago
    It will be the end of them.

lifty 5y ago

Another great Docker alternative from one of the containerd maintainers (Akihiro Suda) is https://github.com/containerd/nerdctl https://github.com/containerd/nerdctl. It supports compose as well.

EnigmaCurry 5y ago

Due to security concerns of enabling user namespaces[1], I don't run rootless podman containers any more, and my current podman use on my workstation is to run rootful podman containers inside a VM (KVM with virt-manager, actually running Proxmox, which does nested virtualization for podman VM[2].), and configures those containers as systemd services with ansible. I'd really rather just use docker-compose (or a 100% UI clone like podman-compose), but for me the whole point of using podman was to limit the API attack vector, and using the single process model, so introducing the docker API into podman isn't really what I wanted either. (podman-compose doesn't need the API but theres other reasons I haven't used that.) I think though, you can't really replace docker with podman (without docker API) in a general sense. You just have to treat it as its own container platform. It will work for certain docker containers you've tested reliably, but if you regularly test out random container stuff you will run into problems on a daily basis. But you can use podman for new container development (because you're the one implementing it and avoiding the problems) that will also be compatible with docker. Configuring Traefik on podman has been painful[3] because it relies upon docker labels for configuration discovery (you can still write a static config file without discovery, but gets tedious), and now that there is docker API support it works, maybe no one cares to have a true dockerless podman Traefik provider, but I think that would be neat, and can probably be written with the new providers plugins[4] [1] https://news.ycombinator.com/item?id=28393949 https://news.ycombinator.com/item?id=28393949 [2] https://blog.rymcg.tech/tags/proxmox https://blog.rymcg.tech/tags/proxmox [3] https://github.com/traefik/traefik/issues/5730 https://github.com/traefik/traefik/issues/5730 [4] https://github.com/traefik/pluginproviderdemo https://github.com/traefik/pluginproviderdemo

KronisLV 5y ago
> ...and my current podman use on my workstation is to run rootful podman containers inside a VM... This makes me feel that perhaps we're slowly moving in the direction of a full circle, to how Docker Toolbox worked inside of VirtualBox, at least on Windows: https://docs.docker.com/toolbox/ https://docs.docker.com/toolbox/ Here's an example of someone's experience with setting it up: https://medium.com/@peorth/using-docker-with-virtualbox-and-windows-10-b351e7a34adc https://medium.com/@peorth/using-docker-with-virtualbox-and-... The industry seems to be slowly advancing, with Podman, Docker with HyperV and now with WSL2 integration, all just to solve the hard permission and runtime problem, whereas the actual OCI standard and the tooling that Docker provides for getting things up and running (environment variables, resource limits, exposing ports etc., with a few warts here and there) was sufficient from the beginning for the most part. > I think though, you can't really replace docker with podman (without docker API) in a general sense. With this, i agree, but perhaps i've ended up with a different set of conclusions. Docker and the tools like it are good for deploying applications in a mostly reproducible way and essentially solving the dependency management issue in a sub-optimal yet passable way. Because of all of the tools solving this problem and it oftentimes being a chief concern for it being chosen, all else becomes secondary, short of pressing issues like exploits and such. To that end, Docker inside of a VM, with separate VMs for separate apps and separate clusters for separate environments seems like the least painful option - decent security, somewhat limited attack surface, not relying on just one technology to be secure (even Podman has its exploits), but with the wide support that Docker has. For example, you could have your project, which has a few front end containers, a few various services for the back end and a few databases, also in containers. You could essentially have 1 VM per environment with all of those running (development, testing, accept testing) in the less important deployments, but have as many VMs and servers as you need for the important ones (staging, production). Then, have separate container clusters (with something like Docker Swarm) for your development environments and the production ones and you should be good. Sometimes the path of least resistance isn't all that bad. At least until Podman is stable enough to be a daily driver, be it in 5 years, 10 years or never.

Macha 5y ago

I've been a bit disillusioned with podman recently for breakage reasons. The cgroups v2 migration for example have caused a lot of pods to break and require recreation and the error message for debugging this problems are not reported well. The docs are also not missing any detail that would help debug this kind of problems. The underlying runtime leaks through, but it feels like the podman docs don't want to document that, but they also don't point to anywhere where it is documented. So you end googling this issue, find people in the issue tracker having their issues closed because it's a problem with the runtime and then try to map the error you're seeing in podman to the other projects to google to see if there's any reported information.

foresto 5y ago
> The underlying runtime leaks through For those of us who have never used Podman or explored the depths of Docker, can you explain what you mean by that?
- Macha 5y ago
  A recent example > $ podman start my_container > sd-bus call: Permission denied: OCI runtime permission denied error What on earth is an on OCI runtime? How are its permissions configured? Here's some issues with some random flags to configure: https://github.com/containers/podman/issues/6368 https://github.com/containers/podman/issues/6368 . How are these linked to podman? The devs know, where is this documented for Joe random user? Or another one I ran into: https://github.com/containers/podman/issues/7830 https://github.com/containers/podman/issues/7830 Again, here's some settings in files in /etc/containers to configure that might fix it? Where is this in the podman docs, or release notes? Just found my pods didn't start after an update one day and had to dig into github issues.
  - foresto 5y ago
    I see. So the criticism here is that Podman's error reporting is sometimes insufficient to explain an error triggered by systemd/cgroup changes. Docker has the same (class of) problem: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992486 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992486 It is indeed frustrating. I don't think I'll count it as a reason to avoid Podman, though, since Docker is no better.

unemphysbro 5y ago

I'm pretty new to virtualization, what're the pros/cons of podman vs docker in prod.?

k8s_Hero 5y ago

There's another tool that allows you to drill-down events in K8s on the pod level and even see pod logs in real time, all in one place: https://komodor.com/blog/new-pod-status-and-logs-dash-saves-time-and-unifies-execution/ https://komodor.com/blog/new-pod-status-and-logs-dash-saves-...