24 ms·

Migrating from Docker to Podman

337 points by FreeHugs 5y ago

yonran 5y ago
Can podman machine create a shared volume between your Mac and your container?
- brtknr 5y ago
  You can mount hostfs which I guess is the same thing
rochacon 5y ago
For those of you that still prefer a GUI to quickly toggle the VM, there is a simple app for that too: https://news.ycombinator.com/item?id=28412548 https://news.ycombinator.com/item?id=28412548
cmbernard333 5y ago
Planning to do this soon. Been looking for a reason to switch from the bloated docker for desktop.
riedel 5y ago
How does podman replace docker desktop? I thought it more as an alternative to the docker daemon, which is still free and open source. I start to wonder if people actually value open source if they run away from something just because some company publishes a commercial GUI. I like that with docker swarm one can without too much headache go from dev environments to a cluster. At university this seems much better than maintaining k8s. Podman seemed to be more interesting in rootless environments like HPC to me. I really what benefit switching to podman would actually bring to us.
- eddyg 5y ago
  > How does podman replace docker desktop? I don’t think it does. minikube probably comes closet. (But you could run podman instead of Docker inside minikube...)
- pred_ 5y ago
  It is straightforward to get Podman up and running in WSL2; it is also possible to set up Docker in WSL2 as well without Docker Desktop as well but it is much more painful. So in the Windows space, Podman effectively becomes an alternative to Docker Desktop, simply because the latter makes it possible to do Docker at all (ignoring the other things it does).
  - jayd16 5y ago
    What makes docker much more painful?
  - riedel 5y ago
    OK I start to get the problem with WSL2. I guess forking docker machine to support WSL2 natively would be a good way to go then.
    - riedel 5y ago
      I just noted that it seems to straight forward to extend machine via drivers and at least there is one for parallels. Also rancher seems to maintain a fork of machine itself so it seems unlikely to die as an alternative...
- nonameiguess 5y ago
  Using any sort of Linux container runtime on Mac requires a VM, since you can't otherwise get the Linux kernel features required. Docker Desktop and podman machine will both do the VM provisioning for you, and then you can use docker the container engine or podman to actually drive containers in the VM it gives you. So it effectively can replace it because podman machine will provision a VM for you, but you can of course use any other VM provisioner you want. There is no need to have it coupled to the container engine. It's worth noting if you have an M1 Mac, podman machine doesn't work on it yet. Docker Desktop does. Of course, the easiest way to use containerization technology if that's what you want to do is just use Linux workstations and don't worry about needing a kernel virtualization layer between your workstation and your container engine at all. Edit: Noting since sibling comments are discussing Windows and WSL that I'm talking specifically about replacing Docker Desktop on Mac because the article linked here is talking about using podman machine to replace Docker Desktop on Mac.
- jedahan 5y ago
  I wrote this dumb little shell script to use multipass + podman to replace docker-desktop. https://github.com/jedahan/podman-desktop https://github.com/jedahan/podman-desktop
- ithkuil 5y ago
  https://github.com/lima-vm/lima https://github.com/lima-vm/lima may fit your usecase
- ecnahc515 5y ago
  podman has a `machine` subcommand for setting up a VM for running podman. It configures the podman server and your podman client connects to the server, very much like docker. https://docs.podman.io/en/latest/markdown/podman-machine.1.html https://docs.podman.io/en/latest/markdown/podman-machine.1.h...
alias_neo 5y ago
Ive been using Podman for a while for my non-Kubernetes cloud deployments (i.e. small VM based things). It's worked very well for me after a few initial hiccups a year or so ago. Now that Podman-compose[0] is in the works, it'll really be comparable in the UX space soon, and outperforms Docker in several ways when it comes to security. The key difference with Podman compared to Docker is that is does not run a deamon as root, like Docker does, thus all containers are created with the privilege level of the user who created it. This can be a learning curve for those used to Docker as privileges (e.g. for filesystems, files) and capabilities (e.g. for devices, low level networking) need to be handled more explicitly as opposed to Docker's approach of "simon (root) says". Additionally, Podman is very light weight due to the lack of a daemon since there is no service or supporting software which needs to run beyond the capabilities baked into Linux. [0] https://github.com/containers/podman-compose https://github.com/containers/podman-compose EDIT TO ADD: I run Linux both on desktop and server so I have no data for usage in Windows/Mac. Docker Desktop, as I understand it, is a Linux VM.
- cpuguy83 5y ago
  Docker has a rootless mode in the same way that podman has a rootless mode.
  - nonameiguess 5y ago
    Although true, podman did have this feature first, and it's still experimental and unsupported in docker. Docker provides scripts to attempt the setup automatically if you're on a Debian or Red Hat based system, but if you're using something else, you're on your own, and it's complicated and error prone to do, mostly because configuring the daemon and socket to work without root is way more complex than just adding in UID/GID mapping and installing slirp4netns, which is all you need to do to get rootless podman working. It's even easier now that overlayfs works without root without needing fuse-overlayfs, but you're kind of aced out of luck on the docker side with them only supporting Red Hat and Debian, since I don't think any of those get the latest kernels like you'd get with Arch or something you just customize yourself, other than maybe Fedora Stream?
  - 5y ago
jburwell 5y ago
Lima[0] also looks like a promising replacement on macOS. It manages provisioning a VM with nerdctl[1] installed, networking, and shared storage. The project has a support path for ARM Macs with a patch QEMU. [0]: https://github.com/lima-vm/lima https://github.com/lima-vm/lima [1]: https://github.com/containerd/nerdctl https://github.com/containerd/nerdctl
nikkinana 5y ago
Nobody cares about podman.
thomasbacklund 5y ago
I have really enjoyed using Podman and will keep using it. I have found it be to stable (running on CentOS) for our production stuff. Shameless plug: We built Simplenetes[1] around Podman (a simpler alternative to Kubernetes, but written in 100% shell script :) 1: https://simplenetes.io/ https://simplenetes.io/
- sgt 5y ago
  That actually looks pretty interesting. How do you handle load balancing of inbound traffic.. do you use a pod running Traefik or similar? How do the pods communicate when they are deploying, unavailable or busy and so on? I guess I could get this from your site but there's a LOT of information on the first pages there and possibly not what I am looking for.
  - thomasbacklund 5y ago
    Thanks, We use haproxy pods for inbound traffic, they perform TLS termination and simply pass the traffic over to a local proxy pod. The haproxy pod (and all other pods) communicate with each other over this local proxy service which is running on each host. We have a very simplified and robust overall architecture, were each pod allocates a specific virtual port and the proxy will try each host for that pod (and remember status), meaning we don't need to keep track of global routing tables and update each host's ip tables (shivering) when pods come and go. We don't use iptables. If some instance of a pod is unavailable the proxy will seamlessly try another instance of the pod. Initially we tried to config haproxy to do all this proxying for us, but it was asking too much. Good to know is that Simplenetes is still in beta.
    - sgt 5y ago
      Ok thanks. Interesting approach. I guess it would be interesting to see how easy something is to troubleshoot, should something actually go wrong.
      - thomasbacklund 5y ago
madars 5y ago
The main thing I'm missing with podman is gVisor support https://github.com/google/gvisor/issues/311 https://github.com/google/gvisor/issues/311 . Would be happy to switch once that is available!
- cutemonster 5y ago
  There's also Bottlerocket, https://github.com/bottlerocket-os/bottlerocket https://github.com/bottlerocket-os/bottlerocket I haven't used any of them, but maybe B.r. works with podman?
domenkozar 5y ago
Still for reproducibility, it's best to build container images with Nix: https://nix.dev/tutorials/building-and-running-docker-images https://nix.dev/tutorials/building-and-running-docker-images
- ibeckermayer 5y ago
  I don’t really get it — my low resolution understanding is that Nix gives you the ability to define your Unix environment itself with definition files, similar to how Docker gives you the ability to define a container abstraction with Dockerfiles. So if your whole machine’s environment is already specified, why do you need to add Docker as another layer of abstraction? Is it simply to deal with needing to run multiple apps on the same underlying machine (defined by Nix) with possibly conflicting dependencies (those would be managed by Docker)?
  - benguillet 5y ago
    One use case I see is if you're using Nix for all your local development, but Docker in production (because it's the easiest these days: package an image, give it to ECS/Fargate or equivalent and it's good to go). You're not using Docker in development because of the sync issues on Mac between the host and the containers, but ideally you still want as much as possible the development and production environment parity (same versions of dependencies, etc). You can build your Docker images with Nix to ensure the dependencies versions you're developing with will be the same in prod.
  - kaba0 5y ago
    With nix, the whole dependency hell problem is solved, so you will not get conflicting dependencies anymore (other than perhaps bugs). You could install the same program twice with the exact same version of libc compiled by gcc and clang for example and it would still not get into each other’s way. Docker on the other hand doesn’t solve this problem itself - docker images can be built declaratively (eg. with nix itself), but it is more about managing the running of services with possibly different environments. A typical dockerfile will not be identical at all between two separate creations (most of the time it just installs programs from a repository without any versioning other than perhaps the distro’s major version) The fact that we as in software developers use it for dev environment is just the unfortunate way it is.
motiejus 5y ago
Shameless plug: I wrote undocker[1] to convert docker images to a rootfs tarball, so I can run them with plain systemd. Goal: no more daemons to run 3rd party containers, systemd is good enough by now: resource limits, isolation, chroot, dynamic users, logging, and more. Low-level tooling is done, I am now building ecosystem around it: easy installation, convert to deb/rpm, systemd units, etc. [1]: https://sr.ht/~motiejus/undocker https://sr.ht/~motiejus/undocker
- f0e4c2f7 5y ago
  Wow I must be quite behind on systemd indeed. It's been a few years. Is there any isolation offered like you would get with docker or is that a tradeoff? Edit: looking at the docs is that system-nspawn that's actually doing the heavy lifting. For Linux namespaces. I feel like this has great potential!
  - motiejus 5y ago
    I actually use systemd, not systemd-nspawn (it's also in the README), because using both does not always play together. As far as systemd vs dockerd goes, dockerd provides a bit more isolation by default, but `systemd-analyze security` can guide you so far beyond the Docker defaults. And it is always compatible with system daemons, giving consistent configuration between, say, postgresql from package manager and prometheus from docker container+undocker.
  - technological 5y ago
    One trade off I can think about is rolling out changes or updates . With docker the orchestration tool will handle that for me
- silisili 5y ago
  That's really interesting, I had no idea systemd could do that. Have you written in more detail anywhere? I'd love to see a detailed comparison between approaches.
  - motiejus 5y ago
tachyons 5y ago
Trying to understand what does podman solves in this context as only docker desktop GUI client will be paid and the article is about CLI usage.
xgbi 5y ago
I see all comments here and I’m wondering if anybody actually read TFA. This is NOT a drop-in replacement on Mac, very far from it. No volumes mount from the host, no auto port forward, complications when building images, bugs where the socket isn’t cleared etc. They will get there eventually but this is way over hyped for a sensible replacement for docker on Mac.
- manojlds 5y ago
  Sounds like standard docker experience then. (Half joking)
- kbenson 5y ago
  > They will get there eventually but this is way over hyped for a sensible replacement for docker on Mac. The nice thing is that even if it's not useful for you on your development system, your Docker work will still run on it the exact same elsewhere where it does work (hopefully). There is a somewhat recent article from Red Hat on how to get it working on a Mac[1], but it seems somewhat convoluted in that a lot of stuff (virtualization) that Docker for the Mac apparently does for you is not automated yet. Edit: Oh, I guess this announcement for 3.3.0 is more/better non-unix support? Is that the version you tried? Maybe they made some of this easier. 1: https://www.redhat.com/sysadmin/replace-docker-podman-macos https://www.redhat.com/sysadmin/replace-docker-podman-macos
- geerlingguy 5y ago
  Seems like the majority of responses I get when I ask about Mac support is "why don't you just run Linux?" I do, but not for my workstation, where I do media production and a lot of other things that require a GUI and I use software that, unfortunately, doesn't run as well on Linux (if at all). I have plenty of Linux servers, but if I wanted to do all my development work 'over the wire' I wouldn't use Docker Desktop either.
  - Aeolun 5y ago
    Well, I’d run linux, but I can’t do that on my enterprise laptop since it isn’t supported in any way, shape or form.
mdoms 5y ago
Someone correct me if I'm wrong but my understanding is that Docker is only charging for Docker Desktop, which is a GUI and management tool required to use Docker on Windows and MacOS - both of which are not supported by Podman. And Docker Desktop is not required (or even available) on Linux - the only platform Podman supports.
- CyanLite2 5y ago
  you're right. And the caveat is still that Docker Desktop costs $240 a year only for companies with $10m+ in revenue or 250+ employees. Free for everyone else. I don't get the whole "Let's spend weeks rewriting our build infrastructure to save $240 a year" strategy going on here.
  - freeplay 5y ago
    $240 a year * 250+ employees is 60k at the very least. My company has over 3500 engineers. That's almost a million dollars in new spend and you gain basically nothing. It's a product the entire org has already been using for a long time, now you just have to pay a million dollars a year to use it.
    - oefnak 5y ago
      For all those engineers to learn a different tool will cost you way more.
    - yunohn 5y ago
      You gain support. And the continued existence of the company that developed Docker CLI & GUI. Surely that’s important to your 3500 engineer company’s future too?
  - ayewo 5y ago
    > I don't get the whole "Let's spend weeks rewriting our build infrastructure to save $240 a year" strategy going on here. I think that's because 2 things are at play here: 1. People are busy and often rarely read past the headline announcing the change, so they are unlikely to know of the caveat. 2. People don't like being taxed at the infrastructure level, so the default price for plumbing tools like Docker is $0. What's the assurance that the $240/yr will not rise to $2400/yr a year later, especially if they fail to hit their revenue numbers? Once the glove comes off, it's so much safer to cap your costs today by seeking out an alternative, rather than be confronted with uncapped costs (or any kind of vendor uncertainty) in the future.
abledon 5y ago
never heard of podman, but wow is their twitter logo really a remix of DugTrio ? https://twitter.com/Podman_io/ https://twitter.com/Podman_io/
CyanLite2 5y ago
Alex, I'll take "The things people do to avoid paying $240 a year..."
- 2OEH8eoCRo0 5y ago
  I'll take, "The things people do to avoid using Linux."
kzrdude 5y ago
podman is wholesale copying docker, doesn't that feel a little bit unfair? What does docker think about it, I guess they don't want to draw attention to it(?).
- perlgeek 5y ago
  Offering API-compatible tools is very deeply ingrained in the UNIX philosophy; just think of the different implementations of "ls", or the C functions mandated by POSIX, or the way that clang (the compiler targeting LLVM) has the same flag names as GCC, which probably copied them from somewhere else in the first place... Generally, if you publish an Open Source project, you cannot complain if people copy parts of it, even it's the command line arguments / API / whatever.
  - isatty 5y ago
    One can also argue that the “openness” is what allowed docker to be popular. If it was locked down from day 1 there’d have been a lot less interest. Nobody likes being tied to things at that level.
teliskr 5y ago
I’ve enjoyed using the Kubernetes environment on Docker Desktop for Mac. It’s been pretty good.. paying for it is not an unreasonable request.
omginternets 5y ago
Is podman suitable for use as a library in a larger project? Or are there dedicated libraries for that?
- hda111 5y ago
  I’m not sure if the API is stable enough. But podman is in fact libpod (was named to podman) and it’s used to some extent in Cri-O. Nothing prevents you from using it as a library.
xrd 5y ago
I noticed in the documentation it says non Linux as an option. Is anyone using podman to run Windows containers? If so, have you written it up? I've exported a bunch of containers from Google Cloud to run on virtual box but it's clunky and doesn't always work.
hda111 5y ago
Any reasons to migrate from Docker to Podman when using Linux?
- rurban 5y ago
  Yes, redhat based distros have podman as default. On debian/arch people had weird troubles.

337 points by FreeHugs 5y ago

yonran 5y ago

Can podman machine create a shared volume between your Mac and your container?

brtknr 5y ago
You can mount hostfs which I guess is the same thing

rochacon 5y ago

For those of you that still prefer a GUI to quickly toggle the VM, there is a simple app for that too: https://news.ycombinator.com/item?id=28412548 https://news.ycombinator.com/item?id=28412548

cmbernard333 5y ago

Planning to do this soon. Been looking for a reason to switch from the bloated docker for desktop.

riedel 5y ago

How does podman replace docker desktop? I thought it more as an alternative to the docker daemon, which is still free and open source. I start to wonder if people actually value open source if they run away from something just because some company publishes a commercial GUI. I like that with docker swarm one can without too much headache go from dev environments to a cluster. At university this seems much better than maintaining k8s. Podman seemed to be more interesting in rootless environments like HPC to me. I really what benefit switching to podman would actually bring to us.

eddyg 5y ago
> How does podman replace docker desktop? I don’t think it does. minikube probably comes closet. (But you could run podman instead of Docker inside minikube...)
pred_ 5y ago
It is straightforward to get Podman up and running in WSL2; it is also possible to set up Docker in WSL2 as well without Docker Desktop as well but it is much more painful. So in the Windows space, Podman effectively becomes an alternative to Docker Desktop, simply because the latter makes it possible to do Docker at all (ignoring the other things it does).
- jayd16 5y ago
  What makes docker much more painful?
- riedel 5y ago
  OK I start to get the problem with WSL2. I guess forking docker machine to support WSL2 natively would be a good way to go then.
  - riedel 5y ago
    I just noted that it seems to straight forward to extend machine via drivers and at least there is one for parallels. Also rancher seems to maintain a fork of machine itself so it seems unlikely to die as an alternative...
nonameiguess 5y ago
Using any sort of Linux container runtime on Mac requires a VM, since you can't otherwise get the Linux kernel features required. Docker Desktop and podman machine will both do the VM provisioning for you, and then you can use docker the container engine or podman to actually drive containers in the VM it gives you. So it effectively can replace it because podman machine will provision a VM for you, but you can of course use any other VM provisioner you want. There is no need to have it coupled to the container engine. It's worth noting if you have an M1 Mac, podman machine doesn't work on it yet. Docker Desktop does. Of course, the easiest way to use containerization technology if that's what you want to do is just use Linux workstations and don't worry about needing a kernel virtualization layer between your workstation and your container engine at all. Edit: Noting since sibling comments are discussing Windows and WSL that I'm talking specifically about replacing Docker Desktop on Mac because the article linked here is talking about using podman machine to replace Docker Desktop on Mac.
jedahan 5y ago
I wrote this dumb little shell script to use multipass + podman to replace docker-desktop. https://github.com/jedahan/podman-desktop https://github.com/jedahan/podman-desktop
ithkuil 5y ago
https://github.com/lima-vm/lima https://github.com/lima-vm/lima may fit your usecase
ecnahc515 5y ago
podman has a `machine` subcommand for setting up a VM for running podman. It configures the podman server and your podman client connects to the server, very much like docker. https://docs.podman.io/en/latest/markdown/podman-machine.1.html https://docs.podman.io/en/latest/markdown/podman-machine.1.h...

alias_neo 5y ago

Ive been using Podman for a while for my non-Kubernetes cloud deployments (i.e. small VM based things). It's worked very well for me after a few initial hiccups a year or so ago. Now that Podman-compose[0] is in the works, it'll really be comparable in the UX space soon, and outperforms Docker in several ways when it comes to security. The key difference with Podman compared to Docker is that is does not run a deamon as root, like Docker does, thus all containers are created with the privilege level of the user who created it. This can be a learning curve for those used to Docker as privileges (e.g. for filesystems, files) and capabilities (e.g. for devices, low level networking) need to be handled more explicitly as opposed to Docker's approach of "simon (root) says". Additionally, Podman is very light weight due to the lack of a daemon since there is no service or supporting software which needs to run beyond the capabilities baked into Linux. [0] https://github.com/containers/podman-compose https://github.com/containers/podman-compose EDIT TO ADD: I run Linux both on desktop and server so I have no data for usage in Windows/Mac. Docker Desktop, as I understand it, is a Linux VM.

cpuguy83 5y ago
Docker has a rootless mode in the same way that podman has a rootless mode.
- nonameiguess 5y ago
  Although true, podman did have this feature first, and it's still experimental and unsupported in docker. Docker provides scripts to attempt the setup automatically if you're on a Debian or Red Hat based system, but if you're using something else, you're on your own, and it's complicated and error prone to do, mostly because configuring the daemon and socket to work without root is way more complex than just adding in UID/GID mapping and installing slirp4netns, which is all you need to do to get rootless podman working. It's even easier now that overlayfs works without root without needing fuse-overlayfs, but you're kind of aced out of luck on the docker side with them only supporting Red Hat and Debian, since I don't think any of those get the latest kernels like you'd get with Arch or something you just customize yourself, other than maybe Fedora Stream?
- 5y ago

jburwell 5y ago

Lima[0] also looks like a promising replacement on macOS. It manages provisioning a VM with nerdctl[1] installed, networking, and shared storage. The project has a support path for ARM Macs with a patch QEMU. [0]: https://github.com/lima-vm/lima https://github.com/lima-vm/lima [1]: https://github.com/containerd/nerdctl https://github.com/containerd/nerdctl

nikkinana 5y ago

Nobody cares about podman.

thomasbacklund 5y ago

I have really enjoyed using Podman and will keep using it. I have found it be to stable (running on CentOS) for our production stuff. Shameless plug: We built Simplenetes[1] around Podman (a simpler alternative to Kubernetes, but written in 100% shell script :) 1: https://simplenetes.io/ https://simplenetes.io/

sgt 5y ago
That actually looks pretty interesting. How do you handle load balancing of inbound traffic.. do you use a pod running Traefik or similar? How do the pods communicate when they are deploying, unavailable or busy and so on? I guess I could get this from your site but there's a LOT of information on the first pages there and possibly not what I am looking for.
- thomasbacklund 5y ago
  Thanks, We use haproxy pods for inbound traffic, they perform TLS termination and simply pass the traffic over to a local proxy pod. The haproxy pod (and all other pods) communicate with each other over this local proxy service which is running on each host. We have a very simplified and robust overall architecture, were each pod allocates a specific virtual port and the proxy will try each host for that pod (and remember status), meaning we don't need to keep track of global routing tables and update each host's ip tables (shivering) when pods come and go. We don't use iptables. If some instance of a pod is unavailable the proxy will seamlessly try another instance of the pod. Initially we tried to config haproxy to do all this proxying for us, but it was asking too much. Good to know is that Simplenetes is still in beta.
  - sgt 5y ago
    Ok thanks. Interesting approach. I guess it would be interesting to see how easy something is to troubleshoot, should something actually go wrong.
    - thomasbacklund 5y ago

madars 5y ago

The main thing I'm missing with podman is gVisor support https://github.com/google/gvisor/issues/311 https://github.com/google/gvisor/issues/311 . Would be happy to switch once that is available!

cutemonster 5y ago
There's also Bottlerocket, https://github.com/bottlerocket-os/bottlerocket https://github.com/bottlerocket-os/bottlerocket I haven't used any of them, but maybe B.r. works with podman?

domenkozar 5y ago

Still for reproducibility, it's best to build container images with Nix: https://nix.dev/tutorials/building-and-running-docker-images https://nix.dev/tutorials/building-and-running-docker-images

ibeckermayer 5y ago
I don’t really get it — my low resolution understanding is that Nix gives you the ability to define your Unix environment itself with definition files, similar to how Docker gives you the ability to define a container abstraction with Dockerfiles. So if your whole machine’s environment is already specified, why do you need to add Docker as another layer of abstraction? Is it simply to deal with needing to run multiple apps on the same underlying machine (defined by Nix) with possibly conflicting dependencies (those would be managed by Docker)?
- benguillet 5y ago
  One use case I see is if you're using Nix for all your local development, but Docker in production (because it's the easiest these days: package an image, give it to ECS/Fargate or equivalent and it's good to go). You're not using Docker in development because of the sync issues on Mac between the host and the containers, but ideally you still want as much as possible the development and production environment parity (same versions of dependencies, etc). You can build your Docker images with Nix to ensure the dependencies versions you're developing with will be the same in prod.
- kaba0 5y ago
  With nix, the whole dependency hell problem is solved, so you will not get conflicting dependencies anymore (other than perhaps bugs). You could install the same program twice with the exact same version of libc compiled by gcc and clang for example and it would still not get into each other’s way. Docker on the other hand doesn’t solve this problem itself - docker images can be built declaratively (eg. with nix itself), but it is more about managing the running of services with possibly different environments. A typical dockerfile will not be identical at all between two separate creations (most of the time it just installs programs from a repository without any versioning other than perhaps the distro’s major version) The fact that we as in software developers use it for dev environment is just the unfortunate way it is.

motiejus 5y ago

Shameless plug: I wrote undocker[1] to convert docker images to a rootfs tarball, so I can run them with plain systemd. Goal: no more daemons to run 3rd party containers, systemd is good enough by now: resource limits, isolation, chroot, dynamic users, logging, and more. Low-level tooling is done, I am now building ecosystem around it: easy installation, convert to deb/rpm, systemd units, etc. [1]: https://sr.ht/~motiejus/undocker https://sr.ht/~motiejus/undocker

f0e4c2f7 5y ago
Wow I must be quite behind on systemd indeed. It's been a few years. Is there any isolation offered like you would get with docker or is that a tradeoff? Edit: looking at the docs is that system-nspawn that's actually doing the heavy lifting. For Linux namespaces. I feel like this has great potential!
- motiejus 5y ago
  I actually use systemd, not systemd-nspawn (it's also in the README), because using both does not always play together. As far as systemd vs dockerd goes, dockerd provides a bit more isolation by default, but `systemd-analyze security` can guide you so far beyond the Docker defaults. And it is always compatible with system daemons, giving consistent configuration between, say, postgresql from package manager and prometheus from docker container+undocker.
- technological 5y ago
  One trade off I can think about is rolling out changes or updates . With docker the orchestration tool will handle that for me
silisili 5y ago
That's really interesting, I had no idea systemd could do that. Have you written in more detail anywhere? I'd love to see a detailed comparison between approaches.
- motiejus 5y ago

tachyons 5y ago

Trying to understand what does podman solves in this context as only docker desktop GUI client will be paid and the article is about CLI usage.

xgbi 5y ago

I see all comments here and I’m wondering if anybody actually read TFA. This is NOT a drop-in replacement on Mac, very far from it. No volumes mount from the host, no auto port forward, complications when building images, bugs where the socket isn’t cleared etc. They will get there eventually but this is way over hyped for a sensible replacement for docker on Mac.

manojlds 5y ago
Sounds like standard docker experience then. (Half joking)
kbenson 5y ago
> They will get there eventually but this is way over hyped for a sensible replacement for docker on Mac. The nice thing is that even if it's not useful for you on your development system, your Docker work will still run on it the exact same elsewhere where it does work (hopefully). There is a somewhat recent article from Red Hat on how to get it working on a Mac[1], but it seems somewhat convoluted in that a lot of stuff (virtualization) that Docker for the Mac apparently does for you is not automated yet. Edit: Oh, I guess this announcement for 3.3.0 is more/better non-unix support? Is that the version you tried? Maybe they made some of this easier. 1: https://www.redhat.com/sysadmin/replace-docker-podman-macos https://www.redhat.com/sysadmin/replace-docker-podman-macos
geerlingguy 5y ago
Seems like the majority of responses I get when I ask about Mac support is "why don't you just run Linux?" I do, but not for my workstation, where I do media production and a lot of other things that require a GUI and I use software that, unfortunately, doesn't run as well on Linux (if at all). I have plenty of Linux servers, but if I wanted to do all my development work 'over the wire' I wouldn't use Docker Desktop either.
- Aeolun 5y ago
  Well, I’d run linux, but I can’t do that on my enterprise laptop since it isn’t supported in any way, shape or form.

mdoms 5y ago

Someone correct me if I'm wrong but my understanding is that Docker is only charging for Docker Desktop, which is a GUI and management tool required to use Docker on Windows and MacOS - both of which are not supported by Podman. And Docker Desktop is not required (or even available) on Linux - the only platform Podman supports.

CyanLite2 5y ago
you're right. And the caveat is still that Docker Desktop costs $240 a year only for companies with $10m+ in revenue or 250+ employees. Free for everyone else. I don't get the whole "Let's spend weeks rewriting our build infrastructure to save $240 a year" strategy going on here.
- freeplay 5y ago
  $240 a year * 250+ employees is 60k at the very least. My company has over 3500 engineers. That's almost a million dollars in new spend and you gain basically nothing. It's a product the entire org has already been using for a long time, now you just have to pay a million dollars a year to use it.
  - oefnak 5y ago
    For all those engineers to learn a different tool will cost you way more.
  - yunohn 5y ago
    You gain support. And the continued existence of the company that developed Docker CLI & GUI. Surely that’s important to your 3500 engineer company’s future too?
- ayewo 5y ago
  > I don't get the whole "Let's spend weeks rewriting our build infrastructure to save $240 a year" strategy going on here. I think that's because 2 things are at play here: 1. People are busy and often rarely read past the headline announcing the change, so they are unlikely to know of the caveat. 2. People don't like being taxed at the infrastructure level, so the default price for plumbing tools like Docker is $0. What's the assurance that the $240/yr will not rise to $2400/yr a year later, especially if they fail to hit their revenue numbers? Once the glove comes off, it's so much safer to cap your costs today by seeking out an alternative, rather than be confronted with uncapped costs (or any kind of vendor uncertainty) in the future.

abledon 5y ago

never heard of podman, but wow is their twitter logo really a remix of DugTrio ? https://twitter.com/Podman_io/ https://twitter.com/Podman_io/

CyanLite2 5y ago

Alex, I'll take "The things people do to avoid paying $240 a year..."

2OEH8eoCRo0 5y ago
I'll take, "The things people do to avoid using Linux."

kzrdude 5y ago

podman is wholesale copying docker, doesn't that feel a little bit unfair? What does docker think about it, I guess they don't want to draw attention to it(?).

perlgeek 5y ago
Offering API-compatible tools is very deeply ingrained in the UNIX philosophy; just think of the different implementations of "ls", or the C functions mandated by POSIX, or the way that clang (the compiler targeting LLVM) has the same flag names as GCC, which probably copied them from somewhere else in the first place... Generally, if you publish an Open Source project, you cannot complain if people copy parts of it, even it's the command line arguments / API / whatever.
- isatty 5y ago
  One can also argue that the “openness” is what allowed docker to be popular. If it was locked down from day 1 there’d have been a lot less interest. Nobody likes being tied to things at that level.

teliskr 5y ago

I’ve enjoyed using the Kubernetes environment on Docker Desktop for Mac. It’s been pretty good.. paying for it is not an unreasonable request.

omginternets 5y ago

Is podman suitable for use as a library in a larger project? Or are there dedicated libraries for that?

hda111 5y ago
I’m not sure if the API is stable enough. But podman is in fact libpod (was named to podman) and it’s used to some extent in Cri-O. Nothing prevents you from using it as a library.

xrd 5y ago

I noticed in the documentation it says non Linux as an option. Is anyone using podman to run Windows containers? If so, have you written it up? I've exported a bunch of containers from Google Cloud to run on virtual box but it's clunky and doesn't always work.

hda111 5y ago

Any reasons to migrate from Docker to Podman when using Linux?

rurban 5y ago
Yes, redhat based distros have podman as default. On debian/arch people had weird troubles.