13 ms·
Podman, the open source Docker alternative ported to M1 (Apple Silicon) machines
- lox 5y agoThis looks like the podman client, effectively? Has anyone gotten `podman machine` working on M1?
- kenada 5y ago`podman machine` uses Fedora CoreOS, which doesn’t currently support aarch64. However, it [sounds like][1] that could change soon. [1]: https://github.com/coreos/fedora-coreos-tracker/issues/13 https://github.com/coreos/fedora-coreos-tracker/issues/13
- simnalamburt 5y agoThe current version of podman-apple-silicon uses "testing-devel" version of official Fedora CoreOS aarch64.
- simnalamburt 5y agoOne of the main reason that I made podman-apple-silicon was to make `podman machine` work properly. It works!
- athorax 5y agoLinking to the homebrew installer for this is an...odd... Choice. Never the less, congrats podman devs!
- pcr910303 5y agoMostly because the dev linked to the Homebrew installer when announcing(?) it on her Twitter account[0], but also because the forked repo[1] that contains the patches just shows the original README. This isn’t an official port to the M1 — it’s a custom version patched by a different dev. [0]: https://twitter.com/simnalamburt/status/1434244533001224192 https://twitter.com/simnalamburt/status/1434244533001224192 [1]: https://github.com/simnalamburt/podman https://github.com/simnalamburt/podman
- phinnaeus 5y agoIt looks like the real nice thing here is having a formula for QEMU with the ARM patch applied: https://github.com/simnalamburt/qemu/tree/hvf https://github.com/simnalamburt/qemu/tree/hvf With this I believe you could also used [nerd](https://github.com/containerd/nerdctl https://github.com/containerd/nerdctl) instead of podman but I haven't tested it yet. Edit: It works. Had a bit of trouble since I wanted to uninstall the "real" QEMU first, but `lima` still depended on it, and then installing the patched QEMU needed to update the version of `lima` I had installed, which then tried to reinstall QEMU, which failed because of some symlinks which were now owned by the patched QEMU...
- kitd 5y agoOT, but I'm impressed you managed to make all those changes within the HN-comment-edit-timeout!
- piaste 5y ago> With this I believe you could also used [nerd](https://github.com/containerd/nerdctl https://github.com/containerd/nerdctl) instead of podman but I haven't tested it yet. This is the first time I hear of nerdctl and it's _very_ interesting. M1 aside, does it work fine on regular arm64 linux? I run a small Raspberry Pi 4B homeserver and I would have used podman for improved security, were it not for the poor/incomplete Compose support, while nerdctl seems to explicitly support it.
- gizdan 5y agoTIL of nerdctl. Anyone know what the differences between nerdctl and podman are?
- whimsica1 5y agoAnyone tried this? How's the performance compared to Docker Machine in Mac (notoriously slow on storage).
- initplus 5y agoI assume it's pretty slow, not on storage but on compute. x86 docker/podman on M1 must use QEMU software emulation, rosetta doesn't support x86 virtualization.
- vbezhenar 5y agoWhy do you think that it uses x86? I assume that it just runs ordinary ARM linux in VM which just works (I also don't really understand this title post, surely podman worked on ARM linux since the beginning).
- slpnix 5y agoBehind the scenes, it's using QEMU with Alex Graf's patches for hvf (Hypervisor.framework) support, so it's Virtualization, not emulation. In other words, the performance is really good ;-) BTW, in case you don't want to depend on a fork, upstream podman is going to gain M1 support (in the sense of 'podman-machine' knowing how to start aarch64 VMs with hvf) very soon.
- infogulch 5y agoTangentially, I wonder if Moby underestimated the amount of human hours that were instantly allocated to alternatives as soon as they announced Docker Desktop was going paid. (I don't know if this project is a consequence of that announcement or not.) Hopefully Podman will be able to capitalize on this event and get the polish needed for widespread use.
- SilverRed 5y agoI suspect the push for podman was more about how docker ignored CGroupsV2 for so long that Fedora eventually turned it on anyway which broke docker and then told users to switch to podman.
- cozzyd 5y agoAnd EL8 for that matter
- kbenson 5y agoI think a really big part of it was where Red Hat asked Docker to accept their patch that allowed people to run docker with local registries only (no docker.io), and were told Docker would not be accepting that patch, and to go pound sand if they didn't like it (eh, so maybe not so forcefully). The first thing I tried to figure out when looking into Docker for work was how to limit the registries it would look at to only be our own when used in production, and I was surprised to find out you can't (at least not without a hack to make it think it's using a mirror and just hitting your registry first).
- nsonha 5y agoIdk why people keep pushing for this, on a personal dev machine, root is not a problem, and then there is QEMU
- denkmoon 5y agoI think you'd be surprised how often the route from dev to prod is "copy it from my machine into the cloud". Good practices start at home.
- eru 5y agoWell, it's also a good practice the other way round: If you can make your dev setup model the production setup, that's one less thing to worry about.
- nsonha 5y agoit's docker that requires root, you don't use root yourself
- denkmoon 5y agoIt's perfectly possible to use podman rootless. Presumably docker too, but I only have experience with podman. That is, the podman process does not have root privileges. Maybe excessive, maybe a good prophylactic for potentially damaging NPM packages (for example) to not get root on my CI infrastructure.
- deleted 5y ago
- fiddlerwoaroof 5y agoIs there anyway to make docker-style Darwin containers?
- takeda 5y agoI don't see reason why it wouldn't be possible. Windows did just that. Although at that point having x86_64-linux, x86_64-windows and armv8-darwin would further remove benefits of docker reducing it to a fancy tarball.
- jamesfinlayson 5y agoI don't think Mac/Darwin has cgroups but it's based on BSD to it might have jails?
- yjftsjthsd-h 5y agoSo my somewhat shaky understanding is that Apple does have some form of jails in Darwin, because they use it on iOS (hence, "jailbreaking"), but for some reason doesn't ship it in desktop Darwin (aka macOS).
- heavyset_go 5y agoAs far as I'm aware, macOS' sandbox isn't like the kernel namespaces and cgroups available on Linux.
- johncolanduoni 5y agoIt exists on macOS but doesn’t support the mount namespacing you’d need to create something like a docker container on macOS.
- lostlogin 5y ago> Apple does have some form of jails in Darwin Thinking about the names Apple might call this tech is amusing, with their use of ‘me’ ‘I’ ‘Apple’ etc. I assume ‘Jail’ wouldn’t be in the name.
- pojzon 5y agoDemn after Docker Desktop announcment this podman gets posted almost daily on HackerNews. I understand its a good moment do advertise, but good tools happen to advertise themselves.
- stavros 5y ago> good tools happen to advertise themselves. Nothing advertises itself. People advertise things, by posting about them.
- mdoms 5y agoPodman, the open source alternative to the open source parts of Docker. To be clear.
- slimsag 5y agoThis looks more like the Podman version of Docker Desktop (which is closed source, and no longer free), effectively, as it's handling the virtualization aspects for you according to[0]. [0] https://twitter.com/simnalamburt/status/1434244533001224192 https://twitter.com/simnalamburt/status/1434244533001224192
- ur-whale 5y ago> the open source Docker alternative I was under the impression that docker was open source. I am mistaken?
- slimsag 5y agoDocker Desktop (the software people must use to run Docker under any Mac or Windows machines) is closed source.
- The_Colonel 5y ago... and podman is not an alternative for Docker Desktop.
- slimsag 5y ago... sure seems like it is: this handles QEMU setup/teardown with hardware virtualization support through Hypervisor.framework according to[0]. [0] https://twitter.com/simnalamburt/status/1434244533001224192 https://twitter.com/simnalamburt/status/1434244533001224192
- stavros 5y agoDoesn't Docker proper do that on Mac?
- dolmen 5y agoAFAIK the Docker engine (that allows to run containers) isn't available for Mac independently of Docker Desktop. At least binaries are not provided. https://docs.docker.com/engine/install/binaries/ https://docs.docker.com/engine/install/binaries/
- stavros 5y agoOh wow, really? I thought Docker Desktop was only a UI that helped you start/stop Docker, I didn't realize there's no OSS version at all. That's much worse than I thought, wow. I guess I'll have to switch to Podman too, even though I don't use Mac, just because we need a unified approach across OSes in our company and can't afford to have Mac-using developers be second-class citizens.
- zapita 5y agoCalling podman “the open-source docker alternative” is disingenuous. The Docker engine which it competes with is also open-source. The only closed Docker product is their desktop wrapper, for which podman is not an alternative. Podman people, you’re better than this.
- kodah 5y agoThis has little or nothing to do with "podman people". The stuff people are talking about in the top comments have everything to do with people (and corporations) trying to figure out how to run podman efficiently on MacOS. It certainly can be done by bundling QEMU or through a VM. Second, Docker Desktop for MacOS and Windows are not open source, hence this repository is empty: https://github.com/docker/for-win https://github.com/docker/for-win
- brodock 5y agoDocker is open-core.
- j16sdiz 5y agoDocker Desktop is not
- hda111 5y agoDocker isn’t true open source in my opinion. With true open source you can compile your own version of the software with your own changes and it works just like the official release. You can’t do this with Docker Engine afaik.
- qwerty456127 5y agoPlanning to buy a new MacBook for a family member I have some question to whoever is into the Apple wold: is that true that the next generation of MacBooks is going to have classic Esc&F# buttons, MagSafe, SD card reader and HDMI? When is it expected to be released? How is a MacBookPro better than a MacBookAir of the same specs (RAM&SSD)? We were going to buy a new MacBook now but the classic parts returning sound really motivating to wait.
- konradkpl 5y agoWe don't know anything for sure, only rumors: https://www.macrumors.com/guide/14-inch-macbook-pro/ https://www.macrumors.com/guide/14-inch-macbook-pro/
- qwerty456127 5y agoThank you. This answer all the questions except the Pro-vs-Air difference.
- konradkpl 5y agoThe current macbook pro 13 with M1 does not differ significantly from the macbook air m1: https://9to5mac.com/2021/09/01/m1-macbook-air-vs-m1-macbook-pro-which-should-you-buy/ https://9to5mac.com/2021/09/01/m1-macbook-air-vs-m1-macbook-... . You have one core more and active cooling with fan, but in daily use it is difficult to generate the load that will trigger this cooling. The situation will definitely change with the new Macbook Pro 14/16 to be shown in October or November.
- lucian1900 5y agoThe only difference between the current Pro and Air is that the latter can thermal throttle. I got the Air and I have managed to make it throttle while running x86 games. However, it wasn’t by much. The games remained playable. Overall, it’s great. Very fast and entirely silent.
- 5y ago
- sdze 5y agoWhat hypervisor is used for that?
- simnalamburt 5y agoQEMU with Hypervisor.framework patch has been used!
- simnalamburt 5y agoHi, podman-apple-silicon developer here! I want to share some FAQs about this project. :) Q: Does this run amd64 docker images or aarch64 docker images? A: aarch64 images currently, but I'm going to patch podman to make it possible to run both amd64 image and aarch64 image. All I have to do for this is to make QEMU call and Linux image configurable, so it won't be very hard. However, if you are running amd64 images, you will have to bear the performance overhead due to CPU emulation. Q: Is this toy or are you actually going to maintain this? A: I'm DevOps engineer and I made podman-apple-silicon to actually use this in my day job. Q: Are you going to merge this to the upstream? A: I'll keep trying, but it won't be easy unless QEMU merges Alex Graf's Hypervisor.framework patch. I may forgot to check HackerNews, so please feel free to ask me anything about podman-apple-silicon at https://twitter.com/simnalamburt https://twitter.com/simnalamburt
- traverseda 5y ago> I'm going to patch podman to make it possible to run both amd64 image and aarch64 image From what I understand, if you had working QEMU-static and binfmt, wouldn't cross-architecture containers just work? I've used that a lot in chroots, and I'm confused as to why that wouldn't just transparently work in this case. Are you talking about just making that process easier? Does podman enforce extra checks that prevent you from using binfmt?
- simnalamburt 5y agoIf you just switch the binary you’re 90% finished but there are some chores to make it perfect 1. The arguments given to the qemu should be changed by the CPU arch. For example, AArch64 uses ‘-accel=hvf’ while amd64 in Apple Silicon must use ‘-accel=tcg’. AArch64 requires ‘-cpu’ option whild amd64 does not. etc. And currently, the arguments of QEMU is half-way hardcoded to the podman source code. 2. You should change the linux image when you change the CPU arch. Currently, podman always downloads the Linux image whose CPU arch is same with host’s CPU arch. This is where configuration should be added. 3. aarch64 uses UEFI while amd64 don’t need to (I don’t know why)
- 5y ago
- whckt 5y agoVery nice! I’m keen to do away with the VirtualBox on my current Intel when I make the transition to M1.
- nsonha 5y agoI'm not on M1 so QEMU kind of puts me off . Is there a way to use this with any of hyperkit, virtualbox, or vmware?
- imwillofficial 5y agoTrust me, learn QEMU, worth the time.
- nsonha 5y agohow do you mean learn it? So far I've only used these as drivers to run other things so my only concern is that QEMU is supposed to be slow. I don't really do anything directly with it.
- imwillofficial 5y agoMy mistake, I took your usage of QEMU as a shorthand for managing and manipulating VMs, and wanting to use VMware et al due to not wanting to use the “QEMU ecosystem”
- awild 5y agoI'm curious every post on podman had a very positive thread. We were kinda forced to use podman and while we enjoy rootless containers conceptually they have caused us a lot of issues. After every restart of a node when a user had pods running, said user will not be able to use podman. Often times, bugs can only be solved by completely resetting your user. It's also not as straightforward to configure as the documentatiom let's on. Overall I don't have an opinion on the software, it's just confusing to me how much praise it receives?
- michaelcampbell 5y ago> bugs can only be solved by completely resetting your user. What does "resetting your user" mean?
- dotancohen 5y agoPresumably there is a config file somewhere that is causing issues. Resetting the user might be a way of saying rm -rf /home/someuser. That said, I've never used podman and this is the first that I've heard of it.
- awild 5y agoI meant user config sorry.
- alibarber 5y agoPodman does rely on a lot of files in the /tmp/run-... directory and this has caused us some similar issues. There was some info somewhere on how to change this to somewhere more suitable. Sorry it's not too helpful, but might be some clues for you.
- jedahan 5y agoI made a dumb shell script alternative to Docker Desktop. works on M1, fork unneeded. Uses multipass and podman. https://github.com/jedahan/podman-desktop https://github.com/jedahan/podman-desktop
- OneTimePetes 5y agoIs the name a Blindsight reference?
- symlinkk 5y agoWhy is HN shilling this so hard? This feels so forced.
- seba_dos1 5y agoMy first reaction was "what the hell? podman has already worked on aarch64 machines for ages". Turns out the title is missing a vital piece of information that this is a port that targets macOS.
- robberphex 5y agoIt's better to keep same software stack with production environment. So I think containerd/nerdctl/lima is another option.