11 ms·

Podman in Linux

146 points by diegopacheco 5y ago

paxys 5y ago
While I understand the phrasing, it's still funny to read "open-source Docker replacement".
- m463 5y ago
  When I first used docker on macos a while back, I was surprised with all the telemetry/phoning home it did. It started doing it at the beginning of the installer, before docker was even installed.
rmetzler 5y ago
Somehow a lot of these blog posts seem to get the fine technical details of the marketing speak wrong. > Docker recently changed the license From my understanding this is related to Docker Desktop not Docker. I'm pretty sure Podman can't replace Docker Desktop. This is also what the linked website says. Or did I miss something? And in the linked Blog post it says > Docker was dropped from Kubernetes. which from my understanding is also incorrect, because it's the docker-shim which is deprecated (not dropped) and Docker inc could probably make Docker Engine CRI compliant.
- dmart 5y ago
  It seems to me that almost no one understands the difference between the various layers of "Docker" (that is to say: Desktop, CLI, daemon, containerd, runc) and which layers tools like Podman aim to replace.
  - denysvitali 5y ago
    To be fair, podman has it's own "Docker Desktop" part, podman machine. But of course on Linux this doesn't make any sense.
  - gizdan 5y ago
    From what I've seen in all these Podman articles, I've come to the same conclusion as you. This is how Podman fits in: Podman (and its various components) can replace everything but parts of Docker Desktop, namely the GUI that Docker Desktop, has. For everything else, it has it's own Docker compatible CLI, an optional daemon (by default it's daemonless), there is no containerd component as it communicates directly to any OCI compatible runtime. They've also implemented their own OCI compatible runtime, crun, which is supposed to be faster than runc, and more lightweight. I suppose for the average Joe/Jane this probably doesn't matter. They want to run a few commands the first time around to set up, and then do "start/stop/remove my container" and that's all they want to do.
    - amarshall 5y ago
      Docker Desktop isn’t really about the GUI so much as the management of, and host integration with, a Linux VM for running on non-Linux OSes. Notably, there’s no Docker Desktop for Linux, only macOS and Windows.
      - gizdan 5y ago
        Yep. Podman takes cares of those things using the `podman machine` sub-command. From what I understand, currently only macOS might be working, but Windows support will be coming if it's not already there.
        studmuffin650 5y ago
        the only issue really left is that volume mounts don't work with podman machine as of yet. The issue has been live on github for awhile, but its finally getting traction. Likely because of the recent Docker for Desktop changes. EDIT: github link: https://github.com/containers/podman/issues/8016 https://github.com/containers/podman/issues/8016
        otterley 5y ago
        AFAICT podman machine relies on VirtualBox. This would be an enormous performance and resource regression on MacOS — Docker Desktop uses the much more performant and resource-conscious native hypervisor frameworks instead.
  - encryptluks2 5y ago
    Yes, but Docker won't work on Windows without having some machine-compatible integration with Hyper-V. Docker Machine was deprecated in favor of Docker Desktop: https://docs.docker.com/machine/ https://docs.docker.com/machine/ For now however, you can use minikube which provides drivers for Hyper-V and hyperkit: https://minikube.sigs.k8s.io/docs/drivers/ https://minikube.sigs.k8s.io/docs/drivers/
    - imachine1980_ 5y ago
      works whit wsl2, who is include in non pro versions of window, and i think the installer works out of the box (if you have the ubuntu/wsl2 installed)
      - encryptluks2 5y ago
        I was never able to get docker to properly work with WSL2 without installing Docker Desktop and enabling the integration. WSL2 just seemed too buggy for my likes and I am a happy Arch Linux user.
  - jmspring 5y ago
    But on Windows/Mac there really is not a way to run Docker w/o Docker Desktop installed. And that could be a thing confusing people. Linux, yeah, I don't think there is a Desktop version for that. It's all CLI
- jonfw 5y ago
  Podman can replace docker desktop. It doesn't have the same GUI but it does have the capability to run containers via familiar CLI commands on a variety of OSes, connecting to (and in some cases provisioning through podman machine) a VM when required I also think that it's more than safe to say that K8s is dropping Docker when they've deprecated it as a container runtime
  - benatkin 5y ago
    You can also run regular docker with vagrant instead of Docker Desktop. This seems to be the way you can replace Docker Desktop with Podman: https://www.redhat.com/sysadmin/replace-docker-podman-macos https://www.redhat.com/sysadmin/replace-docker-podman-macos There was Kitematic for Docker, I think it was independent, but it's owned by Docker now and they shut it down. https://github.com/docker/kitematic https://github.com/docker/kitematic
    - nickstinemates 5y ago
      It evolved to become Docker Desktop
      - benatkin 5y ago
        No it didn't, Docker Desktop was already released before Docker bought Kitematic. I have receipts: https://www.zdnet.com/article/docker-reels-in-kitematic-as-it-hits-container-acquisition-trail-again/ https://www.zdnet.com/article/docker-reels-in-kitematic-as-i... (2015) https://en.m.wikipedia.org/wiki/Docker_(software) https://en.m.wikipedia.org/wiki/Docker_(software) (Initial release: 2012) If you mean Docker Desktop added some features from Kitematic, that's a misleading way of saying it.
        nickstinemates 5y ago
        Guess I don't know what I'm talking about
        5y ago
- boardwaalk 5y ago
  It depends on what you mean by “replace” Docker Desktop, but Podman can run a VM on macOS and has replaced Docker Desktop for me. There’s no fancy (useless) UI nor Windows support yet though.
  - jonfw 5y ago
    Windows works via a "Bring your own VM" approach, but since WSL exists I'd expect most Windows users would just run it there
    - flatiron 5y ago
      When you install Docker desktop and already have wsl2 installed you get a pop up saying “you just want us to use wsl2?” And away you go. At least that’s what happened when I did it 6 months ago. Works great!
      - maple3142 5y ago
        If you don't need to run `docker` command under Windows, install docker directly from distro repo is enough. No need to run another background service. Another benefit is it is faster to build docker images when the files are large, because it doesn't need to move files between WSL VMs.
  - gavinray 5y ago
    I thought there was Windows support for Podman the same way that Docker Desktop provides Windows support -- primarily through WSL2?
  - otterley 5y ago
    AFAICT podman machine relies on VirtualBox. This would be an enormous performance and resource regression on MacOS — Docker Desktop uses the much more performant and resource-conscious native hypervisor frameworks instead.
    - muizelaar 5y ago
- zapita 5y ago
  You are correct on both counts. Most people are not intimately familiar with the details of the Docker and Kubernetes stacks. Unscrupulous vendors have been taking advantage of this confusion to spread FUD and shine a more flattering light on their own products.
- lucideer 5y ago
  > I'm pretty sure Podman can't replace Docker Desktop. Multiple siblings here have already mentioned that it absolutely can (and does for many). My question is: in what way does it not? What is Docker Desktop doing for you that podman lacks? Just UI?
  - JazzXP 5y ago
    Volume Mount integration is the big one for me. UI is neither here nor there, but managing the VM is what Docker Desktop means for most users. Podman Machine is getting there, but not quite there yet.
  - kkapelon 5y ago
    Docker Desktop also includes a full Kubernetes distribution. It is actually the easiest way to get a local K8s cluster on Windows or Mac. Docker desktop also includes Docker-compose (a way to chain multiple docker container together) And of course the UI. Podman is just replacing the basic docker CLI. I would say that podman replaces about 20% of what Docker desktop offers.
- fulafel 5y ago
  I think you are reading their marketing speak too charitably by assuming it contains "fine technical details". They purpousefully renamed everything to "Docker" to get people think that the desktop virtual machine offering is the same thing and this caused a lot of confusion.
ActorNightly 5y ago
Im just wondering if the full loop will ever be complete and deployment patterns start shifting to single file compiled executables.
- inetknght 5y ago
  cp ./app.AppImage /srv/app/app.AppImage for deployment_host in $( <deployment_hosts jq '.[].hostname'); ssh deployment_user@deployment_host /srv/app/app.AppImage & done okay boss, what's the next problem?
  - jrockway 5y ago
    app.AppImage used up all the RAM on the machine, and the kernel OOMkilled sshd. Now it's time to roll back. (But I guess it wasn't the fault of that deployment -- you just staged the binary, you didn't start it running.)
    - inetknght 5y ago
      The app.AppImage is staged to the network share and started on the remote host. The AppImage might eat all the RAM and the AppImage will get OOMkilled but sshd is unlikely to be killed. When the AppImage gets OOMkilled, the ssh session will end with an error and the ssh client will report that the session terminated unexpectedly. I've done it (and later cringed). But it definitely works.
- nonameiguess 5y ago
  For programming languages that offer a good experience with static linking, sure, but even those may depend on external config files, environment variables, specific ports and sockets, all of which can potentially conflict with other programs on the same physical host. Go binaries are almost always just one file and yet are among the most popular to deploy as containers along with making up virtually all of the CNCF ecosystem.
Iolaum 5y ago
podman user here, because of the ability to run in rootless mode. Using it on RPi4 with Fedora IoT running linuxserver io containers. Appreciate the systemd integration as well making the containers services that gracefully go down and come up when the pi gets rebooted without me needing to do anything.
- some0x80070005 5y ago
  It’s great that podman serves a good role for you, and I’m not going to argue that. My points: 1. Docker containers absolutely can be run without root. Yes, it’s not the default policy, but containers can have a user ID. If you are referencing the daemon-less root-less nature of podman, that’s a clear advantage of podman vs Docker. 2. Docker containers also have a restart policy which I use to also have them startup on machine reboot. By graceful, you must mean sending SIGTERM to the containers which Docker does as well. Perhaps podman does these things better, but I want to point out that Docker does have many features for better or for worse.
  - kblev 5y ago
    Thanks
  - PhilippGille 5y ago
    > root-less nature of podman I see this repeated a lot, but it's not the default, its has to be explicitly configured: https://github.com/containers/podman/blob/v3.3.1/docs/tutorials/rootless_tutorial.md https://github.com/containers/podman/blob/v3.3.1/docs/tutori... And in addition to the known upsides, there are some lesser known downsides: 1. There are feature limitations with it: https://github.com/containers/podman/blob/v3.3.1/rootless.md https://github.com/containers/podman/blob/v3.3.1/rootless.md 2. There are security implications, quoting Arch Wiki: > Warning: Rootless Podman relies on the unprivileged user namespace usage (CONFIG_USER_NS_UNPRIVILEGED) which has some serious security implications, see Security#Sandboxing applications for details. Also worth noting that Docker itself has a rootless mode as well by now: https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/ I'm happy that there are Docker alternatives, but I have the feeling that podman has been hyped a lot recently and many articles and comments give the impression that it's more secure by default and without any downsides.
rpncreator 5y ago
The challenges I’ve had switching out Docker Engine, CLI, and Compose with Podman has been the absence of a vetted Docker Compose replacement. What I’ve done so far in replacing Docker Desktop has been to use just the CLI, Engine, and Compose on WSL2.
- alexeldeib 5y ago
  I never liked the GUI or desktop behavior. I just install containerd, point dockerd at it, and download everything manually. This is pretty much my install, sans systemd units: curl -LO https://download.docker.com/linux/static/stable/x86_64/docker-20.10.8.tgz tar -xvzf docker-20.10.8.tgz mv docker/dockerd /usr/bin/dockerd mv docker/docker-init /usr/bin/docker-init mv docker/docker-proxy /usr/bin/docker-proxy mv docker/docker /usr/bin/docker rm -rf docker rm docker-20.10.8.tgz
- PhineasRex 5y ago
  As of 3.0 you can apparently run docker-compose directly against podman in daemon mode (thought I haven't tried it).
  - terinjokes 5y ago
    I've been running this way since the beginning of the year. Works great, just need to set DOCKER_HOST when launching docker-compose.
- flemhans 5y ago
  When I found out Podman supports Kubernetes pod YML files with `podman play kube`, I "ported" my Compose files to those, and that works pretty well (in the newest versions of Podman).
infogulch 5y ago
Can you use podman with ZFS on Linux volumes?
- TD-Linux 5y ago
  There is a dedicated storage driver for zfs: https://www.jwillikers.com/podman-with-btrfs-and-zfs https://www.jwillikers.com/podman-with-btrfs-and-zfs That said, the default overlay storage driver already supports reflinks, which will get you most of the benefits.
  - yencabulator 5y ago
    Last I looked, ZFS didn't support reflinks. https://github.com/openzfs/zfs/issues/405 https://github.com/openzfs/zfs/issues/405
nitsky 5y ago
I love podman. When you write a file to a volume from a container, the user that spawned the container is the owner. This is exactly what you expect, but with docker, everything is written as root. After many years, this has not been fixed: https://github.com/moby/moby/issues/2259 https://github.com/moby/moby/issues/2259 This has made it impossible to use docker in scripts where root access is not available. Thank you podman!
- nissarup 5y ago
  Thank you! This has been my main headache with docker. I'll switch to podman at home.
yawaramin 5y ago
> It's the natural open-source Docker replacement. Docker recently changed the license and plans. Come on. While maybe not an outright lie, this is certainly bending the truth and leaving out crucial details–Docker CLI is still open source and free, just not Docker Desktop. While you can use podman on Linux (and should if it fits your needs!), you're not being forced to use it because Docker became paid or anything like that!
itsjloh 5y ago
I tried to give Podman a go on Ubuntu 20.04 and it _worked_ but I could never get it going with a docker-compose file. There is apparently support in the works, but I can't find or get that support on Ubuntu at this stage. Shame, I was hoping it might support IPv6 better than docker currently does.
- nzrf 5y ago
  I can’t speak for Ubuntu, but all of my containers are setup in docker compose for podman things start find there is a couple tweaks like container name I had to make, but over all pretty straightforward. I’d recommend another go if you are looking for an alternative. As I like rootless containers. I think the implementation feels awkward for local directory permission mounting volumes.
aorth 5y ago
The code snippet in the gist is posted twice in the blog post... and I don't know why it's not just posted in code blocks...
ggm 5y ago
There's only one Question really: can it use a Dockerfile?
- otheracc 5y ago
  Yes, and the more standard "Containerfile" works as well (same grammar but non-branded naming). Overall, it's a drop-in replacement with additional features and a more linux friendly underlying architecture. You can even alias podman to docker and shouldn't run into any issues.
  - ggm 5y ago
    This is good. The inability to take build artifact inputs into FreeBSD bhyve/jails, is usually why people say they can't go there (it's certainly whats limiting me) -So having an alternate explicitly handle the input I HAVE moving to the product I WANT is really good. Thanks for clarifying.
ramconx 5y ago
what a shitty blog :)
terrywang 5y ago
Podman is not (YET) a drop-in replacement for Docker CE (on Linux), at least for me (even after 3.0.0 release when it adds seamless Docker Compose support, the way it does it contradicts daemon-less...). Deploying stacks (on Linux) Docker Compose style are typical use cases for using Docker, `podman-compose` works sometimes, however, over half of such initial attempts fail and require tinkering. Docker CE (at least for Linux) is still the best option when the use cases are simply clone the repo & deploy/run the stack using `docker-compose up -d`, it simply does the job at the best cost. podman / buildah / skopeo trio is definitely worth learning, podman can be very useful to migrate containerized workloads from local / standalone dev machines to production k8s clusters, by leveraging `generate kube`.
- hda111 5y ago
  No, it doesn’t contradict daemon-less (wrt resources used by the daemon). This “daemon” only runs activated by a systemd socket for a few seconds. Whereas Docker CE always runs at least containerd (dockerd is also socket activated). You could argue that conmon is the daemon of podman and every container has its own daemon. It’s a bit wasteful wrt memory but that how it’s designed.
crb 5y ago
I spoke to Red Hat's Dan Walsh, container team lead, and Brent Baude, the lead architect of Podman, on my podcast last week. It's a good primer to the what and why of Podman, Buildah, and all the other "not Docker" tools Red Hat makes. https://kubernetespodcast.com/episode/164-podman/ https://kubernetespodcast.com/episode/164-podman/

Podman in Linux

146 points by diegopacheco 5y ago

paxys 5y ago

While I understand the phrasing, it's still funny to read "open-source Docker replacement".

m463 5y ago
When I first used docker on macos a while back, I was surprised with all the telemetry/phoning home it did. It started doing it at the beginning of the installer, before docker was even installed.

rmetzler 5y ago

Somehow a lot of these blog posts seem to get the fine technical details of the marketing speak wrong. > Docker recently changed the license From my understanding this is related to Docker Desktop not Docker. I'm pretty sure Podman can't replace Docker Desktop. This is also what the linked website says. Or did I miss something? And in the linked Blog post it says > Docker was dropped from Kubernetes. which from my understanding is also incorrect, because it's the docker-shim which is deprecated (not dropped) and Docker inc could probably make Docker Engine CRI compliant.

dmart 5y ago
It seems to me that almost no one understands the difference between the various layers of "Docker" (that is to say: Desktop, CLI, daemon, containerd, runc) and which layers tools like Podman aim to replace.
- denysvitali 5y ago
  To be fair, podman has it's own "Docker Desktop" part, podman machine. But of course on Linux this doesn't make any sense.
- gizdan 5y ago
  From what I've seen in all these Podman articles, I've come to the same conclusion as you. This is how Podman fits in: Podman (and its various components) can replace everything but parts of Docker Desktop, namely the GUI that Docker Desktop, has. For everything else, it has it's own Docker compatible CLI, an optional daemon (by default it's daemonless), there is no containerd component as it communicates directly to any OCI compatible runtime. They've also implemented their own OCI compatible runtime, crun, which is supposed to be faster than runc, and more lightweight. I suppose for the average Joe/Jane this probably doesn't matter. They want to run a few commands the first time around to set up, and then do "start/stop/remove my container" and that's all they want to do.
  - amarshall 5y ago
    Docker Desktop isn’t really about the GUI so much as the management of, and host integration with, a Linux VM for running on non-Linux OSes. Notably, there’s no Docker Desktop for Linux, only macOS and Windows.
    - gizdan 5y ago
      Yep. Podman takes cares of those things using the `podman machine` sub-command. From what I understand, currently only macOS might be working, but Windows support will be coming if it's not already there.
      - studmuffin650 5y ago
        the only issue really left is that volume mounts don't work with podman machine as of yet. The issue has been live on github for awhile, but its finally getting traction. Likely because of the recent Docker for Desktop changes. EDIT: github link: https://github.com/containers/podman/issues/8016 https://github.com/containers/podman/issues/8016
      - otterley 5y ago
        AFAICT podman machine relies on VirtualBox. This would be an enormous performance and resource regression on MacOS — Docker Desktop uses the much more performant and resource-conscious native hypervisor frameworks instead.
- encryptluks2 5y ago
  Yes, but Docker won't work on Windows without having some machine-compatible integration with Hyper-V. Docker Machine was deprecated in favor of Docker Desktop: https://docs.docker.com/machine/ https://docs.docker.com/machine/ For now however, you can use minikube which provides drivers for Hyper-V and hyperkit: https://minikube.sigs.k8s.io/docs/drivers/ https://minikube.sigs.k8s.io/docs/drivers/
  - imachine1980_ 5y ago
    works whit wsl2, who is include in non pro versions of window, and i think the installer works out of the box (if you have the ubuntu/wsl2 installed)
    - encryptluks2 5y ago
      I was never able to get docker to properly work with WSL2 without installing Docker Desktop and enabling the integration. WSL2 just seemed too buggy for my likes and I am a happy Arch Linux user.
- jmspring 5y ago
  But on Windows/Mac there really is not a way to run Docker w/o Docker Desktop installed. And that could be a thing confusing people. Linux, yeah, I don't think there is a Desktop version for that. It's all CLI
jonfw 5y ago
Podman can replace docker desktop. It doesn't have the same GUI but it does have the capability to run containers via familiar CLI commands on a variety of OSes, connecting to (and in some cases provisioning through podman machine) a VM when required I also think that it's more than safe to say that K8s is dropping Docker when they've deprecated it as a container runtime
- benatkin 5y ago
  You can also run regular docker with vagrant instead of Docker Desktop. This seems to be the way you can replace Docker Desktop with Podman: https://www.redhat.com/sysadmin/replace-docker-podman-macos https://www.redhat.com/sysadmin/replace-docker-podman-macos There was Kitematic for Docker, I think it was independent, but it's owned by Docker now and they shut it down. https://github.com/docker/kitematic https://github.com/docker/kitematic
  - nickstinemates 5y ago
    It evolved to become Docker Desktop
    - benatkin 5y ago
      No it didn't, Docker Desktop was already released before Docker bought Kitematic. I have receipts: https://www.zdnet.com/article/docker-reels-in-kitematic-as-it-hits-container-acquisition-trail-again/ https://www.zdnet.com/article/docker-reels-in-kitematic-as-i... (2015) https://en.m.wikipedia.org/wiki/Docker_(software) https://en.m.wikipedia.org/wiki/Docker_(software) (Initial release: 2012) If you mean Docker Desktop added some features from Kitematic, that's a misleading way of saying it.
      - nickstinemates 5y ago
        Guess I don't know what I'm talking about
        5y ago
boardwaalk 5y ago
It depends on what you mean by “replace” Docker Desktop, but Podman can run a VM on macOS and has replaced Docker Desktop for me. There’s no fancy (useless) UI nor Windows support yet though.
- jonfw 5y ago
  Windows works via a "Bring your own VM" approach, but since WSL exists I'd expect most Windows users would just run it there
  - flatiron 5y ago
    When you install Docker desktop and already have wsl2 installed you get a pop up saying “you just want us to use wsl2?” And away you go. At least that’s what happened when I did it 6 months ago. Works great!
    - maple3142 5y ago
      If you don't need to run `docker` command under Windows, install docker directly from distro repo is enough. No need to run another background service. Another benefit is it is faster to build docker images when the files are large, because it doesn't need to move files between WSL VMs.
- gavinray 5y ago
  I thought there was Windows support for Podman the same way that Docker Desktop provides Windows support -- primarily through WSL2?
- otterley 5y ago
  AFAICT podman machine relies on VirtualBox. This would be an enormous performance and resource regression on MacOS — Docker Desktop uses the much more performant and resource-conscious native hypervisor frameworks instead.
  - muizelaar 5y ago
zapita 5y ago
You are correct on both counts. Most people are not intimately familiar with the details of the Docker and Kubernetes stacks. Unscrupulous vendors have been taking advantage of this confusion to spread FUD and shine a more flattering light on their own products.
lucideer 5y ago
> I'm pretty sure Podman can't replace Docker Desktop. Multiple siblings here have already mentioned that it absolutely can (and does for many). My question is: in what way does it not? What is Docker Desktop doing for you that podman lacks? Just UI?
- JazzXP 5y ago
  Volume Mount integration is the big one for me. UI is neither here nor there, but managing the VM is what Docker Desktop means for most users. Podman Machine is getting there, but not quite there yet.
- kkapelon 5y ago
  Docker Desktop also includes a full Kubernetes distribution. It is actually the easiest way to get a local K8s cluster on Windows or Mac. Docker desktop also includes Docker-compose (a way to chain multiple docker container together) And of course the UI. Podman is just replacing the basic docker CLI. I would say that podman replaces about 20% of what Docker desktop offers.
fulafel 5y ago
I think you are reading their marketing speak too charitably by assuming it contains "fine technical details". They purpousefully renamed everything to "Docker" to get people think that the desktop virtual machine offering is the same thing and this caused a lot of confusion.

ActorNightly 5y ago

Im just wondering if the full loop will ever be complete and deployment patterns start shifting to single file compiled executables.

inetknght 5y ago
cp ./app.AppImage /srv/app/app.AppImage for deployment_host in $( <deployment_hosts jq '.[].hostname'); ssh deployment_user@deployment_host /srv/app/app.AppImage & done okay boss, what's the next problem?
- jrockway 5y ago
  app.AppImage used up all the RAM on the machine, and the kernel OOMkilled sshd. Now it's time to roll back. (But I guess it wasn't the fault of that deployment -- you just staged the binary, you didn't start it running.)
  - inetknght 5y ago
    The app.AppImage is staged to the network share and started on the remote host. The AppImage might eat all the RAM and the AppImage will get OOMkilled but sshd is unlikely to be killed. When the AppImage gets OOMkilled, the ssh session will end with an error and the ssh client will report that the session terminated unexpectedly. I've done it (and later cringed). But it definitely works.
nonameiguess 5y ago
For programming languages that offer a good experience with static linking, sure, but even those may depend on external config files, environment variables, specific ports and sockets, all of which can potentially conflict with other programs on the same physical host. Go binaries are almost always just one file and yet are among the most popular to deploy as containers along with making up virtually all of the CNCF ecosystem.

Iolaum 5y ago

podman user here, because of the ability to run in rootless mode. Using it on RPi4 with Fedora IoT running linuxserver io containers. Appreciate the systemd integration as well making the containers services that gracefully go down and come up when the pi gets rebooted without me needing to do anything.

some0x80070005 5y ago
It’s great that podman serves a good role for you, and I’m not going to argue that. My points: 1. Docker containers absolutely can be run without root. Yes, it’s not the default policy, but containers can have a user ID. If you are referencing the daemon-less root-less nature of podman, that’s a clear advantage of podman vs Docker. 2. Docker containers also have a restart policy which I use to also have them startup on machine reboot. By graceful, you must mean sending SIGTERM to the containers which Docker does as well. Perhaps podman does these things better, but I want to point out that Docker does have many features for better or for worse.
- kblev 5y ago
  Thanks
- PhilippGille 5y ago
  > root-less nature of podman I see this repeated a lot, but it's not the default, its has to be explicitly configured: https://github.com/containers/podman/blob/v3.3.1/docs/tutorials/rootless_tutorial.md https://github.com/containers/podman/blob/v3.3.1/docs/tutori... And in addition to the known upsides, there are some lesser known downsides: 1. There are feature limitations with it: https://github.com/containers/podman/blob/v3.3.1/rootless.md https://github.com/containers/podman/blob/v3.3.1/rootless.md 2. There are security implications, quoting Arch Wiki: > Warning: Rootless Podman relies on the unprivileged user namespace usage (CONFIG_USER_NS_UNPRIVILEGED) which has some serious security implications, see Security#Sandboxing applications for details. Also worth noting that Docker itself has a rootless mode as well by now: https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/ I'm happy that there are Docker alternatives, but I have the feeling that podman has been hyped a lot recently and many articles and comments give the impression that it's more secure by default and without any downsides.

rpncreator 5y ago

The challenges I’ve had switching out Docker Engine, CLI, and Compose with Podman has been the absence of a vetted Docker Compose replacement. What I’ve done so far in replacing Docker Desktop has been to use just the CLI, Engine, and Compose on WSL2.

alexeldeib 5y ago
I never liked the GUI or desktop behavior. I just install containerd, point dockerd at it, and download everything manually. This is pretty much my install, sans systemd units: curl -LO https://download.docker.com/linux/static/stable/x86_64/docker-20.10.8.tgz tar -xvzf docker-20.10.8.tgz mv docker/dockerd /usr/bin/dockerd mv docker/docker-init /usr/bin/docker-init mv docker/docker-proxy /usr/bin/docker-proxy mv docker/docker /usr/bin/docker rm -rf docker rm docker-20.10.8.tgz
PhineasRex 5y ago
As of 3.0 you can apparently run docker-compose directly against podman in daemon mode (thought I haven't tried it).
- terinjokes 5y ago
  I've been running this way since the beginning of the year. Works great, just need to set DOCKER_HOST when launching docker-compose.
flemhans 5y ago
When I found out Podman supports Kubernetes pod YML files with `podman play kube`, I "ported" my Compose files to those, and that works pretty well (in the newest versions of Podman).

infogulch 5y ago

Can you use podman with ZFS on Linux volumes?

TD-Linux 5y ago
There is a dedicated storage driver for zfs: https://www.jwillikers.com/podman-with-btrfs-and-zfs https://www.jwillikers.com/podman-with-btrfs-and-zfs That said, the default overlay storage driver already supports reflinks, which will get you most of the benefits.
- yencabulator 5y ago
  Last I looked, ZFS didn't support reflinks. https://github.com/openzfs/zfs/issues/405 https://github.com/openzfs/zfs/issues/405

nitsky 5y ago

I love podman. When you write a file to a volume from a container, the user that spawned the container is the owner. This is exactly what you expect, but with docker, everything is written as root. After many years, this has not been fixed: https://github.com/moby/moby/issues/2259 https://github.com/moby/moby/issues/2259 This has made it impossible to use docker in scripts where root access is not available. Thank you podman!

nissarup 5y ago
Thank you! This has been my main headache with docker. I'll switch to podman at home.

yawaramin 5y ago

> It's the natural open-source Docker replacement. Docker recently changed the license and plans. Come on. While maybe not an outright lie, this is certainly bending the truth and leaving out crucial details–Docker CLI is still open source and free, just not Docker Desktop. While you can use podman on Linux (and should if it fits your needs!), you're not being forced to use it because Docker became paid or anything like that!

itsjloh 5y ago

I tried to give Podman a go on Ubuntu 20.04 and it _worked_ but I could never get it going with a docker-compose file. There is apparently support in the works, but I can't find or get that support on Ubuntu at this stage. Shame, I was hoping it might support IPv6 better than docker currently does.

nzrf 5y ago
I can’t speak for Ubuntu, but all of my containers are setup in docker compose for podman things start find there is a couple tweaks like container name I had to make, but over all pretty straightforward. I’d recommend another go if you are looking for an alternative. As I like rootless containers. I think the implementation feels awkward for local directory permission mounting volumes.

aorth 5y ago

The code snippet in the gist is posted twice in the blog post... and I don't know why it's not just posted in code blocks...

ggm 5y ago

There's only one Question really: can it use a Dockerfile?

otheracc 5y ago
Yes, and the more standard "Containerfile" works as well (same grammar but non-branded naming). Overall, it's a drop-in replacement with additional features and a more linux friendly underlying architecture. You can even alias podman to docker and shouldn't run into any issues.
- ggm 5y ago
  This is good. The inability to take build artifact inputs into FreeBSD bhyve/jails, is usually why people say they can't go there (it's certainly whats limiting me) -So having an alternate explicitly handle the input I HAVE moving to the product I WANT is really good. Thanks for clarifying.

ramconx 5y ago

what a shitty blog :)

terrywang 5y ago

Podman is not (YET) a drop-in replacement for Docker CE (on Linux), at least for me (even after 3.0.0 release when it adds seamless Docker Compose support, the way it does it contradicts daemon-less...). Deploying stacks (on Linux) Docker Compose style are typical use cases for using Docker, `podman-compose` works sometimes, however, over half of such initial attempts fail and require tinkering. Docker CE (at least for Linux) is still the best option when the use cases are simply clone the repo & deploy/run the stack using `docker-compose up -d`, it simply does the job at the best cost. podman / buildah / skopeo trio is definitely worth learning, podman can be very useful to migrate containerized workloads from local / standalone dev machines to production k8s clusters, by leveraging `generate kube`.

hda111 5y ago
No, it doesn’t contradict daemon-less (wrt resources used by the daemon). This “daemon” only runs activated by a systemd socket for a few seconds. Whereas Docker CE always runs at least containerd (dockerd is also socket activated). You could argue that conmon is the daemon of podman and every container has its own daemon. It’s a bit wasteful wrt memory but that how it’s designed.

crb 5y ago

I spoke to Red Hat's Dan Walsh, container team lead, and Brent Baude, the lead architect of Podman, on my podcast last week. It's a good primer to the what and why of Podman, Buildah, and all the other "not Docker" tools Red Hat makes. https://kubernetespodcast.com/episode/164-podman/ https://kubernetespodcast.com/episode/164-podman/