13 ms·

Podman vs. Docker: Comparing the two containerization tools

228 points by tambourine_man 4y ago

bayesian_horse 4y ago
Are there any real world incidents where the container-as-root thing has become a problem? A meta-study even? In these things I'm a bit helpless judging the cost vs benefit ratio.
- rhatdan 4y ago
  There have been major vulnerabilities over the years where being root allow the container to take over the system. Checkout https://www.stackrox.io/blog/the-runc-vulnerability-a-deep-dive-on-protecting-yourself/ https://www.stackrox.io/blog/the-runc-vulnerability-a-deep-d...
rhatdan 4y ago
Running containers without a daemon in rootful and rootless mode is better and more secure in many ways. If you want to understand all of the security features of Podman take a look at chapters 10 and 11 of my book `Podman in Action`. In the book I also have a nice comparison of features in Podman over Docker. Podman 4.4 was just released with a new feature called quadlet, which makes running podman containers under systemd really easy. You should see blogs on this very soon.
gorgoiler 4y ago
Daemonless operation sounds very compelling. It is often slow or complicated to deploy a docker installation just to be able to run a container when all I really want is a process. Conceptually (and I really mean conceptually, not technically) I don’t need a Python daemon to run a Python tool so why do I need a Docker daemon to run a containerized Python tool? LXC did this nicely, imho, by storing the state and configuration of each container as files in a directory. It doesn’t seem like LXC/LXD has really taken off (see also: bzr) — bad luck Canonical, but thank you for trying. Relating to both LXC vs Docker, and Docker vs Podman: oftentimes, the presence of competition is what drives the winner to victory. It might seem like wasted effort to have two competing solutions for a while but the final outcome of a winner that’s better than it would have been is of benefit to everyone. If I had a dollar for every project I started at work just to stone-soup one of my peers into action I would have more than… $20? $50? Postscript, written after reading the comments below (thanks!): when you need to get a project going in a creative field like software engineering, a useful technique is to start with something — anything at all — announce it, and invite meaningful contributions to take that thing from trivial starting point to a rich and useful product. The analogy is “stone soup”: a villager wants to put together a feast but doesn’t have the means to do it themselves. What they can do is get a fire going, get a pot of water simmering over the fire, and put a single rock in it. They then suggest to another villager “hey I’ve got this soup going but it would be even better with one of your onions: how about we work together?”. To another they say the same thing but for potatoes, to another a ham hock, ad finitum until the pot contains a rich and tasty broth. By kicking off the project, albeit with something that was just a framework, they were able to engage others interest and take the project to completion as a team. The more scurrilous version of this is shit soup. One villager sets up the pot / asks a question on stackoverflow. Predictably, no one engages. Another villager — secretly conspiring with the first — shows up and announces the correct ingredient to be added next is goat turd / replies to the stackoverflow question with a deliberately incorrect answer. Lo and behold all the other villagers now show up to explain why that answer is dumb, and in fact we should be adding onions, potatoes, and ham / insert correct technical answer to SO question here. Many of us will have come across this in The Pragmatic Programmer under “Stone Soup and Boiled Frogs”.
- ungamedplayer 4y ago
  I know the interpretation 'stone soup' you use, however there are other parts of the world that know it in a different story, i'll tell it here. When the english first attempted to colonize australia to Australia, an englishman noticed a native 'bush turkey' was not regularly eaten by the local native aboriginals. The englishman had tried to cook and eat them, but it ended up anything but tastey. He asked one of the tribal elders the secret to eating them, the elder responded. "You put a stone into the pot, you bring it to boil When its boiling you throw in the plucked bush turkey, you eat it when the stone is soft." The lesson I take from this is "sometimes things are just going to be bad, you just gotta accept that and move on".
  - SOLAR_FIELDS 4y ago
    I’m not sure I understand your anecdote. I had actually never heard of “stone soup” by grandparent but I found it in Wikipedia as this story: https://en.m.wikipedia.org/wiki/Stone_Soup https://en.m.wikipedia.org/wiki/Stone_Soup My interpretation of grandparent as applied onto that story was that some of their colleagues had some local solutions that were part of the puzzle and OP purposefully created some ancillary solution (the “stone soup”) to get them to contribute to the bigger picture. But perhaps I’m seeing this entirely wrong?
    - curryberto 4y ago
      The stone will never become soft in the soup - the bird will never be ready to eat.
    - gorgoiler 4y ago
      You got it, and thanks for replying! I added a ps to my original comment, to elaborate.
- mekster 4y ago
  > It doesn’t seem like LXC/LXD has really taken off Maybe for you but LXC is very useful for deploying development environment isolated for each developers. systemd-nspawn is quite simple but LXC provides tooling that makes operations easier. Docker and LXD serve different purposes. Docker is meant for an app to be run isolated but LXD can run a whole OS.
uneekname 4y ago
Does anyone here have experience / advice for building upon docker images to be run rootless? So many of the images in Docker Hub run as root by default, and its unclear to me if there's a standard UID for example to use when building them. Any resources on this would be helpful as I learn more about the topic. Thanks!
- rektide 4y ago
  That's not what rootless means at all. The image does not matter at all. What's at stake here is whether users can run a container under their own privileges, or whether the container ultimately is run by a root level user. In either case, whether the container uses a root or user within it isn't really a factor. There's good reasons to assume user permissions within the container, but they have nothing to do with rootless containers: the idea that a regular user can launch a container is a different concept, from the permissions inside the container.
  - uneekname 4y ago
    Thanks for your response. I was under the impression that the UID of a user within a container matches that which it runs under in the host machine. It sounds like that is not the case. From what I've read, the user running a container really starts to matter when the container is given access to the filesystem (using a volume). It sounds like the user within the container still wouldn't matter in this situation, but the user running the container on the host system would have to have appropriate permissions to the volume.
    - MereInterest 4y ago
      In rootfull docker, that is the case, and the uid inside the container is identical to the uid outside the container. In rootless docker, the uid inside the container maps to a sub-uid outside the container. This way, it inherits the same permissions that your own uid has. Honestly, I think the default behavior of rootfull docker is broken by design. Being able to run rootfull docker commands is equivalent to having sudo privileges, because the docker daemon has root privileges and will mount arbitrary files on your behalf.
AkihiroSuda 4y ago
> Because of its daemonless architecture, Podman can perform truly rootless operations. Daemonless isn't really relevant to rootless. containerd/buildkitd/dockerd have been supporting rootless mode too, and lots of rootless codes have been mutually ported over across containerd/buildkitd/dockerd and Podman.
- mekster 4y ago
  What exactly does rootless achieve? Is it some slight security benefit as in running OpenBSD instead of Linux but no difference for day to day usage? What are the advantage of running Podman over Docker except Podman ecosystem is less mature?
  - taftster 4y ago
    The biggest problem with Docker is that its containers are effectively running as root. This is basically OK when the containers you want to run are more like traditional daemons. But if you allow normal users to run containers, in a shared multiuser system, you are basically giving them root to do what they want with your system. e.g. if a normal user can execute a docker container, they can create a mount point for anywhere in your system. They can mount /etc or any other spooky place and be able to read from it like they are root. This is also potentially bad, for example, if you have a network facing daemon, like a web server. Let's say that you bind mount a directory on the host (because yeah, you want to serve up those static HTML files). The privileges of that container (Apache httpd or whatever) are basically running as root on the host system. Not good. There are solutions for all this, of course. But this is really where Podman was trying to bring in advantage and added-value over Docker. That and just running as a normal process rather than as a daemon.
    - AkihiroSuda 4y ago
      > The biggest problem with Docker is that its containers are effectively running as root. Both Docker and Podman support rootless mode (and rootful mode).
tapoxi 4y ago
I actually just switched my CI pipelines from Docker to Buildah this week to avoid using an old version of docker-dind and drop permissions on my build containers. It was incredibly easy. The arguments are exactly the same, so it was just a %s/docker/buildah/g Images from dockerhub also need to have docker.io/ appended to the front, since buildah doesn't assume dockerhub by default. There is apparently an option for aliases to set a default search namespace but it wasn't important enough for me to dive into.
- gorgoiler 4y ago
  Dodging dind is a worthy achievement. Thanks for posting your story. I would love to hear more details.
  - tapoxi 4y ago
    That's basically all there is to it. I'm using GitLab CI, pulling the official buildah image from quay.io. Everything worked on the second try (after appending docker.io/) for about a dozen "core" container builds. The downstream ones use Google Jib kicked off by a gradle build for our spring apps.
- sofixa 4y ago
  Kaniko is also a good alternative to buildah for building containers inside containers without dind.
  - saynay 4y ago
    Kaniko is what I use as well, since I initially had some containers that were not building correctly with buildah. Not quite as seamless as buildah promised to be, but it can read Dockerfiles with no modifications, so it was easy enough to move to.
deleted 4y ago
[deleted]
MuffinFlavored 4y ago
I got fed up with Docker having a "Virtual machine service" using like 4GB of memory (while running no containers) on my 8GB Mac so I investigated what I thought would be "native" (arm64) Lima. I tried this k8s https://github.com/lima-vm/lima/blob/f7e7addab557da560da7146a829c32c59e939a33/examples/k8s.yaml https://github.com/lima-vm/lima/blob/f7e7addab557da560da7146... example thinking it'd be a thin wrapper around QEMU. 6gb+ usage RAM with nothing deployed lol The disconnect to me is weird. I'm pretty sure with qemu-system-aarch64, Debian/Alpine don't use more than 100-200mb of RAM sitting idle. Where does 6GB of RAM usage come from? Not that I think it's a great use of time to optimize for this whatsoever. I just thought it'd be a fun exercise.
- voxic11 4y ago
  Its page cache[0]. A similar thing happens with wsl2 on Windows[1]. The issue is the linux kernel running in the lima-vm thinks all the ram you give the VM is free to cache files on, it doesn't know there is a host OS that could also make use of that ram. So after loading up a ton of containers where each has its own OS dependencies that ends up being a lot of files the kernel keeps cached so long as nothing else needs the memory. There isn't really a fix besides right sizing the amount of ram you give the VM. Or I guess you could disable file caching but I wouldn't recommend it[2]. [0] https://www.linuxatemyram.com/ https://www.linuxatemyram.com/ [1] https://news.ycombinator.com/item?id=26897095 https://news.ycombinator.com/item?id=26897095 [2] https://github.com/Feh/nocache https://github.com/Feh/nocache
  - 3np 4y ago
    One coukd also put their VM root filesystem in ZFS, switching the Linux page cache for more tunable ARC.
  - deleted 4y ago
    [deleted]
  - MuffinFlavored 4y ago
    When you're right, you're right. https://github.com/lima-vm/lima/blob/master/examples/default.yaml#L41 https://github.com/lima-vm/lima/blob/master/examples/default... 4gig default ~$ free -m total used free shared buff/cache available Mem: 3907 304 1446 1 2156 3431 Swap: 0 Thank you.
nunez 4y ago
The biggest difference is that Podman and Buildah are funded by and used underneath OpenShift which is a huge money maker for Red Hat while Docker is on life support with Mirantis holding the plug. Momentum around Docker that isn't Desktop all but halted in 2018 or so.
- taftster 4y ago
  Right. But Docker is not a charity. I think that Podman/Buildah is actually a superior solution. This might unfortunately mean the ultimate demise of Docker, Inc. as we know them. To be fair, I literally use Docker everyday. So I'm not necessarily rooting for its demise. But I'm seemingly happy that innovation is at least coming from somewhere in this space.
- alpark3 4y ago
  Really? I thought Docker was pretty widely used at companies for deployment, etc. At least it was at my company ~1 year ago. I wasn't aware that Docker was on life support in any sense.
  - nunez 4y ago
    A lot of people use Docker A lot of people also don't pay for Docker
  - californical 4y ago
    Widely used, but I don’t think it makes a whole lot of money to sustain itself
    - tonyhb 4y ago
      I think it’s north of $100m a year now so all of the life support talk is not based in truth.
      - deleted 4y ago
        [deleted]
      - 4y ago
taftster 4y ago
I'm surprised that the article doesn't mention the royal pain that is of the user id mappings required for execution of limited privilege containers. This is by far the biggest con and pain in the butt with using Podman.* Though I acknowledge the problem, the user id mapping file is really unfortunate and basically non-portable between systems. I hope there has been better tooling built up around this lately, as Podman basically "wins" over Docker in my book, in all other ways. But the pain required to setup and properly manage user-privileged containers with Podman is just a bit too terse and becomes a significant barrier. *[edit] to be fair, also a pain with rootless Docker too.
- fulafel 4y ago
  The main architectural problem here (originating in Docker) is promoting the shared volume system in the first place. It's just the wrong thing to try in so many ways. It's insecure and runs are non-reproducible. And the OS integration is like a tragedy novel when you look at all the different platforms with unique problems on each. A much better way would be to support automatically copying inputs in and outputs out using the existing layer system. (As an optimization you could it in a rsyncish way)
- FooBarWidget 4y ago
  I wrote a portable solution for the user ID mapping problem: https://github.com/FooBarWidget/matchhostfsowner https://github.com/FooBarWidget/matchhostfsowner It's an init program — written in Rust — that changes the UID of an account (including home directory) inside the container to match that of the host. It takes care of corner cases such as what happens if there's a conflicting account, or when the user wants to run as root, or when chowning the home directory is too slow, etc. In a related article I detail why such a program is non-trivial, what all the caveats are that one might have to look out for, and what alternative approaches exist (e.g. bind mounts): https://www.joyfulbikeshedding.com/blog/2021-03-15-docker-and-the-host-filesystem-owner-matching-problem.html https://www.joyfulbikeshedding.com/blog/2021-03-15-docker-an...
- pkulak 4y ago
  I remember it used to be a thing to deal with, but in the last year installing Podman has been the only step I’ve needed to take. Well, and I use Fedora now, where it obviously works out of the box. I think it’s a solved problem at this point.
triggercut 4y ago
With the Docker enterprise licensing stuff last year, I had to cease use of Docker Desktop at work which has been really annoying. As a non-dev who dabbles and roles their own tools it means my primary use case of firing up a DB really quickly and easily when needed is gone. I've been eyeing podman but the additional friction scares me off from jumping in. Has anyone else not doing full-time dev found it (or similar) a simple enough replacement?
- bayesian_horse 4y ago
  have you looked into installing an actual linux distribution on wsl2 and using docker on that?
- WirelessGigabit 4y ago
  Install Docker in WSL (still free). Install Rancher Desktop. Connect to Docker in WSL. Or if on Linux same as above, but remove the WSL part.
  - sebazzz 4y ago
    Problem for developers in the Microsoft stack is that Visual Studio requires Docker Desktop to be installed - unless Rancher is able to fake that.
    - rstuart4133 4y ago
      > Problem for developers in the Microsoft stack is that Visual Studio requires Docker Desktop to be installed I'm not sure what you are referring to here. I run Docker engine in WSL2, and vscode in Windows. It all seems to work seemlessly to me. What am I missing?
      - depereo 4y ago
        Visual Studio is not vscode.
    - WirelessGigabit 4y ago
bayesian_horse 4y ago
I think my main pain point would be switching from docker-compose to something that would work with podman...
- blotzy 4y ago
  docker-compose can work with podman running its socket service. There is also a podman-compose, which is mostly feature compatible. That said, the transition can be painful. Especially from root to rootless.
- chocobor 4y ago
  Like podman-compose? Seems to have the same cli. I think you cna install it with pip install podman-compose
- pkulak 4y ago
  Just make a pod.yaml and run it with podman pod play pod.yaml I think that’s it. I’m on mobile at the moment.
  - rhatdan 4y ago
    Agree, I believe that the world should move to using Kubernetes YAML for running multiple container workloads. Whether you are running on a single node or in a kubernetes cluster. Docker-Compose while supported by Podman, does not allow you to easily migrate your applications to Kubernetes.
- bayesian_horse 4y ago
  Yes, I wrote that comment without researching the alternatives. Which is also a point: Ain't nobody (or at least somebody) got time for that. Docker(compose) worked well for me for a long time. I'm chafing a little at the "run as root" problems, so I'm somewhat open to alternatives. I'm also a bit hesitant to relearn or run into problems I don't actually NEED to run into.
- arcanemachiner 4y ago
  The answer, ironically, is `docker-compose` with the `-H` flag pointing to your podman socket.
Operative0198 4y ago
From my subjective experience, Podman to date remains an unfinished toy and Docker is still the gold standard for running containers.
- MrDresden 4y ago
  Can you elaborate on what caused you to have that view?
  - Operative0198 4y ago
    Some of the cons of rootless/podman * last time I used systemd units to manage podman containers, it was an inconsistent failure and a catastrophe with containers failing to start. * podman-compose is not yet officially supported. * pods are confusing. * any use of privileged ports (<1024) requires messing with sysctl values as workaround. yikes! * no pre-defined apparmor/selinux profiles for common processes. * folder/file permissions under user namespaces is a confusing mess. * slirp4netns eats cpu and has awful performance. * can't do GPU and other deeper HW related tasks. I could go on and on... Docker has none of these inadequacies.
    - rhatdan 4y ago
      Most of these are issues with running rootless not necessarily with running podman. Podman in rootful mode does not have most of these issues.
      - Operative0198 4y ago
        Podman is default rootless and Docker is default rootful. It's a fair comparison.
        rhatdan 4y ago
        Sure, and bottom line the OS/Kernel prevent you from doing some things in rootless mode, although we are always attempting to push the boundaries on what is allowed, in a secure way. Rootless mode works for the great majority of containers, and in most cases users have work arounds for containers that do not work, like binding to ports < 1024. But I agree that understanding these limitations, sometimes requires users to learn new things. But Security often requires compromise, we don't run all processes as root for a reason in Linux.Running processes with privilege mode by default is way more secure.
hknmtt 4y ago
thankfully i work with compiled language so can run native binaries and not have to deal with this crap.
- pkulak 4y ago
  Do you statically link glibc? Everything needs an environment to run in. I wrap all my Rust projects in a container for ease of deployment.
  - hknmtt 4y ago
    > Everything needs an environment to run in It's called the Operating System.(obviously i am talking about production not development).
- Alifatisk 4y ago
  A self contained binary is fine, but if a program is going to clutter my system then I prefer it to be containerized.
  - hknmtt 4y ago
    That sounds like a development environment problem, not a production environment problem.
koteyur 4y ago
I've asked ChatGPT if the text (I copy&pasted the paragraph about pros/cons) is generated by it, and it said yes. See screenshot: https://i.ibb.co/NmmytNB/Screenshot-20230209-094632-Firefox.jpg https://i.ibb.co/NmmytNB/Screenshot-20230209-094632-Firefox....
- stingraycharles 4y ago
  What’s the accuracy of this tool?
  - koteyur 4y ago
    Good question, I have no idea to be honest. The text looked like ChatGPT's for me (after many hours talking to it :D), that's why I asked to check what it thinks. But I won't be surprised if it's wrong and text is written by human. I wouldn't take it so serious, even if it's generated I don't see a problem here while it's correct (if so).
- criddell 4y ago
  Do you have any particular problem with the content of the article?
  - koteyur 4y ago
    Nope, it's good for me. :) I just shared fun fact (that chatgpt thinks it's generated by it), but it doesn't mean that it's true or the article is bad.
  - jpambrun 4y ago
    There is already a ton of generated spam content to the point where search is almost broken. Spam generated by a better generator trained on spam is still spam. Also normal etiquette is to quote text that isn't yours. To me, this reflects extremely poorly on the author.
    - criddell 4y ago
decide1000 4y ago
On FreeBSD there is something called Bhyve. It is an efficient container solution with several native FreeBsd advantages like OpenZFS and NVMe support. That enables features like rapid async replication and extreme corruption protection. Also in terms of speed and overhead (resource usage) it works amazing. Another FreeBSD solution is Jails. I never seen a more powerful container solution. It is lightweight and has unique features like hierarchical Jails. Management is done over cli or solutions like Iocage. Jails and its ancestors have been developed since 1975. The modern Jails is developed since 1998. It is an incredible flexible and lightweight virtualization platform. Michael W Lucas wrote a very good book about it ("FreeBSD Mastery: Jails").
- CoolCold 4y ago
  Sounds like FreeBSD could make DX much better even 20 years ago, before any Docker was created, but opted out of such step further? Or have not seen opportunity? Or some other specific reason?
  - decide1000 4y ago
    In popularity Unix is not the main OS for most developers. However, FreeBSD and jails, are used by the worlds largest companies. Netflix is famous for it but there are many examples. In my opinion the popularity of the OS among developers might be one of the reasons. Unix seems hardcore compared to Linux. I started to look at FreeBSD when I needed the network power, now I don't use anything else. For starters; Try GhostBSD - FreeBSD with a MATE desktop.
    - rhatdan 4y ago
      BTW Podman has been ported to FreeBSD and works with jails. Although I have never tried it.
    - crabbone 4y ago
      Linux is certified UNIX... Developers aren't "scared of UNIX". They are scared of things they don't know, and "don't know" in this context means Google search page doesn't explode with results when they search for the thing. Anecdotally, people in storage business are much more familiar with FreeBSD due to FreeNAS and ZFS in general, but as some of my colleagues who previously worked for Dell EMC "storage division"^* recalled, the second most popular platform they had to adapt their storage solutions for was AIX... (and that trailed far, far behind Linux). It's also funny, in a way, since internally, they often did use FreeBSD in various departments because of FreeNAS. In a similar company, our home directory on dev. server was backed up by FreeNAS (we were also developing a storage product... for Linux). ---- * - There isn't really a "storage division" within Dell EMC afaik, just a bunch of different storage-related projects. I just had to describe those projects in some way.
the8472 4y ago
Is there a way to run podman as non-root but with a privileged helper (or some caps) for proper bridged network setup?
- rhatdan 4y ago
  No, but you can precreate a network namespace and allow rootless Podman to join the network namespace.
  - rhatdan 4y ago
    BTW Podman now supports pasta as well as slirp4netns. I am told pasta gives you better network performance in rootless mode, although I have never tried it.
hnarn 4y ago
This page is unreadable without clicking through a cookie popup that takes up the entire screen. Here's a tip: nobody wants "targeting cookies", and if someone belongs to the 0.01% that do, you can let them enable it manually, instead of using semi-dark patterns to have uneducated users accept all cookies without understanding what that choice means. I understand some pages need advertising revenue to survive, and that targeted advertising brings in a lot more revenue, but Linode is not a blog, it's a cloud provider valued at almost a billion dollars. They don't need to do this.
- decide1000 4y ago
  On Firefox I use the addon Consent-O-Matic which does the automatic handling of GDPR consent forms.
  - JW_00000 4y ago
    I use the same but it didn't work very well on this site. It took a long time, and the background remained semi-transparent black after it finished.
- ptman 4y ago
  And use plausible/fathom/goatcounter/... instead of something that uses cookies
  - nicbou 4y ago
    I use Plausible (it's fantastic), but it misses a lot of the insights I used to get with Google Analytics, including simple navigation flow between pages. This is fine. Insight is overrated. However I'm not optimizing for conversions, while Linode probably has professionals doing that full time. I can't imagine trying to convince my boss to blind the marketing team, especially since the effect is immeasurable by design. I can use Plausible because it doesn't threaten a whole department.
  - ElectricalUnion 4y ago
    Relevant legislation (say, GDPR) says nothing specific about cookies, just about using client-side state. Granted, relevant legislation also says privacy should be the default, and that you can't coerce people into accepting loss of privacy. Anyways, that would then need to use a, say, "local storage banner" for most intrusive tracking and we're back to square one.
dathinab 4y ago
> Thus, even limited users executing Docker commands are getting those commands fulfilled by a process with root privileges, a further security concern. I would say: A complete security nightmare which make all kind of "smaller" security issues in other places (e.g. IDE) WAY worse and would put docker on a ban-list if the industry really did care about security. Through then you _can_ setup docker without this vulnerability AFIK it's just not done by default in most setups and I'm not sure how hard it is.
- tinus_hn 4y ago
  So there’s the answer: industry doesn’t care. Industry is all about ‘just turn off UAC, just run it all as administrator, just click to bypass the unsigned driver dialogs’ as long as it works.
- navbaker 4y ago
  Docker is already on an informal ban list when it come to US government container deployments in higher classification environments. Most of those situations require Podman based solutions.
  - rhatdan 4y ago
    This is also related to the Client Server model supported by Docker versus the Fork/Exec Model supported by Podman. Podman works closely with the HPC (High Performance Computing) world. Checkout the article about how the fastest computers in the world in the most secure facilities in the world are using Podman. https://www.nersc.gov/assets/Uploads/06-Containers-for-HPC-Shifter-and-Podman.pdf https://www.nersc.gov/assets/Uploads/06-Containers-for-HPC-S... https://opensource.com/article/23/1/hpc-containers-scale-using-podman https://opensource.com/article/23/1/hpc-containers-scale-usi...
  - mardifoufs 4y ago
    But docker can also run rootless for almost as long as podman has existed. Why would it still be on such a blacklist?
chromatin 4y ago
I wonder if they could make the text smaller and make the contrast even lower? I don't think this passes WCAG accessibility guidelines (although I didn't check the exact size and hex color). Really disappointing that it's too difficult to read, because it looks interesting.
kissgyorgy 4y ago
The most important word is not even on the page: systemd. If you want to run containers as a service with systemd, the only proper way you can do that is with podman, because of the daemonless model. When you use `docker run` command in a systemd unit, that only monitors the docker client exit status and whatnot, the actual process will run in a separate process (started by docker daemon) so systemd can't stop/restart or monitor it at all. Only with podman can you do that.
- rollcat 4y ago
  That's an important point. While I have my own reservations wrt systemd, you do want a single, coherent supervision scheme that is the source of all truth about the current (and desired) state of the system, with centralised logging, metrics, etc. Docker can't fill the role of that "one true" supervisor, because you still need some host-side services to bootstrap it, like a dhcp/ntp, acpid, sshd, or the Docker daemon itself. In defense of Docker (at least it's my impression for why they do things the way they do), you actually want a higher-level abstraction over running a single, specific container, and it starts making sense as you move into a clustering context. Even if you have a basic 2-node cluster, and want to deploy a couple different workloads to it (like some internal webapps, a memcache, a cron job, etc), neither systemd nor any of its direct alternatives give you the necessary tools to "just throw" the workloads at the cluster as a single logical entity. (Of course clusters start getting more interesting again, once you want to deploy stateful things like databases.)

Are there any real world incidents where the container-as-root thing has become a problem? A meta-study even? In these things I'm a bit helpless judging the cost vs benefit ratio.

rhatdan 4y ago
There have been major vulnerabilities over the years where being root allow the container to take over the system. Checkout https://www.stackrox.io/blog/the-runc-vulnerability-a-deep-dive-on-protecting-yourself/ https://www.stackrox.io/blog/the-runc-vulnerability-a-deep-d...

rhatdan 4y ago

Running containers without a daemon in rootful and rootless mode is better and more secure in many ways. If you want to understand all of the security features of Podman take a look at chapters 10 and 11 of my book `Podman in Action`. In the book I also have a nice comparison of features in Podman over Docker. Podman 4.4 was just released with a new feature called quadlet, which makes running podman containers under systemd really easy. You should see blogs on this very soon.

gorgoiler 4y ago

Daemonless operation sounds very compelling. It is often slow or complicated to deploy a docker installation just to be able to run a container when all I really want is a process. Conceptually (and I really mean conceptually, not technically) I don’t need a Python daemon to run a Python tool so why do I need a Docker daemon to run a containerized Python tool? LXC did this nicely, imho, by storing the state and configuration of each container as files in a directory. It doesn’t seem like LXC/LXD has really taken off (see also: bzr) — bad luck Canonical, but thank you for trying. Relating to both LXC vs Docker, and Docker vs Podman: oftentimes, the presence of competition is what drives the winner to victory. It might seem like wasted effort to have two competing solutions for a while but the final outcome of a winner that’s better than it would have been is of benefit to everyone. If I had a dollar for every project I started at work just to stone-soup one of my peers into action I would have more than… $20? $50? Postscript, written after reading the comments below (thanks!): when you need to get a project going in a creative field like software engineering, a useful technique is to start with something — anything at all — announce it, and invite meaningful contributions to take that thing from trivial starting point to a rich and useful product. The analogy is “stone soup”: a villager wants to put together a feast but doesn’t have the means to do it themselves. What they can do is get a fire going, get a pot of water simmering over the fire, and put a single rock in it. They then suggest to another villager “hey I’ve got this soup going but it would be even better with one of your onions: how about we work together?”. To another they say the same thing but for potatoes, to another a ham hock, ad finitum until the pot contains a rich and tasty broth. By kicking off the project, albeit with something that was just a framework, they were able to engage others interest and take the project to completion as a team. The more scurrilous version of this is shit soup. One villager sets up the pot / asks a question on stackoverflow. Predictably, no one engages. Another villager — secretly conspiring with the first — shows up and announces the correct ingredient to be added next is goat turd / replies to the stackoverflow question with a deliberately incorrect answer. Lo and behold all the other villagers now show up to explain why that answer is dumb, and in fact we should be adding onions, potatoes, and ham / insert correct technical answer to SO question here. Many of us will have come across this in The Pragmatic Programmer under “Stone Soup and Boiled Frogs”.

ungamedplayer 4y ago
I know the interpretation 'stone soup' you use, however there are other parts of the world that know it in a different story, i'll tell it here. When the english first attempted to colonize australia to Australia, an englishman noticed a native 'bush turkey' was not regularly eaten by the local native aboriginals. The englishman had tried to cook and eat them, but it ended up anything but tastey. He asked one of the tribal elders the secret to eating them, the elder responded. "You put a stone into the pot, you bring it to boil When its boiling you throw in the plucked bush turkey, you eat it when the stone is soft." The lesson I take from this is "sometimes things are just going to be bad, you just gotta accept that and move on".
- SOLAR_FIELDS 4y ago
  I’m not sure I understand your anecdote. I had actually never heard of “stone soup” by grandparent but I found it in Wikipedia as this story: https://en.m.wikipedia.org/wiki/Stone_Soup https://en.m.wikipedia.org/wiki/Stone_Soup My interpretation of grandparent as applied onto that story was that some of their colleagues had some local solutions that were part of the puzzle and OP purposefully created some ancillary solution (the “stone soup”) to get them to contribute to the bigger picture. But perhaps I’m seeing this entirely wrong?
  - curryberto 4y ago
    The stone will never become soft in the soup - the bird will never be ready to eat.
  - gorgoiler 4y ago
    You got it, and thanks for replying! I added a ps to my original comment, to elaborate.
mekster 4y ago
> It doesn’t seem like LXC/LXD has really taken off Maybe for you but LXC is very useful for deploying development environment isolated for each developers. systemd-nspawn is quite simple but LXC provides tooling that makes operations easier. Docker and LXD serve different purposes. Docker is meant for an app to be run isolated but LXD can run a whole OS.

uneekname 4y ago

Does anyone here have experience / advice for building upon docker images to be run rootless? So many of the images in Docker Hub run as root by default, and its unclear to me if there's a standard UID for example to use when building them. Any resources on this would be helpful as I learn more about the topic. Thanks!

rektide 4y ago
That's not what rootless means at all. The image does not matter at all. What's at stake here is whether users can run a container under their own privileges, or whether the container ultimately is run by a root level user. In either case, whether the container uses a root or user within it isn't really a factor. There's good reasons to assume user permissions within the container, but they have nothing to do with rootless containers: the idea that a regular user can launch a container is a different concept, from the permissions inside the container.
- uneekname 4y ago
  Thanks for your response. I was under the impression that the UID of a user within a container matches that which it runs under in the host machine. It sounds like that is not the case. From what I've read, the user running a container really starts to matter when the container is given access to the filesystem (using a volume). It sounds like the user within the container still wouldn't matter in this situation, but the user running the container on the host system would have to have appropriate permissions to the volume.
  - MereInterest 4y ago
    In rootfull docker, that is the case, and the uid inside the container is identical to the uid outside the container. In rootless docker, the uid inside the container maps to a sub-uid outside the container. This way, it inherits the same permissions that your own uid has. Honestly, I think the default behavior of rootfull docker is broken by design. Being able to run rootfull docker commands is equivalent to having sudo privileges, because the docker daemon has root privileges and will mount arbitrary files on your behalf.

AkihiroSuda 4y ago

> Because of its daemonless architecture, Podman can perform truly rootless operations. Daemonless isn't really relevant to rootless. containerd/buildkitd/dockerd have been supporting rootless mode too, and lots of rootless codes have been mutually ported over across containerd/buildkitd/dockerd and Podman.

mekster 4y ago
What exactly does rootless achieve? Is it some slight security benefit as in running OpenBSD instead of Linux but no difference for day to day usage? What are the advantage of running Podman over Docker except Podman ecosystem is less mature?
- taftster 4y ago
  The biggest problem with Docker is that its containers are effectively running as root. This is basically OK when the containers you want to run are more like traditional daemons. But if you allow normal users to run containers, in a shared multiuser system, you are basically giving them root to do what they want with your system. e.g. if a normal user can execute a docker container, they can create a mount point for anywhere in your system. They can mount /etc or any other spooky place and be able to read from it like they are root. This is also potentially bad, for example, if you have a network facing daemon, like a web server. Let's say that you bind mount a directory on the host (because yeah, you want to serve up those static HTML files). The privileges of that container (Apache httpd or whatever) are basically running as root on the host system. Not good. There are solutions for all this, of course. But this is really where Podman was trying to bring in advantage and added-value over Docker. That and just running as a normal process rather than as a daemon.
  - AkihiroSuda 4y ago
    > The biggest problem with Docker is that its containers are effectively running as root. Both Docker and Podman support rootless mode (and rootful mode).

tapoxi 4y ago

I actually just switched my CI pipelines from Docker to Buildah this week to avoid using an old version of docker-dind and drop permissions on my build containers. It was incredibly easy. The arguments are exactly the same, so it was just a %s/docker/buildah/g Images from dockerhub also need to have docker.io/ appended to the front, since buildah doesn't assume dockerhub by default. There is apparently an option for aliases to set a default search namespace but it wasn't important enough for me to dive into.

gorgoiler 4y ago
Dodging dind is a worthy achievement. Thanks for posting your story. I would love to hear more details.
- tapoxi 4y ago
  That's basically all there is to it. I'm using GitLab CI, pulling the official buildah image from quay.io. Everything worked on the second try (after appending docker.io/) for about a dozen "core" container builds. The downstream ones use Google Jib kicked off by a gradle build for our spring apps.
sofixa 4y ago
Kaniko is also a good alternative to buildah for building containers inside containers without dind.
- saynay 4y ago
  Kaniko is what I use as well, since I initially had some containers that were not building correctly with buildah. Not quite as seamless as buildah promised to be, but it can read Dockerfiles with no modifications, so it was easy enough to move to.

deleted 4y ago

[deleted]

MuffinFlavored 4y ago

I got fed up with Docker having a "Virtual machine service" using like 4GB of memory (while running no containers) on my 8GB Mac so I investigated what I thought would be "native" (arm64) Lima. I tried this k8s https://github.com/lima-vm/lima/blob/f7e7addab557da560da7146a829c32c59e939a33/examples/k8s.yaml https://github.com/lima-vm/lima/blob/f7e7addab557da560da7146... example thinking it'd be a thin wrapper around QEMU. 6gb+ usage RAM with nothing deployed lol The disconnect to me is weird. I'm pretty sure with qemu-system-aarch64, Debian/Alpine don't use more than 100-200mb of RAM sitting idle. Where does 6GB of RAM usage come from? Not that I think it's a great use of time to optimize for this whatsoever. I just thought it'd be a fun exercise.

voxic11 4y ago
Its page cache[0]. A similar thing happens with wsl2 on Windows[1]. The issue is the linux kernel running in the lima-vm thinks all the ram you give the VM is free to cache files on, it doesn't know there is a host OS that could also make use of that ram. So after loading up a ton of containers where each has its own OS dependencies that ends up being a lot of files the kernel keeps cached so long as nothing else needs the memory. There isn't really a fix besides right sizing the amount of ram you give the VM. Or I guess you could disable file caching but I wouldn't recommend it[2]. [0] https://www.linuxatemyram.com/ https://www.linuxatemyram.com/ [1] https://news.ycombinator.com/item?id=26897095 https://news.ycombinator.com/item?id=26897095 [2] https://github.com/Feh/nocache https://github.com/Feh/nocache
- 3np 4y ago
  One coukd also put their VM root filesystem in ZFS, switching the Linux page cache for more tunable ARC.
- deleted 4y ago
  [deleted]
- MuffinFlavored 4y ago
  When you're right, you're right. https://github.com/lima-vm/lima/blob/master/examples/default.yaml#L41 https://github.com/lima-vm/lima/blob/master/examples/default... 4gig default ~$ free -m total used free shared buff/cache available Mem: 3907 304 1446 1 2156 3431 Swap: 0 Thank you.

nunez 4y ago

The biggest difference is that Podman and Buildah are funded by and used underneath OpenShift which is a huge money maker for Red Hat while Docker is on life support with Mirantis holding the plug. Momentum around Docker that isn't Desktop all but halted in 2018 or so.

taftster 4y ago
Right. But Docker is not a charity. I think that Podman/Buildah is actually a superior solution. This might unfortunately mean the ultimate demise of Docker, Inc. as we know them. To be fair, I literally use Docker everyday. So I'm not necessarily rooting for its demise. But I'm seemingly happy that innovation is at least coming from somewhere in this space.
alpark3 4y ago
Really? I thought Docker was pretty widely used at companies for deployment, etc. At least it was at my company ~1 year ago. I wasn't aware that Docker was on life support in any sense.
- nunez 4y ago
  A lot of people use Docker A lot of people also don't pay for Docker
- californical 4y ago
  Widely used, but I don’t think it makes a whole lot of money to sustain itself
  - tonyhb 4y ago
    I think it’s north of $100m a year now so all of the life support talk is not based in truth.
    - deleted 4y ago
      [deleted]
    - 4y ago

taftster 4y ago

I'm surprised that the article doesn't mention the royal pain that is of the user id mappings required for execution of limited privilege containers. This is by far the biggest con and pain in the butt with using Podman.* Though I acknowledge the problem, the user id mapping file is really unfortunate and basically non-portable between systems. I hope there has been better tooling built up around this lately, as Podman basically "wins" over Docker in my book, in all other ways. But the pain required to setup and properly manage user-privileged containers with Podman is just a bit too terse and becomes a significant barrier. *[edit] to be fair, also a pain with rootless Docker too.

fulafel 4y ago
The main architectural problem here (originating in Docker) is promoting the shared volume system in the first place. It's just the wrong thing to try in so many ways. It's insecure and runs are non-reproducible. And the OS integration is like a tragedy novel when you look at all the different platforms with unique problems on each. A much better way would be to support automatically copying inputs in and outputs out using the existing layer system. (As an optimization you could it in a rsyncish way)
FooBarWidget 4y ago
I wrote a portable solution for the user ID mapping problem: https://github.com/FooBarWidget/matchhostfsowner https://github.com/FooBarWidget/matchhostfsowner It's an init program — written in Rust — that changes the UID of an account (including home directory) inside the container to match that of the host. It takes care of corner cases such as what happens if there's a conflicting account, or when the user wants to run as root, or when chowning the home directory is too slow, etc. In a related article I detail why such a program is non-trivial, what all the caveats are that one might have to look out for, and what alternative approaches exist (e.g. bind mounts): https://www.joyfulbikeshedding.com/blog/2021-03-15-docker-and-the-host-filesystem-owner-matching-problem.html https://www.joyfulbikeshedding.com/blog/2021-03-15-docker-an...
pkulak 4y ago
I remember it used to be a thing to deal with, but in the last year installing Podman has been the only step I’ve needed to take. Well, and I use Fedora now, where it obviously works out of the box. I think it’s a solved problem at this point.

triggercut 4y ago

With the Docker enterprise licensing stuff last year, I had to cease use of Docker Desktop at work which has been really annoying. As a non-dev who dabbles and roles their own tools it means my primary use case of firing up a DB really quickly and easily when needed is gone. I've been eyeing podman but the additional friction scares me off from jumping in. Has anyone else not doing full-time dev found it (or similar) a simple enough replacement?

bayesian_horse 4y ago
have you looked into installing an actual linux distribution on wsl2 and using docker on that?
WirelessGigabit 4y ago
Install Docker in WSL (still free). Install Rancher Desktop. Connect to Docker in WSL. Or if on Linux same as above, but remove the WSL part.
- sebazzz 4y ago
  Problem for developers in the Microsoft stack is that Visual Studio requires Docker Desktop to be installed - unless Rancher is able to fake that.
  - rstuart4133 4y ago
    > Problem for developers in the Microsoft stack is that Visual Studio requires Docker Desktop to be installed I'm not sure what you are referring to here. I run Docker engine in WSL2, and vscode in Windows. It all seems to work seemlessly to me. What am I missing?
    - depereo 4y ago
      Visual Studio is not vscode.
  - WirelessGigabit 4y ago

bayesian_horse 4y ago

I think my main pain point would be switching from docker-compose to something that would work with podman...

blotzy 4y ago
docker-compose can work with podman running its socket service. There is also a podman-compose, which is mostly feature compatible. That said, the transition can be painful. Especially from root to rootless.
chocobor 4y ago
Like podman-compose? Seems to have the same cli. I think you cna install it with pip install podman-compose
pkulak 4y ago
Just make a pod.yaml and run it with podman pod play pod.yaml I think that’s it. I’m on mobile at the moment.
- rhatdan 4y ago
  Agree, I believe that the world should move to using Kubernetes YAML for running multiple container workloads. Whether you are running on a single node or in a kubernetes cluster. Docker-Compose while supported by Podman, does not allow you to easily migrate your applications to Kubernetes.
bayesian_horse 4y ago
Yes, I wrote that comment without researching the alternatives. Which is also a point: Ain't nobody (or at least somebody) got time for that. Docker(compose) worked well for me for a long time. I'm chafing a little at the "run as root" problems, so I'm somewhat open to alternatives. I'm also a bit hesitant to relearn or run into problems I don't actually NEED to run into.
arcanemachiner 4y ago
The answer, ironically, is `docker-compose` with the `-H` flag pointing to your podman socket.

Operative0198 4y ago

From my subjective experience, Podman to date remains an unfinished toy and Docker is still the gold standard for running containers.

MrDresden 4y ago
Can you elaborate on what caused you to have that view?
- Operative0198 4y ago
  Some of the cons of rootless/podman * last time I used systemd units to manage podman containers, it was an inconsistent failure and a catastrophe with containers failing to start. * podman-compose is not yet officially supported. * pods are confusing. * any use of privileged ports (<1024) requires messing with sysctl values as workaround. yikes! * no pre-defined apparmor/selinux profiles for common processes. * folder/file permissions under user namespaces is a confusing mess. * slirp4netns eats cpu and has awful performance. * can't do GPU and other deeper HW related tasks. I could go on and on... Docker has none of these inadequacies.
  - rhatdan 4y ago
    Most of these are issues with running rootless not necessarily with running podman. Podman in rootful mode does not have most of these issues.
    - Operative0198 4y ago
      Podman is default rootless and Docker is default rootful. It's a fair comparison.
      - rhatdan 4y ago
        Sure, and bottom line the OS/Kernel prevent you from doing some things in rootless mode, although we are always attempting to push the boundaries on what is allowed, in a secure way. Rootless mode works for the great majority of containers, and in most cases users have work arounds for containers that do not work, like binding to ports < 1024. But I agree that understanding these limitations, sometimes requires users to learn new things. But Security often requires compromise, we don't run all processes as root for a reason in Linux.Running processes with privilege mode by default is way more secure.

hknmtt 4y ago

thankfully i work with compiled language so can run native binaries and not have to deal with this crap.

pkulak 4y ago
Do you statically link glibc? Everything needs an environment to run in. I wrap all my Rust projects in a container for ease of deployment.
- hknmtt 4y ago
  > Everything needs an environment to run in It's called the Operating System.(obviously i am talking about production not development).
Alifatisk 4y ago
A self contained binary is fine, but if a program is going to clutter my system then I prefer it to be containerized.
- hknmtt 4y ago
  That sounds like a development environment problem, not a production environment problem.

koteyur 4y ago

I've asked ChatGPT if the text (I copy&pasted the paragraph about pros/cons) is generated by it, and it said yes. See screenshot: https://i.ibb.co/NmmytNB/Screenshot-20230209-094632-Firefox.jpg https://i.ibb.co/NmmytNB/Screenshot-20230209-094632-Firefox....

stingraycharles 4y ago
What’s the accuracy of this tool?
- koteyur 4y ago
  Good question, I have no idea to be honest. The text looked like ChatGPT's for me (after many hours talking to it :D), that's why I asked to check what it thinks. But I won't be surprised if it's wrong and text is written by human. I wouldn't take it so serious, even if it's generated I don't see a problem here while it's correct (if so).
criddell 4y ago
Do you have any particular problem with the content of the article?
- koteyur 4y ago
  Nope, it's good for me. :) I just shared fun fact (that chatgpt thinks it's generated by it), but it doesn't mean that it's true or the article is bad.
- jpambrun 4y ago
  There is already a ton of generated spam content to the point where search is almost broken. Spam generated by a better generator trained on spam is still spam. Also normal etiquette is to quote text that isn't yours. To me, this reflects extremely poorly on the author.
  - criddell 4y ago

decide1000 4y ago

On FreeBSD there is something called Bhyve. It is an efficient container solution with several native FreeBsd advantages like OpenZFS and NVMe support. That enables features like rapid async replication and extreme corruption protection. Also in terms of speed and overhead (resource usage) it works amazing. Another FreeBSD solution is Jails. I never seen a more powerful container solution. It is lightweight and has unique features like hierarchical Jails. Management is done over cli or solutions like Iocage. Jails and its ancestors have been developed since 1975. The modern Jails is developed since 1998. It is an incredible flexible and lightweight virtualization platform. Michael W Lucas wrote a very good book about it ("FreeBSD Mastery: Jails").

CoolCold 4y ago
Sounds like FreeBSD could make DX much better even 20 years ago, before any Docker was created, but opted out of such step further? Or have not seen opportunity? Or some other specific reason?
- decide1000 4y ago
  In popularity Unix is not the main OS for most developers. However, FreeBSD and jails, are used by the worlds largest companies. Netflix is famous for it but there are many examples. In my opinion the popularity of the OS among developers might be one of the reasons. Unix seems hardcore compared to Linux. I started to look at FreeBSD when I needed the network power, now I don't use anything else. For starters; Try GhostBSD - FreeBSD with a MATE desktop.
  - rhatdan 4y ago
    BTW Podman has been ported to FreeBSD and works with jails. Although I have never tried it.
  - crabbone 4y ago
    Linux is certified UNIX... Developers aren't "scared of UNIX". They are scared of things they don't know, and "don't know" in this context means Google search page doesn't explode with results when they search for the thing. Anecdotally, people in storage business are much more familiar with FreeBSD due to FreeNAS and ZFS in general, but as some of my colleagues who previously worked for Dell EMC "storage division"^* recalled, the second most popular platform they had to adapt their storage solutions for was AIX... (and that trailed far, far behind Linux). It's also funny, in a way, since internally, they often did use FreeBSD in various departments because of FreeNAS. In a similar company, our home directory on dev. server was backed up by FreeNAS (we were also developing a storage product... for Linux). ---- * - There isn't really a "storage division" within Dell EMC afaik, just a bunch of different storage-related projects. I just had to describe those projects in some way.

the8472 4y ago

Is there a way to run podman as non-root but with a privileged helper (or some caps) for proper bridged network setup?

rhatdan 4y ago
No, but you can precreate a network namespace and allow rootless Podman to join the network namespace.
- rhatdan 4y ago
  BTW Podman now supports pasta as well as slirp4netns. I am told pasta gives you better network performance in rootless mode, although I have never tried it.

hnarn 4y ago

This page is unreadable without clicking through a cookie popup that takes up the entire screen. Here's a tip: nobody wants "targeting cookies", and if someone belongs to the 0.01% that do, you can let them enable it manually, instead of using semi-dark patterns to have uneducated users accept all cookies without understanding what that choice means. I understand some pages need advertising revenue to survive, and that targeted advertising brings in a lot more revenue, but Linode is not a blog, it's a cloud provider valued at almost a billion dollars. They don't need to do this.

decide1000 4y ago
On Firefox I use the addon Consent-O-Matic which does the automatic handling of GDPR consent forms.
- JW_00000 4y ago
  I use the same but it didn't work very well on this site. It took a long time, and the background remained semi-transparent black after it finished.
ptman 4y ago
And use plausible/fathom/goatcounter/... instead of something that uses cookies
- nicbou 4y ago
  I use Plausible (it's fantastic), but it misses a lot of the insights I used to get with Google Analytics, including simple navigation flow between pages. This is fine. Insight is overrated. However I'm not optimizing for conversions, while Linode probably has professionals doing that full time. I can't imagine trying to convince my boss to blind the marketing team, especially since the effect is immeasurable by design. I can use Plausible because it doesn't threaten a whole department.
- ElectricalUnion 4y ago
  Relevant legislation (say, GDPR) says nothing specific about cookies, just about using client-side state. Granted, relevant legislation also says privacy should be the default, and that you can't coerce people into accepting loss of privacy. Anyways, that would then need to use a, say, "local storage banner" for most intrusive tracking and we're back to square one.

dathinab 4y ago

> Thus, even limited users executing Docker commands are getting those commands fulfilled by a process with root privileges, a further security concern. I would say: A complete security nightmare which make all kind of "smaller" security issues in other places (e.g. IDE) WAY worse and would put docker on a ban-list if the industry really did care about security. Through then you _can_ setup docker without this vulnerability AFIK it's just not done by default in most setups and I'm not sure how hard it is.

tinus_hn 4y ago
So there’s the answer: industry doesn’t care. Industry is all about ‘just turn off UAC, just run it all as administrator, just click to bypass the unsigned driver dialogs’ as long as it works.
navbaker 4y ago
Docker is already on an informal ban list when it come to US government container deployments in higher classification environments. Most of those situations require Podman based solutions.
- rhatdan 4y ago
  This is also related to the Client Server model supported by Docker versus the Fork/Exec Model supported by Podman. Podman works closely with the HPC (High Performance Computing) world. Checkout the article about how the fastest computers in the world in the most secure facilities in the world are using Podman. https://www.nersc.gov/assets/Uploads/06-Containers-for-HPC-Shifter-and-Podman.pdf https://www.nersc.gov/assets/Uploads/06-Containers-for-HPC-S... https://opensource.com/article/23/1/hpc-containers-scale-using-podman https://opensource.com/article/23/1/hpc-containers-scale-usi...
- mardifoufs 4y ago
  But docker can also run rootless for almost as long as podman has existed. Why would it still be on such a blacklist?

chromatin 4y ago

I wonder if they could make the text smaller and make the contrast even lower? I don't think this passes WCAG accessibility guidelines (although I didn't check the exact size and hex color). Really disappointing that it's too difficult to read, because it looks interesting.

kissgyorgy 4y ago

The most important word is not even on the page: systemd. If you want to run containers as a service with systemd, the only proper way you can do that is with podman, because of the daemonless model. When you use `docker run` command in a systemd unit, that only monitors the docker client exit status and whatnot, the actual process will run in a separate process (started by docker daemon) so systemd can't stop/restart or monitor it at all. Only with podman can you do that.

rollcat 4y ago
That's an important point. While I have my own reservations wrt systemd, you do want a single, coherent supervision scheme that is the source of all truth about the current (and desired) state of the system, with centralised logging, metrics, etc. Docker can't fill the role of that "one true" supervisor, because you still need some host-side services to bootstrap it, like a dhcp/ntp, acpid, sshd, or the Docker daemon itself. In defense of Docker (at least it's my impression for why they do things the way they do), you actually want a higher-level abstraction over running a single, specific container, and it starts making sense as you move into a clustering context. Even if you have a basic 2-node cluster, and want to deploy a couple different workloads to it (like some internal webapps, a memcache, a cron job, etc), neither systemd nor any of its direct alternatives give you the necessary tools to "just throw" the workloads at the cluster as a single logical entity. (Of course clusters start getting more interesting again, once you want to deploy stateful things like databases.)