4 ms·

Podman 5.0 has been released

77 points by shallow-mind 3y ago

bearjaws 3y ago
I am glad we have an alternative to Docker, we tried to switch to it recently but it didn't work out. Hopefully long term it gets easier and easier to switch + performance improves.
- buzzwords 3y ago
  Yeah, I had similar experience. Specially test containers was the issue for me.
- zaphar 3y ago
  What didn't work? I'm curious because it's mostly been a drop in replacement for me.
  - bravetraveler 3y ago
    A lot of people rely on/benefit from the rootful daemon I'm a fan of podman but this "drop in replacement" meme needs to pass. It's only true on the outermost surface
    - zaphar 3y ago
      I'm genuinely curious here. I've literally never run into anything that required the rootful daemon. What exactly are people relying on that requires that?
      - Fire-Dragon-DoL 3y ago
        Expose port 443 (yes, for https). i know there are workarounds, just saying it is not a drop-in. I decided to run an app in docker rootless in my personal server and there are a whole bunch of problems related to that. A lot of images expect to be run as "root all the way down"
      - bravetraveler 3y ago
        Most common/immediate example: mounting volumes to files they normally can't interact with. As a normal, non-root user, that is! One may need to account for permissions and ownerships more when using podman compared to Docker. Being in the 'docker' group allows the daemon to set the stage for you. Many ways to address it. For example, using named volumes instead of mounts. ... but a lot of people use mounts expecting something different than what podman offers, due to permissions/ownerships; it is notable
        zaphar 3y ago
        Wow, that seems like using Docker wrong. But I guess if you got used to abusing it like that then not being able to do so is gonna hurt a bit.
        bravetraveler 3y ago
        Eh, it's an alright use for Docker. I get not using named volumes - easy to forget they exist. It's tough for me to point 'blame' any which way, both models are fine enough. UID/GID stuff can get messy fast, I prefer podman/'seeing the warts'
- jbverschoor 3y ago
  OrbStack :)
- dimgl 3y ago
  Been using Orbstack and it's been flawless.
  - smcleod 3y ago
    Orbstack is nice to use, but closed source which is a real shame.
- itsautomatisch 3y ago
  I'm curious what issues you have with it, as it should be pretty much a 1:1 replacement when you use the Docker compatibility for most people. Rancher Desktop is also a pretty good replacement as well there are things that aren't quite working in Podman.
  - rgovostes 3y ago
    I've been using it in lieu Docker Desktop for Mac for the past year and it mostly works, but I do hit issues and have to debug them. - Several issues with non-native containers which are commonly encountered on Apple Silicon Macs: multi-platform containers start much slower, sudo commands in non-native containers don't work, the TARGETARCH variable was set wrong (fixed), the Docker API implementation didn't pay attention to the specified platform (fixed). - The daemon that creates docker.sock so you can use the Docker CLI doesn't clean up after itself if you uninstall, and this breaks Docker Desktop if you want to switch back (say, to investigate one of these incompatibilities). - Host directories you want to mount into containers need to be configured when the machine VM is created. - The machine VM defaults to using an unstable image, which completely broke in September 2023 for a few days. https://github.com/search?q=org%3Acontainers%20is%3Aissue%20author%3Argov&type=issues https://github.com/search?q=org%3Acontainers%20is%3Aissue%20...
    - acdha 3y ago
      > sudo commands in non-native containers don't work I haven’t seen that - do you know which flavor Linux that affected?
      - rgovostes 3y ago
        It has to do with the binfmt_misc configuration on the podman machine VM, which is used on non-Linux hosts like macOS. I've proposed that they update the machine VM configuration to fix the inconsistency with Docker Desktop but the conversation petered out. Solution: https://stackoverflow.com/a/77354286/145504 https://stackoverflow.com/a/77354286/145504 Discussion: https://github.com/containers/podman/discussions/20445 https://github.com/containers/podman/discussions/20445
deleted 3y ago
[deleted]
Hypnosis6173 3y ago
Alway had problems with the podman vm on macos, hopefully it will be more stable now
abbbi 3y ago
is the podman machine still limited to fedora?
- throwaway74354 3y ago
  Is's not. podman machine init with --image parameter lets you use a non-default distribution. This option was previously available as --image-path. Target should be trivial for macOS (or Linux if you use podman machine there for some reason), WSL2 has to have a compatible patched image.
stryan 3y ago
Netavark stack should be a welcome change; finally no more fiddling around with cni-dnsame and shared networks to get inter-container DNS working. I think technically .pod quadlet files came out in 4.9 but I'm still excited for them. Quadlet works great as a docker-compose replacement at the administration level but for use-cases like setting up a quick dev environment it's still lacking a little. Hopefully being able to easily set up a user-level systemd-unit pod should make it easier.
timost 3y ago
I'm curious about the switch from boltdb to SQLite. How should one handle migrating existing podman environments ?
mathfailure 3y ago
It will never be production ready outside their IBM OS, as they don't even support LTS Debian.
- throwaway74354 3y ago
  I second that. It's a definite flaw in marketing and mid-term planning. curl | sh is a bad practice, but lack of "curl https://get.docker.com https://get.docker.com | sh" scenario is certainly bad for Podman adoption. For some reason Docker Desktop users on macOS and Windows are prioritized over non-rpm Linux users. (OTOH, there are some technical blockers as well, such as AppArmor support. Podman development team is obviously more accustomed with SELinux and expect some external contributions in that field)
  - acdha 3y ago
    Why do you think Linux users aren’t prioritized? This supports every Linux distribution I’ve ever needed to use an a few others besides: https://podman.io/docs/installation https://podman.io/docs/installation
    - throwaway74354 3y ago
      Official guide regarding Ubuntu or Debian will get you podman 3.4.4 in case if Ubuntu 22.04 or 4.3.1 in case of Debian 12. The project is in active development with lots of re-architecturing, deprecations and security fixes. There has to be a way to obtain relatively updated binary packages while not being tied to distribution update cadence. There's still https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/unstable/ https://download.opensuse.org/repositories/devel:/kubic:/lib... , but it's not what one could consider production ready. Example of why: https://github.com/containers/podman/issues/5102#issuecomment-737600718 https://github.com/containers/podman/issues/5102#issuecommen...
      - acdha 3y ago
        Oh, that’s not a Podman issue - the Debian world is like RHEL I’m being conservative about major version upgrades. They’re still shipping Python 3.10 and 3.11, too, despite 3.12 having been released and 3.13 waiting in the wings. The build from source instructions work and you can easily maintain your own back ports / PPAs for things like that as the standard mechanism for major upgrades which the core distribution doesn’t want to commit to supporting. Usually you can simply take the updated package definition from the unstable repository and build that, and a quick search suggests many people are doing just that.

77 points by shallow-mind 3y ago

I am glad we have an alternative to Docker, we tried to switch to it recently but it didn't work out. Hopefully long term it gets easier and easier to switch + performance improves.

buzzwords 3y ago
Yeah, I had similar experience. Specially test containers was the issue for me.
zaphar 3y ago
What didn't work? I'm curious because it's mostly been a drop in replacement for me.
- bravetraveler 3y ago
  A lot of people rely on/benefit from the rootful daemon I'm a fan of podman but this "drop in replacement" meme needs to pass. It's only true on the outermost surface
  - zaphar 3y ago
    I'm genuinely curious here. I've literally never run into anything that required the rootful daemon. What exactly are people relying on that requires that?
    - Fire-Dragon-DoL 3y ago
      Expose port 443 (yes, for https). i know there are workarounds, just saying it is not a drop-in. I decided to run an app in docker rootless in my personal server and there are a whole bunch of problems related to that. A lot of images expect to be run as "root all the way down"
    - bravetraveler 3y ago
      Most common/immediate example: mounting volumes to files they normally can't interact with. As a normal, non-root user, that is! One may need to account for permissions and ownerships more when using podman compared to Docker. Being in the 'docker' group allows the daemon to set the stage for you. Many ways to address it. For example, using named volumes instead of mounts. ... but a lot of people use mounts expecting something different than what podman offers, due to permissions/ownerships; it is notable
      - zaphar 3y ago
        Wow, that seems like using Docker wrong. But I guess if you got used to abusing it like that then not being able to do so is gonna hurt a bit.
        bravetraveler 3y ago
        Eh, it's an alright use for Docker. I get not using named volumes - easy to forget they exist. It's tough for me to point 'blame' any which way, both models are fine enough. UID/GID stuff can get messy fast, I prefer podman/'seeing the warts'
jbverschoor 3y ago
OrbStack :)
dimgl 3y ago
Been using Orbstack and it's been flawless.
- smcleod 3y ago
  Orbstack is nice to use, but closed source which is a real shame.
itsautomatisch 3y ago
I'm curious what issues you have with it, as it should be pretty much a 1:1 replacement when you use the Docker compatibility for most people. Rancher Desktop is also a pretty good replacement as well there are things that aren't quite working in Podman.
- rgovostes 3y ago
  I've been using it in lieu Docker Desktop for Mac for the past year and it mostly works, but I do hit issues and have to debug them. - Several issues with non-native containers which are commonly encountered on Apple Silicon Macs: multi-platform containers start much slower, sudo commands in non-native containers don't work, the TARGETARCH variable was set wrong (fixed), the Docker API implementation didn't pay attention to the specified platform (fixed). - The daemon that creates docker.sock so you can use the Docker CLI doesn't clean up after itself if you uninstall, and this breaks Docker Desktop if you want to switch back (say, to investigate one of these incompatibilities). - Host directories you want to mount into containers need to be configured when the machine VM is created. - The machine VM defaults to using an unstable image, which completely broke in September 2023 for a few days. https://github.com/search?q=org%3Acontainers%20is%3Aissue%20author%3Argov&type=issues https://github.com/search?q=org%3Acontainers%20is%3Aissue%20...
  - acdha 3y ago
    > sudo commands in non-native containers don't work I haven’t seen that - do you know which flavor Linux that affected?
    - rgovostes 3y ago
      It has to do with the binfmt_misc configuration on the podman machine VM, which is used on non-Linux hosts like macOS. I've proposed that they update the machine VM configuration to fix the inconsistency with Docker Desktop but the conversation petered out. Solution: https://stackoverflow.com/a/77354286/145504 https://stackoverflow.com/a/77354286/145504 Discussion: https://github.com/containers/podman/discussions/20445 https://github.com/containers/podman/discussions/20445

deleted 3y ago

[deleted]

Hypnosis6173 3y ago

Alway had problems with the podman vm on macos, hopefully it will be more stable now

abbbi 3y ago

is the podman machine still limited to fedora?

throwaway74354 3y ago
Is's not. podman machine init with --image parameter lets you use a non-default distribution. This option was previously available as --image-path. Target should be trivial for macOS (or Linux if you use podman machine there for some reason), WSL2 has to have a compatible patched image.

stryan 3y ago

Netavark stack should be a welcome change; finally no more fiddling around with cni-dnsame and shared networks to get inter-container DNS working. I think technically .pod quadlet files came out in 4.9 but I'm still excited for them. Quadlet works great as a docker-compose replacement at the administration level but for use-cases like setting up a quick dev environment it's still lacking a little. Hopefully being able to easily set up a user-level systemd-unit pod should make it easier.

timost 3y ago

I'm curious about the switch from boltdb to SQLite. How should one handle migrating existing podman environments ?

mathfailure 3y ago

It will never be production ready outside their IBM OS, as they don't even support LTS Debian.

throwaway74354 3y ago
I second that. It's a definite flaw in marketing and mid-term planning. curl | sh is a bad practice, but lack of "curl https://get.docker.com https://get.docker.com | sh" scenario is certainly bad for Podman adoption. For some reason Docker Desktop users on macOS and Windows are prioritized over non-rpm Linux users. (OTOH, there are some technical blockers as well, such as AppArmor support. Podman development team is obviously more accustomed with SELinux and expect some external contributions in that field)
- acdha 3y ago
  Why do you think Linux users aren’t prioritized? This supports every Linux distribution I’ve ever needed to use an a few others besides: https://podman.io/docs/installation https://podman.io/docs/installation
  - throwaway74354 3y ago
    Official guide regarding Ubuntu or Debian will get you podman 3.4.4 in case if Ubuntu 22.04 or 4.3.1 in case of Debian 12. The project is in active development with lots of re-architecturing, deprecations and security fixes. There has to be a way to obtain relatively updated binary packages while not being tied to distribution update cadence. There's still https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/unstable/ https://download.opensuse.org/repositories/devel:/kubic:/lib... , but it's not what one could consider production ready. Example of why: https://github.com/containers/podman/issues/5102#issuecomment-737600718 https://github.com/containers/podman/issues/5102#issuecommen...
    - acdha 3y ago
      Oh, that’s not a Podman issue - the Debian world is like RHEL I’m being conservative about major version upgrades. They’re still shipping Python 3.10 and 3.11, too, despite 3.12 having been released and 3.13 waiting in the wings. The build from source instructions work and you can easily maintain your own back ports / PPAs for things like that as the standard mechanism for major upgrades which the core distribution doesn’t want to commit to supporting. Usually you can simply take the updated package definition from the unstable repository and build that, and a quick search suggests many people are doing just that.