5 ms·

There is a third option: enable the Docker socket and use Docker Compose as usual. https://github.com/containers/podman/blob/main/docs/tutorials/socket_activat

• mschuster91 2y ago
  Docker Compose would not prevent you from doing a "publish port to 0.0.0.0/0", it's not much more than a (very convenient) wrapper around "docker build" and "docker run". And many if not as good as all examples of docker-compose descriptor files don't care about that. Images that use different networks for exposed services and backend services (db, redis, ...) are the rare exception.
  • Cyph0n 2y ago
    Are you sure about that? Because I was under the impression that these firewall rules are configured by Docker. So if you use Docker Compose with Podman emulating the Docker socket, this shouldn’t happen. Maybe someone more knowledgeable can comment.
    • smarx007 2y ago
      I think you are both correct, see https://news.ycombinator.com/item?id=42602429 https://news.ycombinator.com/item?id=42602429 - the socket would still listen on 0.0.0.0 but podman would not punch holes.
      • Cyph0n 2y ago
        Aha, thanks for confirming! Yes, this was the behavior I was talking about. I encountered it with Docker on NixOS and found it confusing. They have since documented this behavior: https://search.nixos.org/options?channel=24.11&show=virtualisation.oci-containers.containers.%3Cname%3E.ports&from=0&size=50&sort=relevance&type=packages&query=virtualisation.oci-containers.containers.%3Cname%3E.ports https://search.nixos.org/options?channel=24.11&show=virtuali...