4 ms·

What is the killer feature that will make me want to switch from Docker Compose to Podman Quadlets?

dharmab 2y ago
I prefer quadlet for 2 reasons: 1. Podman is simpler than Docker. There is no long-running daemon. Rootless is default. 2. Quadlets can be managed as systemd services, giving me the same tools to manage and view logs for system daemons and containers. Quadlets have been especially nice for bundling up an AI app I wrote as a cloud-init file, making it easy to deploy the hardware, software and models as one artifact.
- pydry 2y ago
  quadlets == systemd which requires root to run. this is NOT the same thing as "systemd cant run non root containers". OBVIOUSLY it can, just as docker can run non root containers. Making systemd a necessary dependency to run > 1 container kinda negates many of the the nice advantages that podman has of not requiring root. podman compose doesnt require root and would serve as a substitute but it's a very neglected piece of software.
  - zacwest 2y ago
    You can do non-root systemd units, including Quadlets. See <https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html https://docs.podman.io/en/latest/markdown/podman-systemd.uni...> under "Podman rootless unit search path."
    - pydry 2y ago
      you can run docker containers without them requiring root too. systemd itself is a root service. it shouldnt be a necessary dependency to run > 1 containers without root. somehow it is.
    - znhll 2y ago
      I recently started making the switch from docker (and docker compose) to using podman and quadlet, but holy crap is the documentation for podman quadlets a big f-you wall-of-text mandoc that would make Torvalds proud. I've read thru that and am still not quite sure of how to get from point A to point B. To replace a single docker compose file, sounds like one needs to manually create a number of .container, .volume, .network, .kube files correctly so systemd can spin up a container pod? Is that what I'm reading? Is there nothing that can generate that from a docker-compose.yml?
      - zacwest 2y ago
        I've used Podlet <https://github.com/containers/podlet https://github.com/containers/podlet> somewhat successfully for this.
      - worewood 2y ago
        I agree. That documentation really needs some love. But if you see the discussions on github issues about quadlet features a common theme is maintainers dismissing requests because "that shouldn't be done in production" or "that won't scale". It seems they can't wrap their head around people wanting to do simple things or someone doing things by themselves at home and not for work at a big company or corporation, and that reflects on that documentation. Working for one myself, which does have a support contract wit Red Hat, I kinda get where they're coming from--if they make it easy to shoot yourself in the foot, dumb people shoot themselves in the foot in production and they have to fix the mess later. But for that they could have a sanctioned build for clients and a community build for everybody else, just like they have Fedora and RHEL.
  - voxadam 2y ago
    systemd user units can be run by non-root users. https://wiki.archlinux.org/title/Systemd/User https://wiki.archlinux.org/title/Systemd/User
    - pydry 2y ago
      not the point as i mentioned above. systemd itself requires root.
      - voxadam 2y ago
        Installing packages (like podman or moby/docker) using dnf and apt requires root as well, so I'm not sure what your point is.
        pydry 2y ago
        making systemd - a root service - a necessary dependency in order to orchestrate > 1 nonroot containers is both unnecessary and bad architecture. It was a shitty decision that renders it just "a less popular docker" and not "a better docker".
        linuxandrew 2y ago
        Podman doesn't have a dependency on systemd. e.g. it is packaged in Void Linux. Podman has a better architecture than Docker in that it can easily run on a non-privileged user. Quadlet (aka podman-systemd.unit) is a podman-systemd integration which can make it easy to launch and orchestrate podman containers via systemd. You can get all if the systemd dependency handling, require other units to run after a container finishes, and all sorts of other useful things. Systemd "user" units (systemctl --user) also works here with the containers running as a non-privileged user in a non-root systemd context. Just to be clear, Quadlet is just an integration and you can still run podman without it. You can still run podman on non-systemd systems as well.
        dharmab 2y ago
  - exceptione 2y ago
    systemctl --user ...
    - guilhas 2y ago
      That still depends on systemd, the most privileged deamon in many distros But it is fun to see the marketing 360
      - exceptione 2y ago
        Cool, so no PID Eins. I have no shares in systemd, so fine. What do you propose?
- steeleduncan 2y ago
  Podman seems to have lower memory overhead than Docker. I assume that is a consequence of your point 1
eriksjolund 2y ago
Podman quadlet supports "Socket activation of containers" https://github.com/containers/podman/blob/main/docs/tutorials/socket_activation.md#socket-activation-of-containers https://github.com/containers/podman/blob/main/docs/tutorial... This allows you to run a network server with `Network=none` (--network=none). If the server would be compromised, the intruder would not have the privileges to use the compromised server as a spam bot. There are other advantages, such as support for preserved source IP address and better performance when running a container with rootless Podman + Pasta in a custom network.
- infogulch 2y ago
  That's neat. Does it require 1 connection = 1 process to work? I don't see how you can have a long running server with this feature.
  - deleted 2y ago
    [deleted]
  - xyzzy_plugh 2y ago
    No, the init process hands over the listener FD allowing the server to accept() connections. You can also do 1 connection = 1 process, though, but it's absolutely not required nor particular common these days.
- anonfordays 2y ago
  What's old is new again. That's effectively how inetd worked circa 1986. The inetd daemon had some serious security vulnerabilities so the world move away from using "socket activated daemons" to having always listening services (performance reasons as well).
  - thwarted 2y ago
    inetd supported "socket activation" using the "wait" directive, where inetd would listen on the socket and then hand off the listening socket when there was activity as fd 0 where the server would need to call accept, and could continue to call accept for new connections, or exit when all clients were handled, and inetd would respawn when there was new pending connection on the listening socket.
philips 2y ago
I really like the user namespace handling `--user-ns=keep-id`. It makes it easy for me to create a new Linux user and then have that user run some container and have bind mounts, etc just work correctly. It is the least fuss way I have found of running little services that need access to the host filesystem. https://docs.podman.io/en/latest/markdown/podman-run.1.html#userns-mode https://docs.podman.io/en/latest/markdown/podman-run.1.html#...
tiew9Vii 2y ago
For local development I found no advantages, if anything I found it a little less convenient. For servers where you don’t need the complexities of Kubernetes etc, using Quadlets is nice as you can manage containers as regular systemd services and no Docker daemon running as root.
scheme271 2y ago
The biggest one is probably that podman runs as a user and doesn't need suid normally. So you can run services and have more assurances that container breaches won't give someone root on your system.
jabl 2y ago
For a docker-compose replacement you should probably look at the 'podman kube' support. That supports a subset of the kubernetes API that roughly matches the docker-compose features. Then for deployment to a Kubernetes cluster you can reuse your podman kube yaml. For deployment to a single machine where the full Kubernetes is overkill, you can use the podman quadlet support. Quadlets support a "[Kube]" section where you can point to the yaml file, so you don't have to write all your port and volume etc mappings again in a slightly different syntax.
discardable_dan 2y ago
And why are they called quadlets?

I prefer quadlet for 2 reasons: 1. Podman is simpler than Docker. There is no long-running daemon. Rootless is default. 2. Quadlets can be managed as systemd services, giving me the same tools to manage and view logs for system daemons and containers. Quadlets have been especially nice for bundling up an AI app I wrote as a cloud-init file, making it easy to deploy the hardware, software and models as one artifact.

pydry 2y ago
quadlets == systemd which requires root to run. this is NOT the same thing as "systemd cant run non root containers". OBVIOUSLY it can, just as docker can run non root containers. Making systemd a necessary dependency to run > 1 container kinda negates many of the the nice advantages that podman has of not requiring root. podman compose doesnt require root and would serve as a substitute but it's a very neglected piece of software.
- zacwest 2y ago
  You can do non-root systemd units, including Quadlets. See <https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html https://docs.podman.io/en/latest/markdown/podman-systemd.uni...> under "Podman rootless unit search path."
  - pydry 2y ago
    you can run docker containers without them requiring root too. systemd itself is a root service. it shouldnt be a necessary dependency to run > 1 containers without root. somehow it is.
  - znhll 2y ago
    I recently started making the switch from docker (and docker compose) to using podman and quadlet, but holy crap is the documentation for podman quadlets a big f-you wall-of-text mandoc that would make Torvalds proud. I've read thru that and am still not quite sure of how to get from point A to point B. To replace a single docker compose file, sounds like one needs to manually create a number of .container, .volume, .network, .kube files correctly so systemd can spin up a container pod? Is that what I'm reading? Is there nothing that can generate that from a docker-compose.yml?
    - zacwest 2y ago
      I've used Podlet <https://github.com/containers/podlet https://github.com/containers/podlet> somewhat successfully for this.
    - worewood 2y ago
      I agree. That documentation really needs some love. But if you see the discussions on github issues about quadlet features a common theme is maintainers dismissing requests because "that shouldn't be done in production" or "that won't scale". It seems they can't wrap their head around people wanting to do simple things or someone doing things by themselves at home and not for work at a big company or corporation, and that reflects on that documentation. Working for one myself, which does have a support contract wit Red Hat, I kinda get where they're coming from--if they make it easy to shoot yourself in the foot, dumb people shoot themselves in the foot in production and they have to fix the mess later. But for that they could have a sanctioned build for clients and a community build for everybody else, just like they have Fedora and RHEL.
- voxadam 2y ago
  systemd user units can be run by non-root users. https://wiki.archlinux.org/title/Systemd/User https://wiki.archlinux.org/title/Systemd/User
  - pydry 2y ago
    not the point as i mentioned above. systemd itself requires root.
    - voxadam 2y ago
      Installing packages (like podman or moby/docker) using dnf and apt requires root as well, so I'm not sure what your point is.
      - pydry 2y ago
        making systemd - a root service - a necessary dependency in order to orchestrate > 1 nonroot containers is both unnecessary and bad architecture. It was a shitty decision that renders it just "a less popular docker" and not "a better docker".
        linuxandrew 2y ago
        Podman doesn't have a dependency on systemd. e.g. it is packaged in Void Linux. Podman has a better architecture than Docker in that it can easily run on a non-privileged user. Quadlet (aka podman-systemd.unit) is a podman-systemd integration which can make it easy to launch and orchestrate podman containers via systemd. You can get all if the systemd dependency handling, require other units to run after a container finishes, and all sorts of other useful things. Systemd "user" units (systemctl --user) also works here with the containers running as a non-privileged user in a non-root systemd context. Just to be clear, Quadlet is just an integration and you can still run podman without it. You can still run podman on non-systemd systems as well.
        dharmab 2y ago
- exceptione 2y ago
  systemctl --user ...
  - guilhas 2y ago
    That still depends on systemd, the most privileged deamon in many distros But it is fun to see the marketing 360
    - exceptione 2y ago
      Cool, so no PID Eins. I have no shares in systemd, so fine. What do you propose?
steeleduncan 2y ago
Podman seems to have lower memory overhead than Docker. I assume that is a consequence of your point 1

eriksjolund 2y ago

Podman quadlet supports "Socket activation of containers" https://github.com/containers/podman/blob/main/docs/tutorials/socket_activation.md#socket-activation-of-containers https://github.com/containers/podman/blob/main/docs/tutorial... This allows you to run a network server with `Network=none` (--network=none). If the server would be compromised, the intruder would not have the privileges to use the compromised server as a spam bot. There are other advantages, such as support for preserved source IP address and better performance when running a container with rootless Podman + Pasta in a custom network.

infogulch 2y ago
That's neat. Does it require 1 connection = 1 process to work? I don't see how you can have a long running server with this feature.
- deleted 2y ago
  [deleted]
- xyzzy_plugh 2y ago
  No, the init process hands over the listener FD allowing the server to accept() connections. You can also do 1 connection = 1 process, though, but it's absolutely not required nor particular common these days.
anonfordays 2y ago
What's old is new again. That's effectively how inetd worked circa 1986. The inetd daemon had some serious security vulnerabilities so the world move away from using "socket activated daemons" to having always listening services (performance reasons as well).
- thwarted 2y ago
  inetd supported "socket activation" using the "wait" directive, where inetd would listen on the socket and then hand off the listening socket when there was activity as fd 0 where the server would need to call accept, and could continue to call accept for new connections, or exit when all clients were handled, and inetd would respawn when there was new pending connection on the listening socket.

philips 2y ago

I really like the user namespace handling `--user-ns=keep-id`. It makes it easy for me to create a new Linux user and then have that user run some container and have bind mounts, etc just work correctly. It is the least fuss way I have found of running little services that need access to the host filesystem. https://docs.podman.io/en/latest/markdown/podman-run.1.html#userns-mode https://docs.podman.io/en/latest/markdown/podman-run.1.html#...

tiew9Vii 2y ago

For local development I found no advantages, if anything I found it a little less convenient. For servers where you don’t need the complexities of Kubernetes etc, using Quadlets is nice as you can manage containers as regular systemd services and no Docker daemon running as root.

scheme271 2y ago

The biggest one is probably that podman runs as a user and doesn't need suid normally. So you can run services and have more assurances that container breaches won't give someone root on your system.

jabl 2y ago

For a docker-compose replacement you should probably look at the 'podman kube' support. That supports a subset of the kubernetes API that roughly matches the docker-compose features. Then for deployment to a Kubernetes cluster you can reuse your podman kube yaml. For deployment to a single machine where the full Kubernetes is overkill, you can use the podman quadlet support. Quadlets support a "[Kube]" section where you can point to the yaml file, so you don't have to write all your port and volume etc mappings again in a slightly different syntax.

discardable_dan 2y ago

And why are they called quadlets?