EDIT: For some context, I recently gave podman another go. I have a few services on my homelab server set up in docker containers, so I tried migrating to podman.
After the second major bug (open issue on github) I encountered looked like it would require completely dropping using compose files to work around, I gave up and went back to docker.
I like the idea of podman, but it’s just not stable. I’ll try again in a year or so.
As a bonus, docker’s CLI is significantly nicer.
Podman is much better than docker though in pretty much every way
y’all use containers still? I run my site with native installed software configured by hand like a TRUE sysadmin!
You’re that chain smoking black hat with a stack of computers, black out curtains several screens and not a single lightbulb.
Podman is unironically the better choice. Just try to make docker comply with your firewall…
Podman is unironically the better choice.
I like the idea of podman, but it’s just not stable. This meme was inspired by my frustration of trying to switch.
Just try to make docker comply with your firewall.
I literally did this yesterday and it wasn’t that hard. You just add
iptables:Falseto the docker config file.Cult
Docker bypasses your firewall and runs as root. Only an idiot would allow that shit… I’m an idiot. But I’m fixing that.
It doesn’t “bypass your firewall”… it lets you shoot yourself in the foot. You’re asking it to open ports without specifying an explicit network interface so it opens them on all interfaces. Which includes opening up the firewall, because what’s the point of putting up a service and blocking it in the firewall.
Also, doing it by hand would be incredibly tedious. Docker automatically adjusts the rules to match the ports and interfaces to its private container netmasks, and brings them up or down as needed when the containers start/stop.
All you have to do is bind ports to localhost or to a private interface if you don’t want the service to be publicly exposed.
Beginners get bitten by this because they say
ports: 9999:9999instead ofports: 127.0.0.1:9999:9999/tcplike they should. Unfortunately most examples out there use the terse version and never explain why it’s bad.
Is that a dugtrio?
Alternate universe with Digong and Seetrio.
Ngl after trying out Rootless Podman on my system (I was playing with Distrobox) I kinda wanna switch my whole Homelab to it, I’m just lazy, afraid the move to rootless with blow up everything and have zero fucking free time.
I am running my entire homelab from podman quadlets (systemd managed podman containers) and it’s honestly very dope. Podman gets a bad rap for being second tier to docker but they legit have a bunch of awesome features for Linux users specifically that make it way nicer. Using systemd for docker status can add some misdirection occasionally, but having the logs from containers directly in journalctl alongside the rest of my system logs is amazing
i plan to set up my stuff like that as well, just don’t find time :/
i genuinely run all my shit bare metal
🤘
Container manager in Synology. Why?
docker/podman sucks, u can’t avoid using journald for logging. U also can’t avoid using overlayfs. Plain LXC is what I have at home
All my homies use nerdctl anyway.
Switching colleagues over to Pdman desktop, whenever legal asks about licenses for DD. :)
Podman has some thngs rhat I don’t like but it ften works much better, and a lot f really great tools use it natively (like distrobox)
Is your keyboard ok?
This is why I don’t like Docker compared to Podman:
I may be dumb but I apply the firewall at the router level (OPNsense). That should be fine, right?
Security should be layered. Ideally both network & server-based firewalls should be enabled.
I literally yesterday dealt with that. There’s an option to just turn off Docker’s firewall manipulation so you can do it manually.
I had the same issue, but I just added my plain iptables rules to the DOCKER-USER table, which worked fine
Please elaborate…
Basically put:
{ iptables: False, Ip6tables: False }In /etc/docker/daemon.json
I just use the native docker apps that truenas has preconfigured. The one time I needed a custom compose container I just bashed my face against the keyboard until it worked. This is how I feel about all containerization. There really should be an easier system. Nothing wrong with higher accessibility.
This meme taught me a lot with all these comments. Thank you
I’m curious why you feel this way? I’m kinda the opposite — podman has features I use that Docker doesn’t.
Not the poster, but I kinda get this sentiment. For my laptop and things that I do for work, I prefer Podman. Better security posture out of the box, and I’m typically crafting my own pods to work a specific way.
But, if I am just trying to start up some app/service and I’m following the GitHub documentation with the project…I want to just copy and paste and there isn’t a 1-for-1 for
docker compose. Podman does have an alias package so you can saydockeron the cli, but the “compose” part of it is not as good if I just want something to run without dicking with it.So in short, if I’m making something with a container or want to have hands on control, I prefer Podman. If I’m running something “off the shelf”, like just running someone’s docker compose files files from their Github, I’m just running Docker man.
I use the docker compose plugin with podman and it’s the same. My compose stack is massive with tons of services and I migrated it from docker to podman with no issues.
There’s a built in tool to rake docker compose files, and make quqdlets that worked just fine for me?
That’s neat, are you talking about Podlet? Your comment prompted me to search.
Am I the only one who struggles with podman permissions? Every time I try to use it one service or another doesn’t work.
I tried for immich (only service I expose) and failed.
God I hate arguing with podman. Something doesn’t work and I can’t tell if it’s my quadlet or the app
