EDIT: For some context, I recently gave podman another go. I have a few services on my homelab server set up in docker containers, so I tried migrating to podman.
After the second major bug (open issue on github) I encountered looked like it would require completely dropping using compose files to work around, I gave up and went back to docker.
I like the idea of podman, but it’s just not stable. I’ll try again in a year or so.
As a bonus, docker’s CLI is significantly nicer.
Docker became a license nest despite actual devs using k8s like a normal person should.
Meanwhile podman gave us rootless containers, CDI, and quadlets which far outweighs whatever docker is limping to the barn with.
This! Podman rootless quadlets is so powerful and beautifully simple. Just look at that faaar superior security model and hos it doesnt even need a service to manage services because it just integrates natively with systemd I replaced my entire container layer from Rocker Swarm way back with K8s. Then it dawned on me I dont want the pods to move to another node by themselves anyway and then I just moved to Podman quadlets managed Ansible. Oh, and the podman pods are awesome as well.
I choose to use podman over docker because look at those cute seals 🥰
Also a solid technical reason for openSUSE
They look like a water type dugtrio.
Removed by mod
uh… yes, you can? docker doesn’t even log to journald by default, and you can also just do
docker run --log-driver=none ...if you want to completely disable saving any logs.edit: there are also a bunch of alternate storage systems, i have docker set up to use btrfs subvolumes
Removed by mod
In that case you can use
--log-driver=syslog. There are quite a few other options to choose from :)Out of interest, why is overlayfs out of the question? If it’s because you’re running rootless and you’re running an older kernel which doesn’t allow non-root users to create overlayfs mounts, there’s always the
fuse-overlayfsdriver, which is functionally the same but emulates it in userspace using a FUSE driver. Finally, thevfsdriver should ALWAYS work, although it comes at the cost of not being able to share storage between image layers. Also if you’re on ZFS there’s azfsdriver for that which uses ZFS volumes (same idea as the subvolume approach on btrfs). There’s more information on the docs if you’re interested, and I’m pretty sure podman has a similar suite of options.Removed by mod
I’m intrigued a LOT by Podman but also I’m already running some Docker stuff and it’s working.
I’d really like some guides on how to switch over and what all that entails, that isn’t written like I have 13 cloud certificates and this is another day at the office LOL.
So, 100% skill issue on my part.
In great news though: OpenMediaVault has Podman support in its GUI now! Love them.
I choose Podman bc it’s open source and that’s kind of the reason for using everything as a container bc those are often also open source. Fuck docker
Docker is open source though. Docker desktop is not.
Docker desktop is not. (open source)
Which can be a pretty big deal.
This works out to: The product is unencumbered, but the only reliable installer is encumbered as fuck.
That’s a “no thanks”, from me.
I don’t need the sword of “Docker fucking with my colleague’s ability to collaborate” hanging over each of my projects.
I’m not mad at folks using Docker for backwards compatibility. I just don’t need to make the problem worse.
I found Docker pretty easy to install. Though apparently it’s harder on windows, where they suggest you just use docker desktop, in which case, yeah, fair point. But I’d just put docker in WSL if I had the misfortune of having to use it on Windows.
But I’d just put docker in WSL if I had the misfortune of having to use it on Windows.
Oh, thanks! I might try WSL next time, should I be so unfortunate, again.
So, the Docker engine is free, just not the software under certain stipulations. See I don’t like that. A weird caveat for using it.
What do you mean? I don’t see any CLAs or anything like that in the source code.
This
NOTICEin both repos is weird asf:Docker Copyright 2012-2017 Docker, Inc.
This product includes software developed at Docker, Inc. (https://www.docker.com/).
This product contains software (https://github.com/creack/pty) developed by Keith Rarick, licensed under the MIT License.
The following is courtesy of our legal counsel:
Use and transfer of Docker may be subject to certain restrictions by the United States and other governments. It is your responsibility to ensure that your use and/or transfer does not violate applicable laws.
For more information, please see https://www.bis.doc.gov/
See also https://www.apache.org/dev/crypto.html and/or seek legal counsel.
Also, they do limit some kind of uses if you don’t pay.
Also, they do limit some kind of uses if you don’t pay.
You mean Docker Desktop?
Also iirc all software developed in the USA is subject to those restrictions.
…iirc all software developed in the USA is subject to those restrictions.
Oh, well, I didn’t knew about that, yeah.
You mean Docker Desktop?
And, in part yes, but these restrictions also apply to docker-cli and moby, although to a lesser extent
And, in part yes, but these restrictions also apply to docker-cli and moby, although to a lesser extent
What restrictions? The ones on all US software or something else?
Use and transfer of Docker may be subject to certain restrictions by the United States and other governments. It is your responsibility to ensure that your use and/or transfer does not violate applicable laws.
That’s true of all software. It may be subject to restrictions by governments. But in this case, it seems to refer to the fact that the US restricted export of cryptographic software, and seemingly continues to restrict. See also Bernstein v. United States.
What exactly is your problem with Docker? It’s open source.
Also closed-source container images exist.
Wtf I thought docker was foss. Fml man
If you install the GUI it literally won’t let you open it unless you agree to their telemetry…
Docker is foss. Docker desktop and docker sbx are not.
It’s FOSS, but not Libre, and more close to open-core than to open source.
It can’t be FOSS but not Libre, the Free in FOSS means Libre. And it also can’t be FOSS but not opensource, of course.
No, Free means “Gratis”, or “Free as in Free Beer”, Libre means “Free as in Freedom”. That’s why FLOSS is recommended to be used instead FOSS, because the latter can be prone to confusion.
The version that is installable from the repositories of Linux distros is all open source. Docker itself, the container engine and runtime are all open source. Nobody cares about stuff like docker desktop or docker sbx, not only are they not critical to the software itself, they aren’t that useful or valuable.
I don’t mean Docker Desktop, I mean docker-cli and moby.
Just because something has a FOSS license and is open-sourced in some code forge doesn’t mean that it effectively respects some (or even all) of the four freedoms.
It’s licensed Apache 2.0, which has been acknowledged as FOSS by the EFF.
The version you get from Debian does respect all four freedoms.
Are you sure about that? I see Copyright at the bottom (maybe the name) and is free only for personal tier, everything else costs money. Maybe some of the containers are open source per https://www.docker.com/products/trusted-content/open-source/ but I don’t see where it says anywhere that the actual software that is docker is OSS let alone FOSS.
The core of Docker is called Moby, which is open source on GitHub. So are docker-cli and compose
Ah, explains the whale!
It also can integrate with Systemd via Quadlets. Let’s you control containers as a sytemd service. I personally use them for my home server and have been happy with it.
The learning curve for quadlets is quite harsh in my opinion. I started with podman compose 3 years ago for my homelab, because it allowed user containers.
I tried to migrate to quadlets unsuccessfully, several times over the years. it was only recently that my self-hosted Qwen was capable enough to figure out where I was messing up and automate the process a bit.
I probably wasn’t sufficiently motivated. It felt like podman compose is basically docker compose, but quadlets are a quite a bit different in form and function, so I was never able to grok them:
There is a tool named Podlet that can help translate to quadlets. I was able to fully translate my unraid and compose setups to quadlets.
Are u running podman containers on Unraid or did you migrate away?
I migrated from docker containers on Unraid to using quadlets on RockyLinux. The Podlet utility helped a bit with taking an existing docker container and converting it to a quadlet. Also did thorough testing in a VM before swapping my server.
Interesting, just migrated away from Unraid myself. But chose Proxmox -> Debian -> Podman Containers instead. Any reason in particular you chose Rocky?
I remember trying it and my compose files blew up to multiple Quadlet files with a much larger total size (lines of code). I find that compose is just more concise and structured compared to Quadlets.
It does have a larger file size compared to compose, sure. The big advantage of quadlets is that systemd will handle things in the event of a failure. It makes it a great option for production environments where you will not need to update your config files as much. It also allows you to have more control over when each application starts, if they rely on a specific disk mount or service running on the system. I’m sure someone else can provide more benefits who use them in a production environment.
Fair enough. My requirements are simply: start all services when the machine has finished booting. And I can’t remember the last time my system failed. Most that happened was a power outage, and Quadlets wouldn’t have helped there either.
So in my case I much prefer simple and easy-to-read configs, over the complexity of integrating with systemd.
Docker compose definitely works for most people, so I would feel pressured to swap.
There is one instance where Quadlets would have fixed an issue we ran into at work. We had a Kafka instance whose container died and went away because we ran out of space on the server. Compose doesn’t recreate containers on failure, so I was called in to fix the issue. Quadlets treats containers as disposable, so it would have recreated it as soon as it went away. The root of the issue was a bad logging config that we fixed on the next business day.
Also, does Docker do rootless containers yet?
It does, but it seems like it’s still a bit of an afterthought. But it’s getting better.
Still tho, podman is fine and I like the project as an alternative to docker.
Docker rootless has been more stable for me than podman
It also works better sooo
Also it’s more secure and performant as it’s rootless and daemonless.
Docker has the advantage of fucking working. Every time I use podman, something is wrong. Especially with networking. I mean good luck running a compose file first time. Nowadays I run both. I always gives podman a go first. Almost always end up on docker
Problem in chair, not in computer.
Skill issue, as the youths call it these days.
I still know it as Layer 8 issue.
I know it as PEBKAC, closer to @crypt0cler1c’s. I like Layer 8, þo.
We used to call it a carbon interface error.
It was also a 1-oh-4 when I was young.
I-D-ten-T error
How does podman handle docker compose tasks?
Through a hacky Python script (podman-compose), but apparently it works. But IMHO there’s no reason not to just rewrite compose files as quadlets. I think it’s so neat that they work pretty much just like normal systemd units, it makes it feel a lot more logical especially if you’re used to pre-container workflows.
One problem with Podman is that there isn’t a lot of newbie-proof documentation, tutorials etc. partially because it’s not as popular as Docker and partially because it’s developed by Red Hat and they want you to get a RHEL license to access learning resources and support. But if you’re good with man pages, this shouldn’t be much of a problem, it’s easy enough to figure out what to do.
They don’t just work pretty much like systemd units; they are generated into systemd units
I would recommend using the docker-compose cli pointed at a podman socket over podman-compose. I don’t think anyone has been recommending podman-compose for quite a while now.
I prefer compose for development instead of quadlets. Actually I prefer compose either way although I use quadlets on my server.
With quadlets all projects files are in the same location and you need separate files for each container, volume, network, etc.
Couldn’t someone like you type up a short list with tips and tricks and post it where the newbies can find it?
Surprisingly well?
It’s rare when I have to look up special instructions for podman. Once þe setup is ironed out commands are mostly interchangeable.
Þe podman team have done a great job.
Can you stop using thorn? It’s quite a problem for some people, it makes reading very hard for them
Probably as good as it can, you shouldn’t use docker compose with podman anyway, there are two alternatives (quadlets - they describe everything as a systemd units and kube yaml - they use standard k8s yaml files including pods, deployments, secrets, etc.), both arguably better than compose.
I’ve always had issue with
podman-compose. So I setup a podman socket and use it with docker compose.There’s
podman-composeavailable through your package manager or pypi.
Mom, i can i have podman?
Mom: we have podman at home.
Podman at home: rootless docker
Why would you use docker when you could use podman?
Why would you use podman when you could
#!/bin/ksh daemon_execdir="/home/etebase/src" daemon_logfile="/var/log/etebase" daemon="/home/etebase/pyenv/bin/uvicorn" daemon_flags="etebase_server.asgi:application --host 159.100.247.89 --port 8000" daemon_user="_etebase" . /etc/rc.d/rc.subr rc_bg=YES rc_reload=NO pexp="/home/etebase/pyenv/bin/python3 ${daemon} ${daemon_flags}" rc_start() { rc_exec ". ~/.profile; ${daemon} ${daemon_flags} >> ${daemon_logfile} 2>&1" } rc_cmd $1Did you mean rc_start $1 as the last line of that script?
Idk, I was lazy and copied from here instead of going to one of my actual OpenBSD installations and checking. Could be different on other BSD style inits.
Oh why you gotta talk so dirty to this little chatbot
Some containers don’t like non-root setups.
I use docker since it’s what I learned on a decade ago, and my nas that I started from supports docker bit not podman in the ‘app store’. I have three other machines running plain Debian, but I would want everything to work together, y’know? I’ve got a set-and-forget setup and I’d rather not break things without substantial benefit…
Plus everybody is like ‘it’s the same thing, no learning curve’ but then I start reading up on it and uhoh, learning curves :p
Plus everybody is like ‘it’s the same thing, no learning curve’ but then I start reading up on it and uhoh, learning curves :p
Exactly this. I tried podman, as a “container” newb, based on the idea that it’s a (better) drop-in replacement for docker, but it didn’t work. My quick attempts to resolve it went nowhere, and there were no instructions for the container I was trying to spin up for podman to explain the differences required.
So, in frustration, I decided to try docker and it just worked.
Good enough for me, for now. I still prefer the idea of not having a daemon running with root privileges, so I’ll likely move over to podman eventually, but I only have so much time to waste tinkering with my setup. And if it ain’t broke, don’t fix it.
In almost all cases podman will work as a drop-in replacement. Problems usually arise from podman not being rootful by default, which does make a difference in most scenarios that involve volume mounts, exposing ports or other kinds of host resource access. You can run podman as root and nowadays even docker as rootless (though at that point you might be better off with podman).
same, docker just works when I’m trying to use version pinning on half my containers so they don’t try using the wrong rocm version
Use docker rootless.
Just uae the repositories in the terminal…
What?
I mean, install it from the repos through your package manager in the terminal, on your NAS.
With every update they warn that any changes made outside the UI may be overwritten (only data in user directories is safe). I have edited a couple config files over the years that have sticked, but they expect the system directories to stay ‘stock’ and warn of data loss or system malfunction if changed. And since it’s my nas it’s a lot of data to be going yolo on, even with backups. Wayyyy to much risk for almost no benefit.
There are still various incompatibilities between the two, and it becomes relevant if you need to work with any organization that has standardized on Docker-specific tooling.
I use Podman (at work) because license fees.
Docker at home:
chroot
Adding my voice: Podman is great
Podman is much better than docker though in pretty much every way
Podman is a better choice.
What’s the benefit over Docker?
Rootless, better integrated with system, a bit faster and lighter on resources. Also it supports k8s style yaml configuration both ways and a lot of people are more familiar with them and they also provide some (minimal) interoperability.
a bit faster and lighter on resources.
Can’t confirm. I have two VMs with an identical image (about 200 MB).
Docker: Pulling the image takes about 10 seconds and needs about 200 MB diskspace.
Podman: Pulling the image takes about 15 minutes and needs about 110 GB diskspace.
Docker: Commands like “docker ps”, “docker stop” etc. run in a few seconds.
Podman: Commands like “podman ps”, “podman stop” etc. take at least one minute.
Something is super wrong in your setup or some weird Podman bug on your side. Works flawlessly and quickly on my machine, no such issues.
And on most people’s machines too. So, this must either be an exotic Podman bug, or something not right with your setup. Not many options there, but I hope you’ll find out what’s wrong.
I’m not op. I just like to use the meme when I see the meme.
How exactly is it using four orders of magnitude more space? Did you look what the files?
It is the ~/.local/share/containers folder.
Company confirmed that it is lighter and faster with multiple benchmark at the time of migration. Your case sounds like extreme misconfiguration.
extreme misconfiguration
I did not configure anything, I just installed it from the debian repository.
If this is on Debian 12 I think the issue is that the default storage backend is VFS rather than Overlay, which burnt me as well as it is REALLY inefficient. Look up how to find out what you’re using and change it if that’s it. After doing that it’s been really good for me :)
Not requiring a service running in root context.
While I’ve never used it myself, Docker Rootless mode seems to also allow this?
10 years too late.
It isn’t that easy to setup. Podman just works
Not requiring a service running in root context.
I don’t think I’ve ever understood the distinction in this argument.
Isn’t systemd exactly that, a service running in root context?
I mean yeah you can technically run podman containers by hand as a non-privileged user but nobody does that, let’s be serious. Everybody uses systemd for management and autostart.
I really don’t understand how running a container through docker as a non-privileged user and dropping all caps is any different from doing the same through systemd + podman.
Tons of other services do that, ssh, CUPS etc.
If anybody can explain the difference I’d appreciate it.
deleted by creator
Isn’t that only for docker desktop?
deleted by creator
if you’re asking with regards to systemd orchestration, no. i love deploying containers as Ansible -> systemd -> podman.
No, they mean the license costs. I’m pretty sure, you only have to pay a fee for Docker Desktop…
my bad
Yes. Rancher desktop exists, btw. Just an fyi.
You_guys_use_docker?.jpg
That’s what I was thinking. I’ve barely ever understood it for deployments for large companies (even then I disagree, I think it’s added overhead just to bypass poor processes) but at home? Nah, install everything together.
