EDIT: For some context, I recently gave podman another go. I have a few services on my homelab server set up in docker containers, so I tried migrating to podman.

After the second major bug (open issue on github) I encountered looked like it would require completely dropping using compose files to work around, I gave up and went back to docker.

I like the idea of podman, but it’s just not stable. I’ll try again in a year or so.

As a bonus, docker’s CLI is significantly nicer.

  • mlg@lemmy.worldEnglish
    0·
    10 days ago

    Docker became a license nest despite actual devs using k8s like a normal person should.

    Meanwhile podman gave us rootless containers, CDI, and quadlets which far outweighs whatever docker is limping to the barn with.

    • motogo@feddit.dk
      0·
      10 days ago

      This! Podman rootless quadlets is so powerful and beautifully simple. Just look at that faaar superior security model and hos it doesnt even need a service to manage services because it just integrates natively with systemd I replaced my entire container layer from Rocker Swarm way back with K8s. Then it dawned on me I dont want the pods to move to another node by themselves anyway and then I just moved to Podman quadlets managed Ansible. Oh, and the podman pods are awesome as well.

  • Lian Dynn@lemmy.worldEnglish
    0·
    10 days ago

    Podman is unironically the better choice. Just try to make docker comply with your firewall…

    • WolfLink@sh.itjust.worksOP
      0·
      9 days ago

      Podman is unironically the better choice.

      I like the idea of podman, but it’s just not stable. This meme was inspired by my frustration of trying to switch.

      Just try to make docker comply with your firewall.

      I literally did this yesterday and it wasn’t that hard. You just add iptables:False to the docker config file.

    • altphoto@lemmy.today
      0·
      9 days ago

      Docker bypasses your firewall and runs as root. Only an idiot would allow that shit… I’m an idiot. But I’m fixing that.

      • lemmyvore@feddit.nlEnglish
        0·
        9 days ago

        It doesn’t “bypass your firewall”… it lets you shoot yourself in the foot. You’re asking it to open ports without specifying an explicit network interface so it opens them on all interfaces. Which includes opening up the firewall, because what’s the point of putting up a service and blocking it in the firewall.

        Also, doing it by hand would be incredibly tedious. Docker automatically adjusts the rules to match the ports and interfaces to its private container netmasks, and brings them up or down as needed when the containers start/stop.

        All you have to do is bind ports to localhost or to a private interface if you don’t want the service to be publicly exposed.

        Beginners get bitten by this because they say ports: 9999:9999 instead of ports: 127.0.0.1:9999:9999/tcp like they should. Unfortunately most examples out there use the terse version and never explain why it’s bad.

  • RVGamer06@sh.itjust.works
    0·
    9 days ago

    y’all use containers still? I run my site with native installed software configured by hand like a TRUE sysadmin!

      • CallMeAl (like Alan)@piefed.zipEnglish
        0·
        10 days ago

        I don’t know how you would even compare them. Quadlets can do what Docker Swarm or Kube does with dynamic instances and dependency lifecycle management. Docker Compose doesn’t have nearly the same features as Podman Quadlet.

        • hirihit640@sh.itjust.worksEnglish
          0·
          10 days ago

          Docker swarm uses compose files too. But really, when you have tools like Podlet that converts compose files to quadlets, it’s a pretty good sign that the two fit 90% the same use cases.

          • CallMeAl (like Alan)@piefed.zipEnglish
            0·
            10 days ago

            I think its more than Compose does a small subset of what Quadlets can do. I can understand why if your only use case is Compose and you already like it, why change? For me, the rootless by default and daemonless nature of podman quadlets, and its clean design all make it the preferred choice.

            • hirihit640@sh.itjust.worksEnglish
              0·
              10 days ago

              Podman-compose also works rootless and without a daemon. Naturally since it’s daemonless, it does require a separate systemd service if you want services to automatically restart (I forget exactly what that systemd service is called).

              What do you mean by “clean design”? This is of course subjective but I just want to understand quadlets more.

              • CallMeAl (like Alan)@piefed.zipEnglish
                0·
                9 days ago

                What do you mean by “clean design”?

                If you are comfortable reading the source code for each project that is the most revealing way to see the difference.

                In short, Docker has a lot more code because it duplicates a lot of kernel and systemd functionality (often poorly), uses multiple components that communication over grpc with each other to do things, requires setuid binaries, and defaults to running everything as root.

                Podman, is a straight forward clean simple program that fully uses kernel and systemd interfaces rather than duplicating functionality. Quadlet is build on systemd generators and its use of templates via systemd instances lets you use deterministic dynamic configuration in ways that is unlike anything in Docker.

                • hirihit640@sh.itjust.worksEnglish
                  0·
                  9 days ago

                  If you are comfortable reading the source code for each project that is the most revealing way to see the difference.

                  Strongly disagree on this. Design can mean many different things. For example in the docker vs podman explanation you gave, you are talking about integration with Linux and adherence to Linux standards, and I agree that with you on that. That’s one of the reasons I do prefer Podman over Docker.

                  However when I think about “clean” in regards to podman-compose vs Quadlet, I think about the user/developer experience. Quadlets integrate with systemd, but as a consequence inherit the design and interfaces of systemd. This means putting Quadlet files into a global systemd folder. This makes GitOps harder since all your projects get combined into a single folder. Also I’m not a fan of how verbose systemd config format is, like the repetition of keys. Seeing PublishPort= repeated for every port mapping looks ugly imo. And every service needs to be defined in a separate file, even if some services are only a few lines of config. Which makes it harder to see all services at a glance.

                  I recognize this is all my subjective preferences, but this is just what I think when I hear “design”.

  • unitedwithme@lemmy.today
    0·
    11 days ago

    I choose Podman bc it’s open source and that’s kind of the reason for using everything as a container bc those are often also open source. Fuck docker

      • MoogleMaestro@lemmy.zipEnglish
        0·
        11 days ago

        It does, but it seems like it’s still a bit of an afterthought. But it’s getting better.

        Still tho, podman is fine and I like the project as an alternative to docker.

    • Voytrekk@sopuli.xyz
      0·
      11 days ago

      It also can integrate with Systemd via Quadlets. Let’s you control containers as a sytemd service. I personally use them for my home server and have been happy with it.

      • ArchAengelus@lemmy.dbzer0.com
        0·
        11 days ago

        The learning curve for quadlets is quite harsh in my opinion. I started with podman compose 3 years ago for my homelab, because it allowed user containers.

        I tried to migrate to quadlets unsuccessfully, several times over the years. it was only recently that my self-hosted Qwen was capable enough to figure out where I was messing up and automate the process a bit.

        I probably wasn’t sufficiently motivated. It felt like podman compose is basically docker compose, but quadlets are a quite a bit different in form and function, so I was never able to grok them:

        • Voytrekk@sopuli.xyz
          0·
          11 days ago

          There is a tool named Podlet that can help translate to quadlets. I was able to fully translate my unraid and compose setups to quadlets.

            • Voytrekk@sopuli.xyz
              0·
              10 days ago

              I migrated from docker containers on Unraid to using quadlets on RockyLinux. The Podlet utility helped a bit with taking an existing docker container and converting it to a quadlet. Also did thorough testing in a VM before swapping my server.

              • pjusk@lemmy.dbzer0.comEnglish
                0·
                9 days ago

                Interesting, just migrated away from Unraid myself. But chose Proxmox -> Debian -> Podman Containers instead. Any reason in particular you chose Rocky?

          • hirihit640@sh.itjust.worksEnglish
            0·
            10 days ago

            I remember trying it and my compose files blew up to multiple Quadlet files with a much larger total size (lines of code). I find that compose is just more concise and structured compared to Quadlets.

            • Voytrekk@sopuli.xyz
              0·
              10 days ago

              It does have a larger file size compared to compose, sure. The big advantage of quadlets is that systemd will handle things in the event of a failure. It makes it a great option for production environments where you will not need to update your config files as much. It also allows you to have more control over when each application starts, if they rely on a specific disk mount or service running on the system. I’m sure someone else can provide more benefits who use them in a production environment.

              • hirihit640@sh.itjust.worksEnglish
                0·
                10 days ago

                Fair enough. My requirements are simply: start all services when the machine has finished booting. And I can’t remember the last time my system failed. Most that happened was a power outage, and Quadlets wouldn’t have helped there either.

                So in my case I much prefer simple and easy-to-read configs, over the complexity of integrating with systemd.

                • Voytrekk@sopuli.xyz
                  0·
                  9 days ago

                  Docker compose definitely works for most people, so I would feel pressured to swap.

                  There is one instance where Quadlets would have fixed an issue we ran into at work. We had a Kafka instance whose container died and went away because we ran out of space on the server. Compose doesn’t recreate containers on failure, so I was called in to fix the issue. Quadlets treats containers as disposable, so it would have recreated it as soon as it went away. The root of the issue was a bad logging config that we fixed on the next business day.

      • unitedwithme@lemmy.today
        0·
        10 days ago

        So, the Docker engine is free, just not the software under certain stipulations. See I don’t like that. A weird caveat for using it.

          • Kangae_Hishiryo@scribe.disroot.org
            0·
            10 days ago

            This NOTICE in both repos is weird asf:

            Docker Copyright 2012-2017 Docker, Inc.

            This product includes software developed at Docker, Inc. (https://www.docker.com/).

            This product contains software (https://github.com/creack/pty) developed by Keith Rarick, licensed under the MIT License.

            The following is courtesy of our legal counsel:

            Use and transfer of Docker may be subject to certain restrictions by the United States and other governments. It is your responsibility to ensure that your use and/or transfer does not violate applicable laws.

            For more information, please see https://www.bis.doc.gov/

            See also https://www.apache.org/dev/crypto.html and/or seek legal counsel.

            Also, they do limit some kind of uses if you don’t pay.

            • SlurpingPus@lemmy.world
              0·
              10 days ago

              Use and transfer of Docker may be subject to certain restrictions by the United States and other governments. It is your responsibility to ensure that your use and/or transfer does not violate applicable laws.

              That’s true of all software. It may be subject to restrictions by governments. But in this case, it seems to refer to the fact that the US restricted export of cryptographic software, and seemingly continues to restrict. See also Bernstein v. United States.

            • Lena@gregtech.eu
              0·
              10 days ago

              Also, they do limit some kind of uses if you don’t pay.

              You mean Docker Desktop?

              Also iirc all software developed in the USA is subject to those restrictions.

              • Kangae_Hishiryo@scribe.disroot.org
                0·
                10 days ago

                …iirc all software developed in the USA is subject to those restrictions.

                Oh, well, I didn’t knew about that, yeah.

                You mean Docker Desktop?

                And, in part yes, but these restrictions also apply to docker-cli and moby, although to a lesser extent

                • Lena@gregtech.eu
                  0·
                  10 days ago

                  And, in part yes, but these restrictions also apply to docker-cli and moby, although to a lesser extent

                  What restrictions? The ones on all US software or something else?

      • EnsignWashout@startrek.website
        0·
        10 days ago

        Docker desktop is not. (open source)

        Which can be a pretty big deal.

        This works out to: The product is unencumbered, but the only reliable installer is encumbered as fuck.

        That’s a “no thanks”, from me.

        I don’t need the sword of “Docker fucking with my colleague’s ability to collaborate” hanging over each of my projects.

        I’m not mad at folks using Docker for backwards compatibility. I just don’t need to make the problem worse.

        • Lena@gregtech.eu
          0·
          9 days ago

          I found Docker pretty easy to install. Though apparently it’s harder on windows, where they suggest you just use docker desktop, in which case, yeah, fair point. But I’d just put docker in WSL if I had the misfortune of having to use it on Windows.

          • EnsignWashout@startrek.website
            0·
            9 days ago

            But I’d just put docker in WSL if I had the misfortune of having to use it on Windows.

            Oh, thanks! I might try WSL next time, should I be so unfortunate, again.

  • user_user@lemmy.zip
    0·
    10 days ago

    docker/podman sucks, u can’t avoid using journald for logging. U also can’t avoid using overlayfs. Plain LXC is what I have at home

    • DaPorkchop_ [they/she/it]@lemmy.ml
      0·
      9 days ago

      uh… yes, you can? docker doesn’t even log to journald by default, and you can also just do docker run --log-driver=none ... if you want to completely disable saving any logs.

      edit: there are also a bunch of alternate storage systems, i have docker set up to use btrfs subvolumes

      • user_user@lemmy.zip
        0·
        8 days ago

        I need to forward logs to syslog, not disabling them. Create rootfs in directory and try running docker/podman over it without overlayfs, well I guess u need btrfs for that

        • DaPorkchop_ [they/she/it]@lemmy.ml
          0·
          8 days ago

          In that case you can use --log-driver=syslog. There are quite a few other options to choose from :)

          Out of interest, why is overlayfs out of the question? If it’s because you’re running rootless and you’re running an older kernel which doesn’t allow non-root users to create overlayfs mounts, there’s always the fuse-overlayfs driver, which is functionally the same but emulates it in userspace using a FUSE driver. Finally, the vfs driver should ALWAYS work, although it comes at the cost of not being able to share storage between image layers. Also if you’re on ZFS there’s a zfs driver for that which uses ZFS volumes (same idea as the subvolume approach on btrfs). There’s more information on the docs if you’re interested, and I’m pretty sure podman has a similar suite of options.

          • user_user@lemmy.zip
            0·
            7 days ago

            No such log-driver on podman and I don’t have docker on Alpine. And yes, I’m using ZFS as storage, kinda use to it. For overlayfs I don’t like the initial push to use it and 3 extra folders for each mount.

        • lemmyvore@feddit.nlEnglish
          0·
          9 days ago

          Not requiring a service running in root context.

          I don’t think I’ve ever understood the distinction in this argument.

          Isn’t systemd exactly that, a service running in root context?

          I mean yeah you can technically run podman containers by hand as a non-privileged user but nobody does that, let’s be serious. Everybody uses systemd for management and autostart.

          I really don’t understand how running a container through docker as a non-privileged user and dropping all caps is any different from doing the same through systemd + podman.

          Tons of other services do that, ssh, CUPS etc.

          If anybody can explain the difference I’d appreciate it.

      • esc@piefed.socialEnglish
        0·
        10 days ago

        Rootless, better integrated with system, a bit faster and lighter on resources. Also it supports k8s style yaml configuration both ways and a lot of people are more familiar with them and they also provide some (minimal) interoperability.

        • katze@lemmy.4d2.org
          0·
          10 days ago

          a bit faster and lighter on resources.

          Can’t confirm. I have two VMs with an identical image (about 200 MB).

          Docker: Pulling the image takes about 10 seconds and needs about 200 MB diskspace.

          Podman: Pulling the image takes about 15 minutes and needs about 110 GB diskspace.

          Docker: Commands like “docker ps”, “docker stop” etc. run in a few seconds.

          Podman: Commands like “podman ps”, “podman stop” etc. take at least one minute.

          • esc@piefed.socialEnglish
            0·
            10 days ago

            Company confirmed that it is lighter and faster with multiple benchmark at the time of migration. Your case sounds like extreme misconfiguration.

            • katze@lemmy.4d2.org
              0·
              10 days ago

              extreme misconfiguration

              I did not configure anything, I just installed it from the debian repository.

              • Klara@lemmy.blahaj.zone
                0·
                10 days ago

                If this is on Debian 12 I think the issue is that the default storage backend is VFS rather than Overlay, which burnt me as well as it is REALLY inefficient. Look up how to find out what you’re using and change it if that’s it. After doing that it’s been really good for me :)

          • Allero@lemmy.today
            0·
            10 days ago

            Something is super wrong in your setup or some weird Podman bug on your side. Works flawlessly and quickly on my machine, no such issues.

      • terminatortwo@piefed.socialEnglish
        0·
        10 days ago

        At work, avoiding surprise licensing fees. If you ever have over 250 employees or over 10 million revenue, you owe a subscription.

        At the home, easy orchestration with systemd