I keep reading about podman, yet it doesm’t FEEL as mature to me as docker for a normal user like me. What’s your opinion? Did you already switch or do you keep waiting for … for what? When will you switch?

    • lemmyvore@feddit.nl
      link
      fedilink
      English
      arrow-up
      23
      arrow-down
      4
      ·
      8 months ago

      It wouldn’t rewrite them if you didn’t have a firewall to begin with.

    • ShortN0te
      link
      fedilink
      English
      arrow-up
      10
      arrow-down
      1
      ·
      8 months ago

      I do not even want to know how many databases are openly available because of that shit.

      • Big P@feddit.uk
        link
        fedilink
        English
        arrow-up
        12
        arrow-down
        5
        ·
        8 months ago

        Firewall rules shouldn’t be your only line of defense

      • lemmyvore@feddit.nl
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        2
        ·
        8 months ago

        It changes packet routing because you’re asking it to map a container port to the host public interface. How else would that occur? And what would be the point in blocking access to it?

        Do you want to write routing rules, and keep track of container interfaces, and to grant access manually, for each and every port you expose?

        • ShortN0te
          link
          fedilink
          English
          arrow-up
          5
          ·
          8 months ago

          When i have port 8888 not allowed on my firewall then no other program should ‘open’ that port. If i map a port with the syntax ‘8888:8888’ exaclty that happens with docker. Not with podman.

          Also this is the default syntax you will find in any guide and docs there is.

          To prevent this happening with docker you will have to specify the localhost with ‘127.0.0.1:8888:8888’

          When you check the internet for this subject you will notice that this behavior catches a lot of ppl by surpirise.

          • lemmyvore@feddit.nl
            link
            fedilink
            English
            arrow-up
            4
            arrow-down
            3
            ·
            8 months ago

            It catches people by surprise because they don’t have a clue. If someone is binding to localhost just to avoid opening the firewall it means that either they don’t understand how packet routing works, or that they should have used a docker network.

            If you use 8888:8888 it means you want the port to be open on the host’s external interface. Which means it needs to be forwarded as well as accessible. Docker does this for you so you don’t have to write the rules by hand, you don’t have to keep track of container interfaces, and you don’t have to remember to take the rules up and down whenever you start or stop the container.

            Out of curiosity, how do you do all this with podman? By hand?

            • ShortN0te
              link
              fedilink
              English
              arrow-up
              4
              arrow-down
              2
              ·
              8 months ago

              Just alone the fact that podman, a drop in replacement for docker, does implement this in another way proofs that it is bad practice to implement the way docker did.

              If you use 8888:8888 it means you want the port to be open on the host’s external interface

              I am sorry. That is just bs. When i install apache and start the service and let it listen on port 80 and 443 i still have to add the firewall rule to allow it. This is the default behavior of every other programm.

              • lemmyvore@feddit.nl
                link
                fedilink
                English
                arrow-up
                4
                arrow-down
                5
                ·
                edit-2
                8 months ago

                When you install Apache on the host then yes, you just need a rule to allow the port. But a container runs on a separate network interface, which means you also (1) need to know the name of the interfaces involved, which change for each container and their network mode and the host’s network adapter and so on, and (2) set up rules to forward the port traffic between the container interface and the host interface.

                I’m guessing you haven’t checked to see what Docker is actually doing, or you’ve looked only at the OUTPUT and INPUT chains.

                I’m also guessing that when you stop Apache you leave the ports open in the firewall. Which is bad practice. Docker takes down the rules when the container stops, which ends up as better security.

                I sincerely hope you’re not actually running a machine that’s just a firewall away from the Internet, because blaming Docker for bad security in that case is very shortsighted. Docker is actually helping you by making correct and complete firewall rules.

                podman, a drop in replacement for docker, does implement this in another way

                Yeah? How does it do that?

        • theRealBassist@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          ·
          8 months ago

          Technically I do, maybe? My home server is running ProxMox which virtualizes PFSense. My docker install is on a separate VM, but same physical device. Not sure if that counts lol

          • ikidd@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            8 months ago

            That doesn’t count. You’re still externally firewalling it, which is good procedure.

        • taladar@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          1
          ·
          8 months ago

          Everyone who runs it on a root server that is not part of some larger private network at that hoster?

  • poVoq@slrpnk.net
    link
    fedilink
    English
    arrow-up
    25
    arrow-down
    1
    ·
    edit-2
    8 months ago

    Podman is solid, just don’t use podman-compose but rather utilize the Systemd integration for container management.

    With very few exceptions, it works just as well as Docker these days.

    • lemmyvore@feddit.nl
      link
      fedilink
      English
      arrow-up
      16
      arrow-down
      3
      ·
      8 months ago

      utilize the Systemd integration for container management.

      The systemd integration is probably the thing I dislike most about it. 😆 Systemd has no business managing containers IMO, it should manage podman and podman should manage the containers. It’s a completely gratuitous mix of concerns but it seems that podman is set on becoming a systemd subsystem… so I’ll probably never use it.

      On a related note, the systemd expansion is getting ridiculous. It’s gotten to the point if you read one day that wayland is being merged into systemd you wouldn’t even know if it’s a joke.

      • poVoq@slrpnk.net
        link
        fedilink
        English
        arrow-up
        15
        arrow-down
        1
        ·
        8 months ago

        A container is a service, makes perfect sense for me to manage that via Systemd like all other services.

      • ShittyKopper [they/them]@lemmy.blahaj.zone
        link
        fedilink
        English
        arrow-up
        3
        ·
        edit-2
        8 months ago

        One of the reasons I use containers instead of installing things directly is that i can completely uninstall a service by deleting a single directory (that contains a compose.yml and any necessary volumes) and running a docker/podman system prune -a

        or that i can back up everything by backing up a single “containers” dir, which i could have on a subvolume and snapshot if i wanted to

        systemd/quadlet on the other hand makes me throw files in /etc (which is where you’re supposed to put them, but ends up resulting in them being tangled together with base system configuration often partially managed by the package manager)

        The Solution™ to this is configuration management like ansible or whatnot, which needlessly overcomplicates things for the use cases i need (though they’re still useful for getting a base system “container ready” wrt ssh hardening and such)

        tldr: i want my base system to be separated from my services, and systemd integration is the exact wrong tool for this job

      • witten@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        8 months ago

        It’s not the “official” way to do it, but you can make systemd run Docker Compose (talking to Podman instead of Docker), which is pretty close to what you’re talking about. And then you don’t have to write stinky systemd INI files for each container.

        • lemmyvore@feddit.nl
          link
          fedilink
          English
          arrow-up
          1
          ·
          8 months ago

          But you don’t need to have systemd run anything (except docker or podman itself). Just run containers with “restart: always” and docker/podman will start them on boot, restart them of they fail, and leave them alone if they’re manually stopped.

          You only need to run compose when you are [re]provisioning a container.

          • herrfrutti@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            8 months ago

            Podman does not start your containrs on boot. You need to do some magic yoursefel. Like a cronjob that starts all containers at boot.

            • poVoq@slrpnk.net
              link
              fedilink
              English
              arrow-up
              3
              ·
              8 months ago

              When you used the Podman systemd integration it starts containers on boot just fine. You can even configure it to auto-update containers. Very hassle free.

  • CapillaryUpgrade@lemmy.sdf.org
    cake
    link
    fedilink
    English
    arrow-up
    23
    arrow-down
    1
    ·
    8 months ago

    Podman is CLI and API compatible with Docker (except where differences in implementation doesn’t allow it)

    Running Podman as root is 99.9% the same as running Docker.

    I have been running my homelab with Podman for several years and it is absolutely mature enough for a regular user.

    Also, the docs are really good.

      • vegetaaaaaaa@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        ·
        edit-2
        8 months ago

        You technically can bind ports <1024 to unprivileged containers. echo 'net.ipv4.ip_unprivileged_port_start=0' | sudo tee /etc/sysctl.d/50-unprivileged-ports.conf; sudo sysctl --system. Though this will allow any user to bind ports below 1024, so it’s not very clean.

        Another workaround is to redirect port 80 to 8080 (or other) through iptables and have your proxy listen on this port. sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080. Same thing for 443.

        As far as I know granting the CAP_NET_BIND_SERVICE capability to /usr/bin/podman does not work.

        Also podman-compose implementation is still incomplete, and I prefer using systemd units to start and manage containers. Check man podman-generate-systemd

      • litmus1931@kbin.social
        link
        fedilink
        arrow-up
        1
        ·
        8 months ago

        You shouldn’t need root to bind to privileged ports. I use k8s but I assume you can set sys capabilities for containers in a similar way I do for pods.

      • CapillaryUpgrade@lemmy.sdf.org
        cake
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        8 months ago

        I only tried running rootless when i set them up several years ago and i was completely green, so it was probably me who was the problem.

        Regarding podman-compose, Fedora repos has a a package that aliases podman -> docker and the regular docker-compose package, which i used before migrating to podman+systemd. It worked flawlessly unless i did networking shenanigans because Podman and Docker differs (/differed?) in so some thing simply couldn’t be brought over.

        Edit: i found the docker-compose and Podman alias thingies in a Fedora Magazine post.

        However, unless you use docker-compose a lot for other stuff, learning to use Podmans systemd integration (also called quadlet) is very much worth it. They’re just a really powerful combo and systemd has a ton of nice features for making stuff run and keep running.

      • worldofgeese@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        8 months ago

        For what it’s worth, I just wrote up a compose.yaml file as I’d write it for Docker Compose and it just worked. See the bottom of my comment on this GitHub issue for an example. I think the team’s intention is for it to transparently support whatever you’d write for a standard Compose file but of course we don’t have things like the brand new Docker watch. They do point to the Compose spec in the Podman Compose README. Bind mounts are good enough for me, thus far.

    • lemmyvore@feddit.nl
      link
      fedilink
      English
      arrow-up
      9
      arrow-down
      1
      ·
      edit-2
      8 months ago

      I mean, it was good enough for podman to copy its API and interface verbatim…

      • witten@lemmy.world
        link
        fedilink
        English
        arrow-up
        9
        ·
        8 months ago

        I don’t think Docker’s API and CLI are historically where it’s had problems…

  • hottari
    link
    fedilink
    English
    arrow-up
    20
    arrow-down
    5
    ·
    8 months ago

    Tried switching some time back, didn’t take long to go back to docker. Podman does not have the polish that docker has taken years to perfect and as much as I love systemd, managing containers in docker is 10x better.

  • magikmw@lemm.ee
    link
    fedilink
    English
    arrow-up
    15
    ·
    8 months ago

    I’ve been using podman instead of Docker for a couple years now. I’m not a heavy user, but it doesn’t ever break for me and I appreciate the pods and ease of turning pod config into a kubernetes deployment.

  • MigratingtoLemmy@lemmy.world
    link
    fedilink
    English
    arrow-up
    15
    arrow-down
    1
    ·
    8 months ago

    Explain your feelings on the matter please. I think podman is very good, and just the fact that it doesn’t need to run as root OOTB is enough for me to switch. Yes, Docker can do that, but I’m ideologically on Podman’s side now. No coming back AFAIK

    • wreckedcarzz@lemmy.world
      link
      fedilink
      English
      arrow-up
      10
      arrow-down
      1
      ·
      8 months ago

      It took your comment for me to understand that ‘podman’ is not some podcast manager, but a docker competitor.

  • SheeEttin@lemmy.world
    link
    fedilink
    English
    arrow-up
    11
    arrow-down
    1
    ·
    8 months ago

    I tried switching a while back, but I found a bunch of stuff didn’t work properly, and wasn’t considered supported. I don’t remember what it was exactly.

    I might try it again once there’s been a bit more development and community use. Docker isn’t ideal, but at least it works and there’s a lot of community support.

  • Kimusan@feddit.dk
    link
    fedilink
    English
    arrow-up
    6
    ·
    8 months ago

    Switched a long time ago - it’s just soooo much easier and I never have any problems

  • markr@lemmy.world
    link
    fedilink
    English
    arrow-up
    6
    arrow-down
    1
    ·
    8 months ago

    My only serious complaint with docker is the quality of their updates. They keep breaking stuff. If podman supported all docker functionality including compose based stacks, I’d consider switching, but last time I looked it didn’t.

    • Username@feddit.de
      link
      fedilink
      English
      arrow-up
      7
      ·
      8 months ago

      There is a wrapper for podman supporting compose.

      But maybe it’s time to use kubernetes deployments or pods instead of compose files…

    • witten@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      8 months ago

      Yeah, the constant Docker breakage was one of the main reasons I switched to Podman. FYI you can use Docker Compose directly with Podman.

  • herrfrutti@lemmy.world
    link
    fedilink
    English
    arrow-up
    5
    ·
    8 months ago

    I switched a year ago to podman and had some trouble to get everything running. But it is possible. I’m not running anything rootful and everything works.

    Read the docs, use podman-compose (this sadly has no good docs, but works quit well when you got it) and get ready to play around with permissions and file ownership.

  • Trincapinones@lemmy.world
    link
    fedilink
    English
    arrow-up
    6
    arrow-down
    3
    ·
    8 months ago

    I switched to podman half a year ago and it was a mess, I had a lot of compatibility and permission issues also, it’s hard to support red hat after the drama

    • worldofgeese@lemmy.world
      link
      fedilink
      English
      arrow-up
      7
      ·
      8 months ago

      It should be harder to support Docker, which hasn’t released a new open source product since before Docker Desktop, which is also proprietary. Podman Desktop? OSS. It’d be hard to name a product Red Hat supports that isn’t OSS.

  • ithilelda@lemmy.world
    link
    fedilink
    English
    arrow-up
    3
    ·
    edit-2
    8 months ago

    well I’ve been using both for quite a while. If you just want something that works, stick with docker. There is nothing wrong with docker in the homelab scenario and podman has rough edges that cringes you. If you are a control freak like me who wants to control every aspect of container running, then podman is a great tool that forces you into the habbit of learning and tinkering. It helped me understand a hell lot of things.

  • lemmyvore@feddit.nl
    link
    fedilink
    English
    arrow-up
    3
    ·
    8 months ago

    I fully admit I’m slow sometimes. I could never understand the podman solution for that common scenario when podman runs as one user ID on the host and the image uses a completely different user ID that doesn’t even exist on the host. And no, unfortunately I can’t always go look for a better image, even though I agree that images should be written to allow for ID selection. But they aren’t.

  • aordogvan@lemmy.world
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    1
    ·
    8 months ago

    Why not try docker rootless? Been using it for 2 years and does everything docker does.