Just want to say everyone should be using podman. Its architecture is way more sane and integrates with Linux on a far more basic level (a regular process that can be started via systemd, etc. instead of a root daemon. Run it as root to get privileged containers).
They've also built an incredible ecosystem around podman itself. Red Hat has been absolutely cooking with containers recently.
Systemd .container services (Quadlet) are excellent. I used them to set up multiple smaller sites without any issues. Containers work just like regular systemd services. I created a small Ansible template to demonstrate how simple yet powerful this solution is.
I agree. I have been using it as a drop in docker replacement alongside podman compose via aliases for years now and I often just forget I am not using docker. The only time it bit me recently is when some scripts were looking for containers with docker specific labels and I had to figure out why they failed only for me.
When you say "Docker Engine" that suggests other parts of Docker are licensed differently (I haven't looked into it). I'd say you have to compare the whole ecosystem and not just a single component either way.
I said "Docker Engine" specifically because it is "Docker Engine" that is the counterpart of Podman, and therefore it is the only component that matters. The discussion here is "Docker" vs "Podman," but "Docker Engine" is what we really mean when saying "Docker."
Docker Desktop has a much more restrictive license. Unfortunately, on MacOS and Windows, the "Docker Desktop" product is often referred to as simply "Docker".
FWIW, Podman has an open source alternative to Docker Desktop as well.
Im fully on board with the idea that root daemons shouldnt be necessary I just dont want systemd to become a dependency for yet again something else it shouldnt be a dependency for.
yeah, it runs fine without systemd, until you need a docker compose substitute and then you get told to use quadlets (systemd), podman compose (neglected and broken as fuck) or docker compose (with a daemon! also not totally compatible) or even kubernetes...
The point is that RedHat went on a tirade for years telling everyone: "Docker bad, root! Podman good, no root! Docker bad, daemon! Podman good, no daemon!".
And then here comes Quadlets and the systemd requirements. Irony at its finest! The reality is Podman is good software if you've locked yourself into a corner with Dan Walsh and RHEL. In that case, enjoy.
For everyone else the OSS ecosystem that is Docker actually has less licensing overhead and restrictions, in the long run, than dealing with IBM/RedHat. IMO that is.
But...you don't need systemd or Quadlets to run Podman, it's just convenient. You can also use podman-compose (I personally don't, but a coworker does and it's reasonable).
But yeah I already use a distro with systemd (most folks do, I think), so for me, using Podman with systemd doesn't add a root daemon, it reuses an existing one (again, for most Linux distros/users).
Today I can run docker rootless and in that case can leverage compose in the same manner. Is it the default? No, you've got me there.
SystemD runs as root. It's just ironic given all the hand waving over the years. And Docker, and all it's tooling, are so ubiquitous and well thought out that Podman and friends are literally a reimplementation which is the selling point.
I've used Podman. It's fine. But the arguments of the past aren't as sharp as they originally were. I believe Docker improved because of Podman, so there's that. But to discount the reality of the doublespeak by paid for representatives from RedHat/IBM is, again, ironic.
> And Docker, and all it's tooling, are so ubiquitous and well thought out that Podman and friends are literally a reimplementation which is the selling point
I would argue that Docker’s tooling is not well thought out, and that’s putting it mildly. I can name many things I do not like about is, and I struggle to find things I like about it’s tooling.
Podman copied it, which honestly makes me not love podman so much. Podman has quite poor documentation, and it doesn’t even seem to try to build actually good designs for tooling.
Quadlets is systemd. Red hat declared it to be the recommended/blessed way of running containers. podman compose is treated like the bastard stepchild (presumably because it doesnt have systemd as a dependency).
Please try to understand the podman ecosystem before lashing out.
Protip: if you want to use Podman (or Podman Desktop) with Docker Compose compatibility, you'll have a better time installing podman-compose [1] and setting up your env like so:
alias docker=podman
# If you want to still use Docker Compose
# export PODMAN_COMPOSE_PROVIDER=docker-compose
# On macOS: `brew install podman-compose`
export PODMAN_COMPOSE_PROVIDER=podman-compose
export PODMAN_COMPOSE_WARNING_LOGS=false
Most of my initial issues transitioning to Podman were actually just Docker (and Docker Desktop) issues.
Quadlets are great and Podman has a tool called podlet [2] for converting Docker Compose files to Quadlets.
I prefer using a tool like kompose [3] to turn my Docker Compose files into Kubernetes manifests. Then I can use Podman's Kubernetes integration (with some tweaks for port forwarding [4]) to replace Docker Compose altogether!
Last year I transitioned all of my personal projects to use podman. The biggest surface area was converting CI to use podman to build my docker files, but also changed out tooling to use it (like having kind use it instead of docker).
For the most part this worked without issue. The only snag I ran into was my CI provider can't use oci formatted images. Podman lets you select the format of image to build, so I was able to work around this using the `--format=docker` flag.
Same here. I migrated maybe 5-6 projects from docker to buildah and podman about 2 years ago and never looked back.
Unlike other posts I've seen around I haven't really encountered issues with CI or local handling of images - though I am using the most bare bones of CI, SourceHut. And I actually feel better about using shell scripts for building the images to a Dockerfile.
I would love to know more details about your CI setup. I'm running all of my self-hosted services as Quadlets (which I generally really love!) and CI (using Gitea) was/is a huge pain point.
I have a simple setup on GCP. I am using Cloud Build with the companion Github app to trigger builds on branch updates.
I like it because I am deploying to GCP, and storing containers in Artifact Registry. Cloud Build has good interop with those other products and terraform, so its pretty convenient to live with.
The pipelines themselves are pretty straight forward. Each step gets an image that it is executed in, and you can do anything you want in that step. There is some state sharing between steps, so if you build something in one step, you can use it in another.
That's a pretty cool migration story! I've been meaning to give podman a more serious look. The OCI image format issue is good to know about – hadn't considered that compatibility angle. I'm curious, did you notice any performance differences in your CI builds after switching?
Its been a while, so all my telemetry has since expired, but there was no meaningful difference in time.
I was prepared to roll it all back, but I never ended up running into problems with it. It's just something that happens in the background that I don't have to think about.
Has Podman become more user friendly in recent years? I gave it a go about three or four years ago now when Docker began their commercial push (which I don't have an issue with).
This was for some hobby project, so I didn't spend a ton of time, but it definitely wasn't as set-and-forget as Docker was. I believe I had to set up a separate VM or something? This was on Linux as the host OS too. It's been a while, so apologies for the hazy memory.
Or it's very possible that I botched the entire setup. In my perfect world, it's a quick install and then `podman run`. Maybe it's time to give it another go.
Definitely more user friendly, and I love using Quadlets! For people using Flatpaks (Linux), check out the app 'Pods' as a lightweight alternative to Podman Desktop. It is still a young project, but is already a very useful way of managing your containers and pods.
As a side note, it is so _refreshing_ to observe the native apps popping up for Linux lately, it feels like a turning point away from the Electron-everything trend. Apps are small, starts immediately and is well integrated with the rest of the system, both functionally and visually. A few other examples of native apps; Cartero, Decibels, GitFourchette, Wike – to name a few that I'm using.
I've found it very straight forward to work with. I run the cli on macOS to spin up ephemeral containers all the time for testing and simple tasks. Never had an issue.
In the spirit of the OP, I also run podman rootless on a home server running the usual home lab suspects with great success. I've taken to using the 'kube play' command to deploy the apps from kubernetes yaml and been pleased with the results.
It's almost a perfect drop-in replacement for Docker so I don't see why it would be any less "set-and-forget".
I only ever found one thing that didn't work with it at all - I think it was Gitlab's test docker images because they set up some VMs with Vagrant or something. Pretty niche anyway.
The one edge case I know of (and have run into) is that podman push doesn't support the --all-tags flag. They have also said they do not plan to implement it. It's annoying because that flag is useful for CI scripts (we give multiple tags to the same build), but not the end of the world either.
In fact, there is even a package "podman-docker" that will alias podman to docker so most of your commands will usually work without modification. (of course, there are always the edge cases)
This is mostly solved I think. I run Podman Desktop on macOS and just aliased Docker to Podman in zshrc and it just works for me. I don’t do any local k8s or anything crazy, but it works with my compose files. I’m going to guess there’s still rough edges if you want GPU passthrough or something with complex networking, but for a server and a database running together it matches Docker itself.
The biggest difference in my (admittedly limited) experience, is that you need to start a "podman machine" before you can start running containers. This is architecturally different from Docker's use of a daemon, in ways I'm not qualified to explain in more detail.
It's an extra step, but not a painful one -- the default podman machine configuration seems to work pretty well out of the box for most things.
Honestly, for my use-case (running Subabase stack locally), it was seamless enough to switch that I'm a little surprised a bash script like this is necessary. On my Mac, I think it was simply `brew install podman` followed by `podman machine start` and then I got back to work as if I were still using docker.
By far the most tedious part of the switch was fully uninstalling Docker, and all its various startup programs & background processes.
Podman only requires `podman machine` if you're using a non-Linux system; this sets up a Linux VM in the background that all the actual containers run on. Docker does the same thing, though I think it sets it up for you automatically.
The only snag I hit regularly is me forgetting to set :z or :Z on my podman volumes to make it play well with SELinux.
I used to use docker compose, but migrated to podman quadlets. The only thing I miss is being able to define every container I run in a pod in the .pod file itself. Having it integrate with systemd is great.
Hasn't become more friendly from what I've seen. The project seems largely centered around K8s, and isn't really investing in fixing anything on the "compose" side. I did the same thing as you when Docker first started going down the more commercial path, and after dealing with random breakages for a number of years, fully switched back to Docker (for local dev work on osx).
Podman machine is fine, but occasionally you have to fix things _in the vm_ to get your setup working. Those bugs, along with other breakages during many upgrades, plus slower performance compared to Docker, made me switch back. This is just for local dev with a web app or two and some supporting services in their own containers via compose, nothing special. Totally not worth it IMO.
On NixOS it was as trivial as `podman.enable = true;`. IIRC on Arch it was just a matter of installing the package.
It's all daemonless, rootless and runs directly with your host kernel so it should be as simple as it an application of this kind gets. Probably you followed some instructions somewhere that involved whatever the podman equivalent for docker-machine is?
My container using is admittedly pretty simplistic (CRUD app with some REST services), but after initial setup I've found it to be extremely reliable and simple to use. They strive for 1:1 docker compat so I think it should be pretty easy to migrate.
Launching Kubernetes pods without a kube-apiserver. The kubelet can run in standalone mode and launch static pods as well, but I don't believe it supports deployment manifests like podman does. Pretty handy.
To mirror some of the other comments here: I've had decent success in using podman for my local dev setup (postgres, redis, ...).
I did run into one issue though. Rootless mode isn't supported (or at least easy to setup) when the user account is a member of an active directory (or whatever Linux equivalent my work laptop is running).
Though root mode works, I can't use podman desktop and I have to sudo every command.
What's the podman UX/story on Windows if anyone is using it? Say for Server 2022 (prod) and Win 11 Pro (dev).
Does one prefer using WSL2 or Hyper-V as the machine provider? From what I understand, podman provides the container engine natively so nothing additional is required. Do container runtimes like containerd only come into play when using kubernetes? Not a windows specific question, but is there a reason to pick a podman native container vs one in a k8s context. I understand podman supports k8s as well. Other info: No current containers (docker or k8s) are in play.
Does Podman have a swarm counterpart, or does running services still effectively require configuring systemd and then switching to kubernetes for multi-machine?
Docker Compose is really great for multi-container deployments on a single machine. And Docker Swarm takes that same Compose specification (although there were historical differences) and brings it over to clusters, all while remaining similarly simple. I'm surprised that ourside of Docker Swarm, Nomad or lightweight Kubernetes distros like K3s there haven't been that many attempts at simple clustering solutions. Even then, Kubernetes (which Podman supports) ends up being more complex.
Last I checked there's no native swarm equivalent in podman. Your best bet is nomad (much simpler than k8s if you want to spin some local setups) or kubernetes.
Podman can work with local pods, using the same yaml as for K8s. Not quite docker swarm, but useful for local testing IME when k8s is the eventual target.
Eh, starting with k8s just because I might want kubernetes in five years is a hard sell, given how easy swarm is to setup. devops that does not fulfill an immediate business need should be delayed because that labor is hella expensive.
They're probably referring to the podman.socket, which isn't quite like a daemon-mode but means it can emulate it pretty well. Unless there is some daemon mode I missed that got added, but I'd be rather surprised at that.
In places where you're doing a `dnf install podman` all you typically need to do is start the service and then point either the podman cli or docker cli directly at it. In Fedora for example it's podman.service.
I honestly prefer using the official docker cli when talking to podman.
I've not looked into podman but this reminded me that I miss rkt. Anyone with experience in rkt and podman able to give me an overview of how they currently differ? I'm not a huge fan of how docker works, so I'd love an alternative.
I went from rkt to podman. Podman is compatible with Docker, including the socket/API, but is similar to rkt in that it launches the container as a child when ran directly (versus Docker, which runs all containers and storage operations under the daemon). Podman also has integration with systemd[1] though it mostly just generates boilerplate for you, since it works a lot closer to how actual daemons work. (P.S.: You might want `--new` if you want a new container each time the unit starts.)
Podman also supports running in "rootless" mode, using kernel.unprivileged_userns_clone and subuid/subgids for the sandboxing and slirp4netns for the networking. This obviously isn't exactly the same as rootful networking, but it works well enough for 99% of the use cases.
If you are running Linux, I think using Podman instead of Docker is generally a no-brainer. I think the way they've approached rootless support is a lot better than Docker and things "just work" more often than not.
Script does almost all of the things required for the "existing docker containers", migrating networks, blocks, restart mech,etc, that leaves out just one thing migrating any other third party script utilizing docker to podman based instructions.
This would highly improve the experience. Goodluck
If you are using docker in this carefully assembled stateful way - you are doing it wrong. You should be using docker via scripts and IaaS tooling that will assert your desired setup from some kind of configuration. Meaning, you should be able to easily blow all of that away and recreate it with a single script. Likewise, a transition to podman should involve adjusting your scripts to re-assert that plan against podman instead of docker.
This is a cool tool for the decrepit hand-configured server with no documentation that has been running since 2017 untouched and needs an update... but I would encourage you to not fall into this trap to begin with.
programmers ("developers," if you prefer) have trouble with "second order" thinking. we integrate X technology in Y way, maybe with some Z optimization, and that'll solve the problem.
okay, but, like... will it?
is there new maintenance stuff you've completely ignored? (I've noticed this is more common when maintenance is someone else's job.) is it completely new and none of us know about it so we get blindsided unless everything goes exactly right every time? do we get visibility into what it's doing? can we fix it when (not if, when) it breaks? can everyone work on it or is it impossible for anyone but the person who set it up? they're good at thinking up things that should fix the problem but less good at things that will.
I'm a fan of cross-functional feature teams because others in the software engineering ecosystem like QA, systems people, ops, etc. tend not to have this problem. programmers are accountable to the other stakeholders up front, bad ideas are handled in real time, and- this is the most important part- everyone learns. (I won't say all systems people are cantankerous bastards... but the mistakes they've harangued me for are usually the mistakes I don't make twice.)
Runs on demand, doesn't require root, can be nested, usually uses newer and simpler primitives (e.g. a few nftables rules in Podman vs iptables spaghetti in Docker). In my experience it is ~90% compatible with Docker. The author explains the practical differences in the blog post https://www.edu4rdshl.dev/posts/from-docker-to-podman-full-m...
It is usually easier to install - most distros ship relatively recent version of Podman, while Docker is split between docker.io (ancient), docker-ce (free but non in repos) and docker-ee.
Not everything is rosy, some tools expect to be talking to real Docker and don't get fooled by `ln -s docker podman`. But it is almost there.
In general, if one is happy to run very old versions of software Debian can be your driver. If not, you are in for pain in my experience. (That is also why Ubuntu as default Linux is a tragedy, old bugs and missing features mean that it is not really attractive to officially support Linux for vendors.)
I've not experienced something on this scale for many years, "Debian stable packages are so outdated" is mostly a meme. Debian 12 was 1y old when I did this and very often you can relatively easily find a backport or build one - but I think in this case it was either glibc or kernel, that's why "just run upstream" didn't work.
What’s the point of using a distribution if you need to find back ports or build your own? Distros are, after all, mostly collections of installable software.
The point is that it works 95% of the time, or probably more like 98%.
If this is a e.g. webserver and I only need my fastcgi backend built by myself, I can still have reverse proxy, database, and every other package be done by the distro.
No one said you need backports. More like: If it fits 90% and one package doesn't work, you get it from somewhere else - that doesn't invalidate the concept of a distro for me. YMMV
I maintain a couple of Debian servers and this is how I do it too.
Reverse proxy, DB, etc from Debian. The application server is built and deployed with nix. The Python version (and all the dependencies) that runs the application server is the tagged one in my nix flake which is the same used in the development environment.
I make sure that PostgreSQL is never upgraded past what is available in the latest Debian stable on any on the dev machines.
Honest question: wouldn't that make you more nervous you now arrived at an unknown/unsupported configuration?
Boring stability is the goal, but if Debian does not fit as is, then why not find a total package that is somewhat more cutting edge but does fit together? Especially given the fact that Debian does customization to upstream, so esoteric times esoteric.
It doesn't make me nervous because Debian has only let me down a couple of times over nearly 20 years and for example Ubuntu und RHEL and SLES have let me down dozens of times each.
Also I don't usually run "supported". I just run a system that fits my needs.
2) `podman run --entrypoint="" --rm -it debian:stable /bin/bash`
in most instances you can just alias docker to podman and carry on. It uses OCI formatted images just like docker and uses the same registry infrastructure that docker uses.
I would think the Docker infrastructure is financed by Docker Inc as a marketing tool for their paid services? Are they ok when other software utilizes it?
On my system it asks between a few different public registries, and dockerhub/docker.io is one of the choices.
t's all public infrastructure for hosting container images, I don't think Docker-the-company minds other software interfacing with it. After all, they get to call them 'Docker images', 'Dockerfiles', and put their branding everywhere. At this point
They've also built an incredible ecosystem around podman itself. Red Hat has been absolutely cooking with containers recently.
reply