Podman, the open source Docker alternative ported to M1 (Apple Silicon) machines

> 3. aarch64 uses UEFI while amd64 don’t need to (I don’t know why)

Sounds like amd64 is falling back to BIOS, while aarch64 never really had any other standard than UEFI. You should be able to run UEFI for amd64 too if you force the machine type to pc-q35-6.1 (or whatever QEMU version you're using).

Docker does this a lot. For example, we were trying to turn off gzipping images on the wire when pulling because it actually cost more when done from the intranet.

You can't. And modifying the source was so convoluted that we gave up.

Then we needed to clean up docker (before there were commands to do that) when it started to eat up all of the disk space.

To our (un)surprise, Docker uses 3 (!!) different storage formats, many of them having redundant information, and editing one of them would cause the other to be corrupted.

One was a binary database format that was specific to Go and didn't have any utility CLI to work with, so you had to write a programmatic interface with it just to edit it.

Or how about the fact that even if you issue commands directly to docker over the HTTP Unix socket, it will deadlock if you issue too many commands to it? This became our nightmare when trying to implement one of the first iterations of custom deployment backends at ZEIT. In fact, the entire project failed because of docker (there was no great alternative at the time).

Fascinating history, is there a PR link for this exchange between Redhat and Docker?

I agree that it should be possible to disable the default registry, but I'm not sure I agree with allowing you to override it. (These requests appear to be conflated in various comments.) Use your own registry by specifying the domain first `myregistry.example.com/repo/image`; an unadorned `repo/image` being globally reserved as shorthand for `registry.docker.io/repo/image` seems fine. Allowing overriding the meaning of `repo/image` would be a support nightmare for both moby and internal IT, just use qualified names.

Every distro had it turned off for ages because turning it on would break docker. So eventually fedora decided docker was never going to added it and turned it on anyway. Then shortly after, docker adds support

Podman has built in support for K8s' Pod definitions. I've never used it so not sure how good (or bad) it is, but it is possible.

It is also able to generate pod definitions from created containers, as well as generate systemd units that you can then enable allowing systemd to manage your pods/containers.

There's also podman-compose, which does exactly what docker-compose does, but with podman.

Docker Desktop can run Windows Containers (or a Linux VM to run Linux containers).

Safe as Open Office is probably a better analogy. MySQL is still very widely deployed. But, yes, your point is very apt!

You can do the same thing for native containers by setting up Server Core VM with Docker Engine and the client on host.

Or if you want to share folders from Windows into Linux containers (you can do it via /mnt/c/ but it's a little more complicated).

It is a common use case for .NET deployments with Kubernetes.

... sure seems like it is: this handles QEMU setup/teardown with hardware virtualization support through Hypervisor.framework according to[0].

[0] https://twitter.com/simnalamburt/status/1434244533001224192

My mistake, I took your usage of QEMU as a shorthand for managing and manipulating VMs, and wanting to use VMware et al due to not wanting to use the “QEMU ecosystem”

Apple’s sandbox focuses on isolating the OS from non-platform binaries. It doesn’t have namespaces or cgroups.

Jailbreaking on iOS is mostly about that sandbox. It doesn’t relate to BSD jails.

On macOS, Apple made the sandbox more lenient and implemented it a bit differently than on iOS. But both have roughly the same goals. They’re also alike in that both use the same kernel-level framework (MACF) to do their job.

But the MACF is completely off-limits to everyone outside Apple. Not even accredited kext developers can use it. So I think that no one except Apple could possibly add container-style isolation to macOS.

As far as I'm aware, macOS' sandbox isn't like the kernel namespaces and cgroups available on Linux.

> Apple does have some form of jails in Darwin

Thinking about the names Apple might call this tech is amusing, with their use of ‘me’ ‘I’ ‘Apple’ etc. I assume ‘Jail’ wouldn’t be in the name.

It exists on macOS but doesn’t support the mount namespacing you’d need to create something like a docker container on macOS.

XNU itself is Mach plus a BSD "personality" taken from FreeBSD[1].

[1] https://developer.apple.com/library/archive/documentation/Da...

They’re VMs. It’s based on the Hypervisor.framework, so it’s actually faster than I thought, but it’s VMs.

But the Docker engine (that runs containers on the local machine) is only available on Mac and Windows via Docker Desktop which is not free-as-in-beer anymore for all.

Does that handle virtualization for you like this does? Is it distributed pre-built anywhere?

I honestly looked just now and couldn't find anything.

That's what VMs are for.

It's perfectly possible to use podman rootless. Presumably docker too, but I only have experience with podman. That is, the podman process does not have root privileges.

Maybe excessive, maybe a good prophylactic for potentially damaging NPM packages (for example) to not get root on my CI infrastructure.

Oh, good call, I wasn't doing this because 1000 is not always the user uid, but it's almost always, and at worst you'll need root to delete the files, thanks!

The current macbook pro 13 with M1 does not differ significantly from the macbook air m1: https://9to5mac.com/2021/09/01/m1-macbook-air-vs-m1-macbook-... . You have one core more and active cooling with fan, but in daily use it is difficult to generate the load that will trigger this cooling. The situation will definitely change with the new Macbook Pro 14/16 to be shown in October or November.

Based on what people that have both say, when the Air would throttle the Pro’s fans become slightly audible.

I also prefer the design of the Air, so it was an easy choice for me.