Hacker News Reader

Comment by cabirum | Hacker News Reader

I thought Podman attempts to mimic Docker behavior as close as possible?

What is different in its architecture exactly?

The primary difference is you’ll attempt to use Podman and begrudgingly go back to Docker after banging your head debugging SELinux.

The endless war of usability and security

Ha! My experience exactly, although I have to admit that this was for personal use at home where my patience is usually thin to non-existent. Docker CE on the home server saved me a lot of aggravation, where podman got me wondering if virtual machines were really that bad... Net effect is that I'm back on docker, plus two vm's I stood up during podman's interregnum.

Are you guys the kind of terrible devs who do chmod 777 everypath you walk into? I guess you also put your user account in the docker group.

chmod is much better documented than the vague errors (which are silent or displayed as I/O errors) that podman "gives" you.

No, I usually use sudo with a slightly extended timeout.

By default Podman doesn't have a daemon running as root, although you can opt into it. Podman instead really encourages setting up systemd units to keep your images running.

Podman is very different internally than Docker. It might mimic commands and OCI image standard, but other things are quite different.

Docker is daemon-based and and Podman is not. Podman uses SELinux by default with additional features and other practices for better security. You can use it without root user.

A primary difference is no server component running as root.

Reply on news.ycombinator.com