Hacker News Reader

Comment by chubot | Hacker News Reader

Something like this should definitely exist, just not with Docker!

Podman is better but it's also a bit coupled to a distro - https://news.ycombinator.com/item?id=38981844

The problem is the Linux kernel container primitives are a bit of a mess

bubblewrap is a lot closer, although last I heard it's not in some distros for security reasons - https://news.ycombinator.com/item?id=30823164

View on HN

i think the kernel primitives are fine, unshare and namespaces make perfect sense to me. docker, podman, buildah, buildx, whatever... all these things with cutesy names and fatal flaws seem like the mess to me.

the feature IS the fatal flaw. after unsharing namespace you still want your network to "just work". the "quality"of the solution is directly proportional to how bad the security is.

the scale is non virtualized qemu all the way to docker which will even screw your iptables rules for your convenience. hn crowd falling in the middle as the Goldie locks we all are.

another docker post filled with podman propaganda. despite it all, still no one uses it.

I mean I know several people who run their infra with podman. But it's for personal things, I don't know if there is any level of usage at the enterprise level.

Not enterprise level, but I made a choice of deploying podman at $job rather than docker for a few reasons.

I'll chime in to say that I have started deploying podman over Docker where it's frictionless at $job as well. I'd say half (or more) of my new container deploys are podman.

At home I use only podman because my tinkering doesn't affect anyone but me.

DISCLAIMER: I work for Red Hat. I'm formerly an OpenShift Consultant and SA.

podman has underpinned our Kubernetes distribution, OpenShift, since 4.0 was released in 2019. OpenShift is a $1B+ USD business for us (https://www.newsobserver.com/news/business/article271678707....). You can search and see a sample of who uses it for Enterprise level business.

OpenShift Container Platform uses CRI-O as the container engine and runC or crun as the container runtime. Podman is only directly used for the openshift-installer, but as a container management tool uses the same underlying runtimes. This means they share the same long tenure in production when it comes to using runc. Is that what you meant?

https://docs.openshift.com/container-platform/4.14/nodes/con....

https://docs.podman.io/en/latest/#:~:text=Podman%20relies%20....

The answer is a little bit more nuanced, as the defaults differ. Podman uses crun by default: https://podman.io/docs/installation#:~:text=crun%20%2F%20run.... For OpenShift the use of crun is available as a Technology Preview: https://www.redhat.com/en/blog/whats-new-in-red-hat-openshif... since 4.12. The default for 4.14 is still runC.

Notwithstanding, Podman is gaining a lot of momentum, especially now with Podman Desktop. Disclaimer: I work for Red Hat on the Podman Machine and OpenShift Local/CRC teams to provide integration with Podman Desktop aiming at developer usecases

Podman Desktop sees a lot of increased use in the last few months and the PM has spoken with many of our 'customers' about the future and how they are using podman.

Disclaimer: working at Red Hat as a (tech) manager of the OpenShift Local team, involved on the virtualization targets for Podman Machine and the integration of some of our extensions.

Still a useful alternative to docker and can be packaged in distros

I haven't used docker since ~2017. My clusters run on cri-o, builds are with kaniko, and some of my systems just call runc with OCI container definitions. Docker (especially its API) is a giant mess, and the sooner it's replaced by smaller tools and clear standards the better.

Can attest from $Job that there are podman users. Podman is awesome for some of our RHEL-based systems and we will continue to use it. You are just gonna hear about it a lot, because it's just a runtime.

https://news.ycombinator.com/newsguidelines.html

> Please don't fulminate. Please don't sneer, including at the rest of the community.

I use it and love it. YMMV.

No love for Apptainer/Singularity?

What's that? What's good about it? :)

Reply on news.ycombinator.com