Fly To Podman: a script that will help you to migrate from Docker

(github.com)

235 points by edu4rdshl350 days ago

23 comments

toprerules350 days ago
Just want to say everyone should be using podman. Its architecture is way more sane and integrates with Linux on a far more basic level (a regular process that can be started via systemd, etc. instead of a root daemon. Run it as root to get privileged containers).They've also built an incredible ecosystem around podman itself. Red Hat has been absolutely cooking with containers recently.
- mati365350 days ago
 Systemd .container services (Quadlet) are excellent. I used them to set up multiple smaller sites without any issues. Containers work just like regular systemd services. I created a small Ansible template to demonstrate how simple yet powerful this solution is.GH: <a href="https://github.com/Mati365/hetzner-podman-bunjs-deploy">https://github.com/Mati365/hetzner-podman-bunjs-deploy</a>
- edwinjones350 days ago
 I agree. I have been using it as a drop in docker replacement alongside podman compose via aliases for years now and I often just forget I am not using docker. The only time it bit me recently is when some scripts were looking for containers with docker specific labels and I had to figure out why they failed only for me.
- koakuma-chan350 days ago
 What are the benefits of using Podman and not Docker?
 - dharmab349 days ago
 From a technical perspective the big two are:- Pod is significantly simpler than Docker, notably Podman doesn't need to run a background process, your containers run directly as separate processes.- Podman avoids some long-standing security design weaknesses in Docker ("rootless"). Docker rootless _is_ a thing but has compatibility limits.
 - powerhugs349 days ago
 Rootless, daemonless, hardware passthrough, no Docker Inc pulling the rug, etc etc
 - osigurdson348 days ago
 If using Kubernetes, Podman's approach allows you to share config with production to a greater extent.
 - krferriter350 days ago
 Licensing. No root daemon.
 - koakuma-chan350 days ago
 Docker Engine is Apache 2.0, is this not a good license? Docker has a rootless mode too.
 - throwaway81523350 days ago
 When you say "Docker Engine" that suggests other parts of Docker are licensed differently (I haven't looked into it). I'd say you have to compare the whole ecosystem and not just a single component either way.
 koakuma-chan350 days ago
 I said "Docker Engine" specifically because it is "Docker Engine" that is the counterpart of Podman, and therefore it is the only component that matters. The discussion here is "Docker" vs "Podman," but "Docker Engine" is what we really mean when saying "Docker."
 cmiles74349 days ago
 Docker Desktop has a much more restrictive license. Unfortunately, on MacOS and Windows, the "Docker Desktop" product is often referred to as simply "Docker".FWIW, Podman has an open source alternative to Docker Desktop as well.
 - pydry349 days ago
 No root daemon got replaced with "but if you want a replacement for docker compose you ought to be using systemd (quadlets)".Meh
 - officialchicken349 days ago
 Incorrect, the use of a non-root daemon is essential for isolation and security.
 pydry349 days ago
 Im fully on board with the idea that root daemons shouldnt be necessary I just dont want systemd to become a dependency for yet again something else it shouldnt be a dependency for.
 powerhugs349 days ago
 Huh, that's another uninformed take.systemd is at it's core an app for running services, such as containers.You should read up on podman and systemd before making up more arguments.
 windexh8er349 days ago
 The point is that RedHat went on a tirade for years telling everyone: "Docker bad, root! Podman good, no root! Docker bad, daemon! Podman good, no daemon!".And then here comes Quadlets and the systemd requirements. Irony at its finest! The reality is Podman is good software if you've locked yourself into a corner with Dan Walsh and RHEL. In that case, enjoy.For everyone else the OSS ecosystem that is Docker actually has less licensing overhead and restrictions, in the long run, than dealing with IBM/RedHat. IMO that is.
 jpeeler349 days ago
 You can run Quadlets under the systemd user session just as well.
 KAMSPioneer349 days ago
 But...you don't need systemd or Quadlets to run Podman, it's just convenient. You can also use podman-compose (I personally don't, but a coworker does and it's reasonable).But yeah I already use a distro with systemd (most folks do, I think), so for me, using Podman with systemd doesn't add a root daemon, it reuses an existing one (again, for most Linux distros/users).
 windexh8er349 days ago
 Exactly my point.Today I can run docker rootless and in that case can leverage compose in the same manner. Is it the default? No, you've got me there.SystemD runs as root. It's just ironic given all the hand waving over the years. And Docker, and all it's tooling, are so ubiquitous and well thought out that Podman and friends are literally a reimplementation which is the selling point.I've used Podman. It's fine. But the arguments of the past aren't as sharp as they originally were. I believe Docker improved because of Podman, so there's that. But to discount the reality of the doublespeak by paid for representatives from RedHat/IBM is, again, ironic.
 amluto349 days ago
 > And Docker, and all it's tooling, are so ubiquitous and well thought out that Podman and friends are literally a reimplementation which is the selling pointI would argue that Docker’s tooling is not well thought out, and that’s putting it mildly. I can name many things I do not like about is, and I struggle to find things I like about it’s tooling.Podman copied it, which honestly makes me not love podman so much. Podman has quite poor documentation, and it doesn’t even seem to try to build actually good designs for tooling.
 windexh8er349 days ago
 Curious what your point is?> I can name many things I do not like about is, and I struggle to find things I like about it’s tooling.Please share.
 amluto349 days ago
 Off the top of my head:FROM [foo]: [foo] is a reference that is generally not namespaced (ubuntu is relative to some registry, but it doesn't say which one) and it's expected to be mutable (ubuntu:latest today is not the same as ubuntu:latest tomorrow).There are no lockfiles to pin and commit dependency versions.Builds are non-reproducible by default. Every default represents worst practices, not best practices. Commands can and do access the network. Everything can mutate everything.Mostly resulting from all of the above, build layer caching is basically a YOLO situation. I've had a build result in literally more than a year out-of-date dependencies because I built on a system that hadn't done that particular build for a while, had a layer cached (by name!), and I forgot to specify a TTL when I ran the build. But, of course, there is no correct TTL to specify.Every lesson that anyone in the history of computing has ever learned about declarative or pure programming has been completely forgotten by the build systems.Why on Earth does copying in data require spinning up a container?Moving on from builds:Containers are read-write by default, not read-only.Things that are logically imports and exports do not have descriptive names. So your container doesn't expose a web service called 'API'; it exposes port 8000. And you need to remember it, and if the image changes the port, you lose, and there is no good way for the tooling to help. Similarly, volumes need to be bound to paths, and there is nothing resembling an interface definition to help get it right. And, since containers are read-write by default, typoing a mount path results in an apparently working container that loses data.The tooling around what constitutes a running container is, to me, rather unpleasant. I can't make a named group of services, restart them, possibly change some of the parts that make them up, and keep the same name in a pleasant manner. I can 'compose down' and 'compose up' them and hope I get a good state. Sometimes it works. And the compose files and quadlets are, of course, not really compatible with each other, nor are they compatible with Kubernetes without pulling teeth.I'm sure I could go on.
 windexh8er349 days ago
 > Builds are non-reproducible by default. Every default represents worst practices, not best practices. Commands can and do access the network. Everything can mutate everything.I think you're conflating software build with environment builds - they are not the same and have different use cases people are after.> Why on Earth does copying in data require spinning up a container?It doesn't.> Containers are read-write by default, not read-only.I don't think you really understand containers since COW is the default. Containers are not "read-write" by default in the context of the underlying image. If you want to block writing to the file system that is trivial.> Things that are logically imports and exports do not have descriptive names. So your container doesn't expose a web service called 'API'; it exposes port 8000. And you need to remember it, and if the image changes the port, you lose, and there is no good way for the tooling to help. Similarly, volumes need to be bound to paths, and there is nothing resembling an interface definition to help get it right. And, since containers are read-write by default, typoing a mount path results in an apparently working container that loses data.Almost all of this is wrong.> And the compose files and quadlets are, of course, not really compatible with each other, nor are they compatible with Kubernetes without pulling teeth.What? This gets wilder as you go on. Why would you expect compose files to be "compatible" with k8s? They are two different ways to orchestrate containers.Pretty much everything you've outlined is, as I see it, a misunderstanding of what containers aim to solve and how they're operationalized. If all of these things were true container usage, in general, wouldn't have been adopted to the point where it's as commonplace as it is today.
 amluto349 days ago
 >> Builds are non-reproducible by default. Every default represents worst practices, not best practices. Commands can and do access the network. Everything can mutate everything.> I think you're conflating software build with environment builds - they are not the same and have different use cases people are after.They're not so different. An environment is just big software. People have come up with schemes for building large environments for decades, e.g. rpmbuild, nix, Gentoo, whatever Debian's build system is called, etc. And, as far as I know, all of these have each layer explicitly declare what it is mutating; all of them track the input dependencies for each layer; and most or all of them block network access in build steps; some of them try to make layer builds explicitly reproducible. And software build systems (make, waf, npm, etc) have rather similar properties. And then there's Docker, which does none of these.> > Containers are read-write by default, not read-only.> I don't think you really understand containers since COW is the default. Containers are not "read-write" by default in the context of the underlying image. If you want to block writing to the file system that is trivial.Right. The issue is that the default is wrong. In a container:<pre><code> $ echo foo >the_wrong_path </code></pre> works, by default, using COW. No error. And the result is even kind of persistent -- it lasts until the "container" goes away, which can often mean "exactly until you try to update your image". And then you lose data.> > Things that are logically imports and exports do not have descriptive names. So your container doesn't expose a web service called 'API'; it exposes port 8000. And you need to remember it, and if the image changes the port, you lose, and there is no good way for the tooling to help. Similarly, volumes need to be bound to paths, and there is nothing resembling an interface definition to help get it right. And, since containers are read-write by default, typoing a mount path results in an apparently working container that loses data.> Almost all of this is wrong.I would really like to believe you. I would love for Docker to work better, and I tried to believe you, and I looked up best practices from the horse's mouth:<a href="https://docs.docker.com/get-started/docker-concepts/running-containers/publishing-ports/" rel="nofollow">https://docs.docker.com/get-started/docker-concepts/running-...</a>and<a href="https://docs.docker.com/get-started/docker-concepts/running-containers/publishing-ports/" rel="nofollow">https://docs.docker.com/get-started/docker-concepts/running-...</a>Look, in every programming language and environmnt I've ever used, even assembly, an interface has a name. If I write a function, it looks like this:<pre><code> void do_thing(); </code></pre> If I write an HTTP API, it has a name, like GET /name_goes_here. If I write a class or interface or trait, its methods have names. ELF files expose symbols by name. Windows IIRC has a weird old system for exporting symbols by ordinal, but it’s problematic and largely unused. But Docker images expose their APIs (ports) by number. The welcome-to-docker container has an interface called '8080'. Thanks.At least the docs try to remind people that the whole mechanism is "insecure by default".I even tried asking a fancy LLM how to export a port by name, and LLM (as expected) went into full obsequious mode, told me it's possible, gave me examples that don't do it, told me that Docker Compose can do it, and finally admitted the actual answer: "However, it's important to note that the OCI image specification itself (like in a Dockerfile) doesn't have a direct mechanism for naming ports."> > And the compose files and quadlets are, of course, not really compatible with each other, nor are they compatible with Kubernetes without pulling teeth.> What? This gets wilder as you go on. Why would you expect compose files to be "compatible" with k8s? They are two different ways to orchestrate containers.I'd like to have some way for a developer to declare that their software can be run with the 'app' container and a 'mysql' container and you connect them like so. Or even that it's just one container image and it needs the following volumes bound in. And you could actually wire them up with different orchestration systems, and the systems could all read that metadata and help do the right thing. But no, no such metadata exists in an orchestration-system-agnostic way.> If all of these things were true container usage, in general, wouldn't have been adopted to the point where it's as commonplace as it is today.Software doesn't look like this. Consider git: it has near universal adoption, but there is a very strong consensus in the community that many of the original CLI commands are really bad.
 windexh8er349 days ago
 > They're not so different. An environment is just big software.Containers are not a software development platform, but a platform that can be used in the build phase of software development. They are very different. Docker is not inherently a software development platform because it does not provide the tools required to write, compile, or debug code. Instead, Docker is a platform that enables packaging applications and their dependencies into lightweight, portable containers. These containers can be used in various stages of the software development lifecycle but are not the development environment themselves. This is not just "big software" - which makes absolutely no sense.> Right. The issue is that the default is wrong. In a container: $ echo foo >the_wrong_pathCan you do incorrect things in software development? Yes. Can you do incorrect things is containers? Yes. You're doing it wrong. If you are writing to a part of the filesystem that is not mounted outside of the container, yes, you will lose your data. Everyone using containers knows this and there are plenty of ways around it. I guess in your case you just always need to export the root of the filesystem so you don't foot gun yourself? I mean c'mon man. It sounds like you'd like to live in a software bubble to protect you from yourself at this point.> If I write an HTTP API, it has a name, like GET /name_goes_here. If I write a class or interface or trait, its methods have names. ELF files expose symbols by name. Windows IIRC has a weird old system for exporting symbols by ordinal, but it’s problematic and largely unused. But Docker images expose their APIs (ports) by number. The welcome-to-docker container has an interface called '8080'. Thanks.You clearly don't understand Docker networking. What you're describing is the default bridge. There are other ways to use networking in Docker outside of the default. In your case, again, maybe just run your containers in "host" networking mode because, again, you're too ignorant to read and understand the documentation of why you have to deal with a port mapping in a container that's sitting behind a bridge network. Again you're making up arguments and literally have no clue what you're talking about.> Software doesn't look like this. Consider git: it has near universal adoption, but there is a very strong consensus in the community that many of the original CLI commands are really bad.OK? Grab a dictionary - read the definition for the word: "subjective", enjoy!
 amluto348 days ago
 > > They're not so different. An environment is just big software.> Containers are not a software development platform, but a platform that can be used in the build phase of software development. They are very different. Docker is not inherently a software development platform because it does not provide the tools required to write, compile, or debug code.You seem to be arguing about something entirely unrelated. GNU make, Portage, Nix, and rpmbuild also don’t provide tools to write, compile, or debug code.> Can you do incorrect things in software development? Yes. Can you do incorrect things is containers? Yes. You're doing it wrong.This is the argument by which every instance of undefined behavior in C or C++ is entirely the fault of the developer doing it wrong, and there is no need for better languages.And yes, I understand Docker networking. I also understand TCP and UDP just fine, and I’ve worked on low level networking tools and even been paid to manage large networks. And I’ve contributed to, and helped review, Linux kernel namespace code. I know quite well what’s going on under the hood, and I know why a Docker container has, internally, a port number associated with the port it exposes.What I do not get is why that port number is part of the way you instantiate that container. The tooling should let me wire up a container’s “http” export to some consumer or to my local port 8000. The internal number should be an implementation detail.It’s like how a program exposes a function “foo” and not a numerical entry in a symbol table. Users calling the function type “foo” and not “17”, even though the actual low-level effect is to call a number. (In a lot of widely used systems, including every native code object file format I’m aware of, the compiler literally emits a call to a numerical address along with instructions so the loader can fix up that address at load time. This is such a solved problem that most programmer, even agency assembly programmers, can completely ignore the fact that function calls actually go to more or less arbitrary numerical targets. But not Docker users — if you want to stick mysql in a container, you need to type in the port number used internally in that particular container.)There are exceptions. BIOS calls were always by number, as are syscalls. These are because BIOS was constrained to be tiny, and syscalls need to work when literally nothing in the calling process is initialized. Docker has none of these excuses. It’s just a handy technology with quite poorly designed tooling, with nifty stuff built on top despite the poor tooling.
 windexh8er348 days ago
 > Why is the port number part of the way you instantiate the container?Because that’s how networking works in literally every system ever. Containers don’t magically "export" services to the world. They have to bind to a port. That’s how TCP/IP, networking stacks, and every server-client model ever designed functions. Docker is no exception. It has an internal port (inside the container) and an external port (on the host), again, when we're dealing with the default bridge networking. Mapping these is a fundamental requirement for exposing services. Complaining about this is like whining that you have to plug in a power cable to use a computer. Clearly your "expertise" in networking is... Well. Another misunderstanding.> The tooling should let me wire up a container’s 'http' export to some consumer or to my local port 8000.Ummmm... It does. It's called: Docker Compose, --network, or service discovery. You can use docker run -p 8000:80 or define a Docker network where containers resolve each other by name. You already don’t have to care about internal ports inside a proper Docker setup.But you still need to map ports when exposing to the host because… Guess what? Your host machine isn't psychic. It doesn’t magically figure out that some random container process running an HTTP server needs to be accessible on a specific port. That’s why port mapping exists. But you already know this because "you understand TCP and UDP just fine".> The internal number should be an implementation detail.This hands-down the dumbest part of the argument. Ports are not just "implementation details." They're literally how services communicate. Inside the container, your app binds to a port (usually one) that it was explicitly configured to use.If an app inside a container is listening on port 5000, but you want to access it on port 8000, you must declare that mapping (-p 8000:5000). Otherwise, how the hell is Docker (or anyone) supposed to know what port to use? According to you - the software should magically resolve this. And guess what? You don’t have to expose ports if you don’t need to. Just connect containers via a shared network which happens automagically via container name resolution within Docker networking.Saying ports should be an "implementation detail" is like saying street addresses should be an implementation detail when mailing a letter. You need an address so people know where to send things. I'm sure you get all sorts of riled up when you need to put an address on a blank envelope because the mail should just know... Right? o_O
 amluto348 days ago
 I feel like we're talking right past each other or something.Of course every TCP [0] and UDP networking system ever has port numbers. And basically every CPU has calls functions with numeric addresses. And you plug in power cables to use a computer. Of course Docker containers internally use ports -- if I have a Docker image plus its associated configuration, and I instantiate it as a container, and it uses its internal port 8080 to expose HTTP, then it uses a port number.But this whole conversation is about Docker's tooling, not about the underlying concept of containers.And almost every system out there that has decent tooling has abstraction layers to make this nicer. In AT&T assembly language, I can type:<pre><code> 1: ... code goes here </code></pre> and that code is called "1" in that file and is inaccessible from outside. If I want to call it from outside, I type something more like:<pre><code> name_of_function: ... code goes here </code></pre> with maybe a .globl to go along with it. And I call it by typing a name. And that call still calls the numeric address of that function.If I plug in a power cable to use a computer, I do not plug it into port 3 on the back of the computer, such that accidentally plugging it into port 2 will blow a fuse. I plug it into a port that has a specific shape and possibly a label.So, yes, I know that "If an app inside a container is listening on port 5000, but you want to access it on port 8000, you must declare that mapping (-p 8000:5000)", but that's not a good thing. Of course, if it's listening on port 5000, I need to map 8000 to 5000. But the fact that I had to type -p 8000:5000 is what's broken. The abstraction layer is missing. That should have been -p 8000:http or something similar.And the really weird thing is that the team that designed Dockerfile seemed to have an actual inkling that something was needed here, which is why we have:<pre><code> EXPOSE 8080 VOLUME ["/mnt/my_data"] </code></pre> but they completely missed the variant that would have been good:<pre><code> EXPOSE 8080 "rest_http" VOLUME "mydata" MANDATORY MOUNT_VOLUME "mydata" "/mnt_mydata" </code></pre> or whatever other spelling of the same concept would have passed muster.And yes, Docker Compose helps, but that's at the wrong layer. Docker Compose is a consumer of a container image. The mapping from logical exposed service to internal port should have been handled at an abstraction layer below Docker Compose, and Compose and Quadlet and Kubernetes and the command line could all share that abstraction layer.> ... service discovery. You can use docker run -p 8000:80 or define a Docker network where containers resolve each other by name. You already don’t have to care about internal ports inside a proper Docker setupCan you point me at some relevant reference? Because, both in my experience and from (re-)reading the basic docs, all of the above is about finding an IP address by which to communicate with a relevant service, not about port numbers, let alone internal port numbers (which are entirely useless to discover from inside another container, because you can't use them there anyway). Even Docker Swarm does things like:<pre><code> $ docker service create ... --publish published=8080,target=80 </code></pre> and that's another site, external to the container image in question, where one must type in the correct internal port number.> I'm sure you get all sorts of riled up when you need to put an address on a blank envelope because the mail should just know... Right? o_OI will take this the most charitable way I can. Sure, it's mildly annoying that you have to use someone numerical phone number to call them, and we all have contact lists to work around this, but that's still missing the target. I'm not complaining about how you address a docker container, and it makes quite a bit of sense that you need someone's phone number to call them. But if you had to also know that that particular phone you were calling had its microphone on port 83 and you had you tell your phone that their microphone was port 83 if you wanted to hear them and you had to change your contact list if they changed phone models, then I think everyone would be rightly annoyed.So I stand by my assertion: Docker's tooling is not very good.[0] But not every networking protocol ever. Even in the space of non-obsolete protocols, IP itself has no port numbers. And the use of a tuple (name or IP, port) is actually a perennial source of annoyance, and people try to improve it periodically, for example with RFC 2782 SRV records and, much more recently, RFC 9460 SVCB and HTTPS records. This is mostly off-topic, as these are about externally visible ports, and I’m talking about internal port numbers.
 bdhcuidbebe349 days ago
 systemd runs as root yes, but services started by systemd dont unless you instruct them to.that means your podman containers dont run as root unless you want them to.mine runs as user services
 windexh8er349 days ago
 I don't see your point. This is exactly how Docker works. Containers that are running when instantiated from the Docker daemon don't need to be run as root. But you can... Just like your containers started from SystemD (quadlet).I run all my containers, when using Docker, as non-root. So where is the upside other than where your trust lies?
 bdhcuidbebe348 days ago
 > So where is the upside other than where your trust lies?The upside is political rather than technical, in that Docker signalef multiple times before they happily will pull the rug for developers.Moving away from that is the driving motivation for using podman. The fact that podman happens to be better engineered is just added bonus.
 pydry349 days ago
 Have you used podman compose? It's shit.When I bring this up online the answer is invariably "well use quadlets then" (i.e. systemd).>systemd doesn't add a root daemon, it reuses an existing onelol the same could be said of every docker container ive ever run....
 pydry349 days ago
 Quadlets is systemd. Red hat declared it to be the recommended/blessed way of running containers. podman compose is treated like the bastard stepchild (presumably because it doesnt have systemd as a dependency).Please try to understand the podman ecosystem before lashing out.
 KAMSPioneer349 days ago
 Podman runs on FreeBSD without systemd, so there you go.
 pydry349 days ago
 yeah, it runs fine without systemd, until you need a docker compose substitute and then you get told to use quadlets (systemd), podman compose (neglected and broken as fuck) or docker compose (with a daemon! also not totally compatible) or even kubernetes...
 - officialchicken349 days ago
 Process isolation
- curt15349 days ago
 I understand that k8s uses containerd or similar daemons to run containers. Do podman's criticisms of docker also apply to k8s?
 - dharmab348 days ago
 No. K8s runs containers in a way very similar to Podman. Podman is like a middle point between the simplicity of containerd and the feature set of the Kubernetes Kubelet.
- throwaway984393350 days ago
 [dead]
- user3939382349 days ago
 Until it’s supported by AWS ECS it’s not relevant for me since that’s what my container builds are for.
 - dharmab349 days ago
 Images built by Podman can be run by Docker and vice versa.
Nezteb350 days ago
Protip: if you want to use Podman (or Podman Desktop) with Docker Compose compatibility, you'll have a better time installing podman-compose [1] and setting up your env like so:<pre><code> alias docker=podman # If you want to still use Docker Compose # export PODMAN_COMPOSE_PROVIDER=docker-compose # On macOS: `brew install podman-compose` export PODMAN_COMPOSE_PROVIDER=podman-compose export PODMAN_COMPOSE_WARNING_LOGS=false </code></pre> Most of my initial issues transitioning to Podman were actually just Docker (and Docker Desktop) issues.Quadlets are great and Podman has a tool called podlet [2] for converting Docker Compose files to Quadlets.I prefer using a tool like kompose [3] to turn my Docker Compose files into Kubernetes manifests. Then I can use Podman's Kubernetes integration (with some tweaks for port forwarding [4]) to replace Docker Compose altogether![1] <a href="https://github.com/containers/podman-compose">https://github.com/containers/podman-compose</a>[2] <a href="https://github.com/containers/podlet">https://github.com/containers/podlet</a>[3] <a href="https://github.com/kubernetes/kompose">https://github.com/kubernetes/kompose</a>[4] <a href="https://kompose.io/user-guide/#komposecontrollerportexpose" rel="nofollow">https://kompose.io/user-guide/#komposecontrollerportexpose</a>
- pydry349 days ago
 podman compose is really bad
 - akvadrako349 days ago
 Indeed, it has a lot of limitations. It's better to use docker compose with a podman socket.
 - Nezteb348 days ago
 Interesting; I have yet to run into any issues with it. Teams I work with mostly use it for local development/testing and do actual deploys using Kubernetes, so we don't use Docker Compose for deployments that utilize features unavailable in Podman Compose.I'll try to do some more testing between the two and edit my original comment with my findings!
 - pydry348 days ago
 Or just use docker until podman compose gets fixed.After all the whole point was supposed to be that it didnt need a daemon.
 - SomeoneOnTheWeb349 days ago
 How so? What problems do you have with it?
 - pydry349 days ago
 Missing features, lots of debugging spam which cant be turned off, doesnt properly adhere to the compose spec...
 - Nezteb348 days ago
 Which features specifically? I can't find a conclusive list anywhere. Other than searching GH issues for bugs like: <a href="https://github.com/containers/podman-compose/issues/655#issuecomment-2294584596">https://github.com/containers/podman-compose/issues/655#issu...</a>RE debugging spam, the only thing I can think you're referring to can be turned off by setting `export PODMAN_COMPOSE_WARNING_LOGS=false`.I'm also curious how it doesn't adhere to the spec. I don't doubt you, but it'd be cool if there was a test suite or audit tool that could document that.
 pydry345 days ago
 I havent tried in a while so I just tried my project again and ran into one missing feature straight away: podman-compose cpIt's basic shit like this which they could fix very easily but I think they just want to push you to use quadlets (systemd).
 - DrBenCarson349 days ago
 It never works on first go, constantly debugging and breaking
lbhdc350 days ago
Last year I transitioned all of my personal projects to use podman. The biggest surface area was converting CI to use podman to build my docker files, but also changed out tooling to use it (like having kind use it instead of docker).For the most part this worked without issue. The only snag I ran into was my CI provider can't use oci formatted images. Podman lets you select the format of image to build, so I was able to work around this using the `--format=docker` flag.
- mariusor350 days ago
 Same here. I migrated maybe 5-6 projects from docker to buildah and podman about 2 years ago and never looked back.Unlike other posts I've seen around I haven't really encountered issues with CI or local handling of images - though I am using the most bare bones of CI, SourceHut. And I actually feel better about using shell scripts for building the images to a Dockerfile.
 - lbhdc350 days ago
 Oh hey! I have used your activity pub library, it's very nice :)
 - mariusor349 days ago
 Thank you. :) I'm still working on it, dare I say it maybe even getting closer to a stable release.
- codelion350 days ago
 That's a pretty cool migration story! I've been meaning to give podman a more serious look. The OCI image format issue is good to know about – hadn't considered that compatibility angle. I'm curious, did you notice any performance differences in your CI builds after switching?
 - lbhdc350 days ago
 Its been a while, so all my telemetry has since expired, but there was no meaningful difference in time.I was prepared to roll it all back, but I never ended up running into problems with it. It's just something that happens in the background that I don't have to think about.
 - jmholla349 days ago
 Yea, I was under the impression docker uses OCI containers these days and not their own custom definition. But I may be ill-informed.
- LEARAX350 days ago
 I would love to know more details about your CI setup. I'm running all of my self-hosted services as Quadlets (which I generally really love!) and CI (using Gitea) was/is a huge pain point.
 - lbhdc349 days ago
 I have a simple setup on GCP. I am using Cloud Build with the companion Github app to trigger builds on branch updates.I like it because I am deploying to GCP, and storing containers in Artifact Registry. Cloud Build has good interop with those other products and terraform, so its pretty convenient to live with.The pipelines themselves are pretty straight forward. Each step gets an image that it is executed in, and you can do anything you want in that step. There is some state sharing between steps, so if you build something in one step, you can use it in another.
 - qudat349 days ago
 I do a lot of self hosting as well and relegated to git post receive hook that sends events through <a href="https://pipe.pico.sh" rel="nofollow">https://pipe.pico.sh</a> and then have a script that listens on that topic and builds what I need.
- mikedelfino350 days ago
 Are you pulling base images from Docker Hub, or do you build all images from source from scratch?
 - lbhdc350 days ago
 I am pulling from a few registries, but trying to move everything to a private registry.In podman, you have to use the "full path" to work with docker hub. Eg `docker.io/library/nginx`.
jjice350 days ago
Has Podman become more user friendly in recent years? I gave it a go about three or four years ago now when Docker began their commercial push (which I don't have an issue with).This was for some hobby project, so I didn't spend a ton of time, but it definitely wasn't as set-and-forget as Docker was. I believe I had to set up a separate VM or something? This was on Linux as the host OS too. It's been a while, so apologies for the hazy memory.Or it's very possible that I botched the entire setup. In my perfect world, it's a quick install and then `podman run`. Maybe it's time to give it another go.
- rsolva350 days ago
 Definitely more user friendly, and I love using Quadlets! For people using Flatpaks (Linux), check out the app 'Pods' as a lightweight alternative to Podman Desktop. It is still a young project, but is already a very useful way of managing your containers and pods.As a side note, it is so _refreshing_ to observe the native apps popping up for Linux lately, it feels like a turning point away from the Electron-everything trend. Apps are small, starts immediately and is well integrated with the rest of the system, both functionally and visually. A few other examples of native apps; Cartero, Decibels, GitFourchette, Wike – to name a few that I'm using.
- seemaze350 days ago
 I've found it very straight forward to work with. I run the cli on macOS to spin up ephemeral containers all the time for testing and simple tasks. Never had an issue.In the spirit of the OP, I also run podman rootless on a home server running the usual home lab suspects with great success. I've taken to using the 'kube play' command to deploy the apps from kubernetes yaml and been pleased with the results.
- IshKebab350 days ago
 It's almost a perfect drop-in replacement for Docker so I don't see why it would be any less "set-and-forget".I only ever found one thing that didn't work with it at all - I think it was Gitlab's test docker images because they set up some VMs with Vagrant or something. Pretty niche anyway.
 - bigstrat2003350 days ago
 The one edge case I know of (and have run into) is that podman push doesn't support the --all-tags flag. They have also said they do not plan to implement it. It's annoying because that flag is useful for CI scripts (we give multiple tags to the same build), but not the end of the world either.
 - moogly350 days ago
 I could not get LocalStack to work on Podman, to my chagrin. And no, doing the "sudo touch /etc/containers/nodocker" thing didn't solve it.
 - mdaniel349 days ago
 <pre><code> podman version podman pull public.ecr.aws/localstack/localstack:4.1 podman run --detach --name lstack -p 4566:4566 public.ecr.aws/localstack/localstack:4.1 # sorry, I don't have awscli handy export AWS_DEFAULT_REGION=us-east-1 AWS_ACCESS_KEY_ID=alpha AWS_SECRET_ACCESS_KEY=beta $HOMEBREW_PREFIX/opt/ansible/libexec/bin/python -c ' import boto3 sts = boto3.client("sts", endpoint_url="http://localhost:4566") print(sts.get_caller_identity()) ' {'UserId': 'AKIAIOSFODNN7EXAMPLE', 'Account': '000000000000', 'Arn': 'arn:aws:iam::000000000000:root', ... </code></pre> I'll spare you the verbosity but<pre><code> 2025-02-22T18:51:56.427 INFO --- [et.reactor-0] localstack.request.aws : AWS s3.CreateBucket => 200 2025-02-22T18:52:14.332 INFO --- [et.reactor-0] localstack.request.aws : AWS s3.PutObject => 200 cat > sample-stack.yaml <<'YAML' AWSTemplateFormatVersion: 2010-09-09 Resources: Iam0: Type: AWS::IAM::Role Properties: RoleName: Iam0 ManagedPolicyArns: - arn:aws:iam::aws:policy/AdministratorAccess AssumeRolePolicyDocument: Principal: AWS: Ref: AWS::AccountId Effect: Allow Action: sts:AssumeRole YAML create_stack_command_goes_here 2025-02-22T18:55:02.657 INFO --- [et.reactor-0] localstack.request.aws : AWS cloudformation.CreateStack => 200 </code></pre> ---ed: ah, I bet you mean the lambda support; FWIW they do call out explicit support for Podman[1] but in my specific setup I had to switch it to use -e DOCKER_HOST=tcp://${my_vm_ip}:2375 and then $(podman system service tcp://0.0.0.0:2375) in the lima vm due to the podman.sock being chown to my macOS UID. My life experience is that engineering is filled with this kind of shitI used <a href="https://github.com/aws-samples/aws-cloudformation-inline-python-lambda-example/blob/main/base-cfn-lambda.yml">https://github.com/aws-samples/aws-cloudformation-inline-pyt...</a> to end-to-end test it1: <a href="https://github.com/localstack/localstack/blob/v4.1.1/localstack-core/localstack/utils/container_utils/docker_sdk_client.py#L52">https://github.com/localstack/localstack/blob/v4.1.1/localst...</a>
 - adenner350 days ago
 In fact, there is even a package "podman-docker" that will alias podman to docker so most of your commands will usually work without modification. (of course, there are always the edge cases)
- sieve350 days ago
 It is not user-friendly, but it works flawlessly once you get used to it.I stayed away from docker all these years and tried podman from scratch last year after docker failed to work for a project I was experimenting with.Took an hour to read various articles and get things working.One thing I liked was it does not need sudo privileges or screw with the networking.
 - butshouldyou348 days ago
 May I ask what issue you ran into with Docker? I'm interested in Podman simply because I'm curious, but I can't think of any reason to move away from Docker besides that.
 - sieve346 days ago
 It's been a while. I think it was the privilege issue more than anything. And as it was a fresh start for me, I decided to pick podman.If docker works for you, I think you should continue with it.
- evilduck350 days ago
 This is mostly solved I think. I run Podman Desktop on macOS and just aliased Docker to Podman in zshrc and it just works for me. I don’t do any local k8s or anything crazy, but it works with my compose files. I’m going to guess there’s still rough edges if you want GPU passthrough or something with complex networking, but for a server and a database running together it matches Docker itself.
- h14h350 days ago
 The biggest difference in my (admittedly limited) experience, is that you need to start a "podman machine" before you can start running containers. This is architecturally different from Docker's use of a daemon, in ways I'm not qualified to explain in more detail.It's an extra step, but not a painful one -- the default podman machine configuration seems to work pretty well out of the box for most things.Honestly, for my use-case (running Subabase stack locally), it was seamless enough to switch that I'm a little surprised a bash script like this is necessary. On my Mac, I think it was simply `brew install podman` followed by `podman machine start` and then I got back to work as if I were still using docker.By far the most tedious part of the switch was fully uninstalling Docker, and all its various startup programs & background processes.
 - stryan350 days ago
 Podman only requires `podman machine` if you're using a non-Linux system; this sets up a Linux VM in the background that all the actual containers run on. Docker does the same thing, though I think it sets it up for you automatically.
- johnbrodie350 days ago
 Hasn't become more friendly from what I've seen. The project seems largely centered around K8s, and isn't really investing in fixing anything on the "compose" side. I did the same thing as you when Docker first started going down the more commercial path, and after dealing with random breakages for a number of years, fully switched back to Docker (for local dev work on osx).Podman machine is fine, but occasionally you have to fix things _in the vm_ to get your setup working. Those bugs, along with other breakages during many upgrades, plus slower performance compared to Docker, made me switch back. This is just for local dev with a web app or two and some supporting services in their own containers via compose, nothing special. Totally not worth it IMO.
- mixedCase350 days ago
 On NixOS it was as trivial as `podman.enable = true;`. IIRC on Arch it was just a matter of installing the package.It's all daemonless, rootless and runs directly with your host kernel so it should be as simple as it an application of this kind gets. Probably you followed some instructions somewhere that involved whatever the podman equivalent for docker-machine is?
- bjoli350 days ago
 The only snag I hit regularly is me forgetting to set :z or :Z on my podman volumes to make it play well with SELinux.I used to use docker compose, but migrated to podman quadlets. The only thing I miss is being able to define every container I run in a pod in the .pod file itself. Having it integrate with systemd is great.
- ijustlovemath350 days ago
 My container using is admittedly pretty simplistic (CRUD app with some REST services), but after initial setup I've found it to be extremely reliable and simple to use. They strive for 1:1 docker compat so I think it should be pretty easy to migrate.
osigurdson350 days ago
Podman is interesting as well because it can run Kubernetes yamls (to a small extent) which can be handy.
- vaylian350 days ago
  With the command `podman kube play file.yaml`
- moondev349 days ago
  Launching Kubernetes pods without a kube-apiserver. The kubelet can run in standalone mode and launch static pods as well, but I don't believe it supports deployment manifests like podman does. Pretty handy.
evantbyrne350 days ago
Does Podman have a swarm counterpart, or does running services still effectively require configuring systemd and then switching to kubernetes for multi-machine?
- hylaride350 days ago
 Last I checked there's no native swarm equivalent in podman. Your best bet is nomad (much simpler than k8s if you want to spin some local setups) or kubernetes.
 - kitd350 days ago
 kubernetesPodman can work with local pods, using the same yaml as for K8s. Not quite docker swarm, but useful for local testing IME when k8s is the eventual target.
 - evantbyrne350 days ago
 Eh, starting with k8s just because I might want kubernetes in five years is a hard sell, given how easy swarm is to setup. devops that does not fulfill an immediate business need should be delayed because that labor is hella expensive.
- KronisLV349 days ago
 It doesn't, which to me seems like a bummer.Docker Compose is really great for multi-container deployments on a single machine. And Docker Swarm takes that same Compose specification (although there were historical differences) and brings it over to clusters, all while remaining similarly simple. I'm surprised that ourside of Docker Swarm, Nomad or lightweight Kubernetes distros like K3s there haven't been that many attempts at simple clustering solutions. Even then, Kubernetes (which Podman supports) ends up being more complex.
- Spivak350 days ago
 No to the first, yes to the second. Podman has a daemon mode that works like like the Docker daemon, no systemd necessary.
 - keeperofdakeys350 days ago
 > Podman has a daemon mode ...Can you provide any documentation about that?
 - stryan350 days ago
 They're probably referring to the podman.socket, which isn't quite like a daemon-mode but means it can emulate it pretty well. Unless there is some daemon mode I missed that got added, but I'd be rather surprised at that.
 - Spivak350 days ago
 Yep!<a href="https://docs.podman.io/en/latest/markdown/podman-system-service.1.html" rel="nofollow">https://docs.podman.io/en/latest/markdown/podman-system-serv...</a>In places where you're doing a `dnf install podman` all you typically need to do is start the service and then point either the podman cli or docker cli directly at it. In Fedora for example it's podman.service.I honestly prefer using the official docker cli when talking to podman.
mdaniel349 days ago
On the off chance it matters to anyone, brew whines that podman requires macOS 13.x due to <a href="https://github.com/containers/podman/issues/22121">https://github.com/containers/podman/issues/22121</a> but that's only for $(podman machine start) support, which relies on <a href="https://github.com/crc-org/vfkit/issues/37">https://github.com/crc-org/vfkit/issues/37</a>If you already have colima lying around, that means you have lima and lima ships with both podman and podman-rootful templates:<pre><code> limactl create --name=proot template://podman-rootful --vm-type=qemu --cpus=4 --memory 4 --disk 20 # it will emit the instructions at the end, but for context podman system connection add lima-proot "unix:///$HOME/.lima/proot/sock/podman.sock" podman system connection default lima-proot podman version # <-- off to the races</code></pre>
dminik350 days ago
To mirror some of the other comments here: I've had decent success in using podman for my local dev setup (postgres, redis, ...).I did run into one issue though. Rootless mode isn't supported (or at least easy to setup) when the user account is a member of an active directory (or whatever Linux equivalent my work laptop is running).Though root mode works, I can't use podman desktop and I have to sudo every command.
powerhugs349 days ago
I went with podman in 2020 when docker acted out last time and haven't looked back since.
vivzkestrel350 days ago
just a pro tip "if it aint broken dont fix it" if you have a working docker file(s) do not migrate unless there is a ground breaking need
- natebc349 days ago
  Podman and Buildah consume Dockerfiles perfectly fine. Have you come across a scenario where Dockerfile contents were a concern?
- exceptione350 days ago
  Security might be such a need, but that depends on how important that is for you. On top, docker auto-fiddles with your firewall.
whalesalad350 days ago
If you are using docker in this carefully assembled stateful way - you are doing it wrong. You should be using docker via scripts and IaaS tooling that will assert your desired setup from some kind of configuration. Meaning, you should be able to easily blow all of that away and recreate it with a single script. Likewise, a transition to podman should involve adjusting your scripts to re-assert that plan against podman instead of docker.This is a cool tool for the decrepit hand-configured server with no documentation that has been running since 2017 untouched and needs an update... but I would encourage you to not fall into this trap to begin with.
- pinoy420350 days ago
 Yeah in theory. In practice that never happens for anything other than a vercel app.
deskamess350 days ago
What's the podman UX/story on Windows if anyone is using it? Say for Server 2022 (prod) and Win 11 Pro (dev).Does one prefer using WSL2 or Hyper-V as the machine provider? From what I understand, podman provides the container engine natively so nothing additional is required. Do container runtimes like containerd only come into play when using kubernetes? Not a windows specific question, but is there a reason to pick a podman native container vs one in a k8s context. I understand podman supports k8s as well. Other info: No current containers (docker or k8s) are in play.Thanks in advance.
- woodrowbarlow350 days ago
 on windows, rancher desktop + podman offers a similar experience to docker desktop.
DrBenCarson349 days ago
This is fine for Linux users and the actual servers, but for local development on a Mac, you cannot beat Orbstack (imo)
JamesSwift350 days ago
I've not looked into podman but this reminded me that I miss rkt. Anyone with experience in rkt and podman able to give me an overview of how they currently differ? I'm not a huge fan of how docker works, so I'd love an alternative.
- jchw350 days ago
 I went from rkt to podman. Podman is compatible with Docker, including the socket/API, but is similar to rkt in that it launches the container as a child when ran directly (versus Docker, which runs all containers and storage operations under the daemon). Podman also has integration with systemd[1] though it mostly just generates boilerplate for you, since it works a lot closer to how actual daemons work. (P.S.: You might want `--new` if you want a new container each time the unit starts.)Podman also supports running in "rootless" mode, using kernel.unprivileged_userns_clone and subuid/subgids for the sandboxing and slirp4netns for the networking. This obviously isn't exactly the same as rootful networking, but it works well enough for 99% of the use cases.If you are running Linux, I think using Podman instead of Docker is generally a no-brainer. I think the way they've approached rootless support is a lot better than Docker and things "just work" more often than not.[1]: <a href="https://docs.podman.io/en/latest/markdown/podman-generate-systemd.1.html" rel="nofollow">https://docs.podman.io/en/latest/markdown/podman-generate-sy...</a>
morcus350 days ago
Podman looks cool, is there any equivalent of Watchtower (<a href="https://containrrr.dev/watchtower/" rel="nofollow">https://containrrr.dev/watchtower/</a>) for Podman?
- xrisk350 days ago
 It’s in-built: <a href="https://docs.podman.io/en/latest/markdown/podman-auto-update.1.html" rel="nofollow">https://docs.podman.io/en/latest/markdown/podman-auto-update...</a>
- okl350 days ago
 GitHub issue for podman support, here: <a href="https://github.com/containrrr/watchtower/issues/1060">https://github.com/containrrr/watchtower/issues/1060</a>
DrNosferatu349 days ago
What about Singularity?And while we’re at it, what’s your favorite non-sudo Docker alternative? And why?
- DrNosferatu349 days ago
 …or Apptainer?
rubenv349 days ago
Only thing I really miss is good Podman support in Skaffold.
kalaksi350 days ago
What if I'm using docker-compose?
- darrenf350 days ago
 Use podman-compose?<a href="https://docs.podman.io/en/latest/markdown/podman-compose.1.html" rel="nofollow">https://docs.podman.io/en/latest/markdown/podman-compose.1.h...</a><a href="https://github.com/containers/podman-compose">https://github.com/containers/podman-compose</a>
 - boudin350 days ago
 Or just use docker compose with podman. There's a section in arch's doc about that <a href="https://wiki.archlinux.org/title/Podman" rel="nofollow">https://wiki.archlinux.org/title/Podman</a>
- Cyph0n350 days ago
 Enable the Podman socket and have it alias the Docker socket.Shameless plug: Alternatively, if you are on NixOS, you can just use compose2nix.<a href="https://github.com/aksiksi/compose2nix">https://github.com/aksiksi/compose2nix</a>
 - kalaksi350 days ago
 I actually am, but want to keep configs more distro agnostic.
 - Cyph0n350 days ago
 Your Docker Compose file remains the source of truth, so there is no “lock-in”. That’s the beauty of config generation :)
 - kalaksi349 days ago
 Good to know!
- tengbretson350 days ago
 There are options, but my experience has not exactly been positive.
- edu4rdshl350 days ago
 You can continue using `docker-compose` (the provider) with `podman compose`. It's the default provider if installed.
gdevenyi349 days ago
I can't use podman until they start releasing up to date packages for all systems I use.Have they started releasing packages yet?
- DistractionRect349 days ago
 They offer packages but if you're on a point release distro you'll want to build it from source.On my Debian box, I build the podman release target in a chroot, extract the archive in /opt/, and use stow to install/uninstall the package. You'll also want the latest crun, but which I also place in stow and install with stow.
- worthless-trash349 days ago
 Not enough data provided. Packages exist for systems.
vednig350 days ago
Just read the source code.Script does almost all of the things required for the "existing docker containers", migrating networks, blocks, restart mech,etc, that leaves out just one thing migrating any other third party script utilizing docker to podman based instructions. This would highly improve the experience. Goodluck
pinoy420350 days ago
Why do people consistently like to make their lives harder in software engineering?
- passivegains350 days ago
 programmers ("developers," if you prefer) have trouble with "second order" thinking. we integrate X technology in Y way, maybe with some Z optimization, and that'll solve the problem.okay, but, like... will it?is there new maintenance stuff you've completely ignored? (I've noticed this is more common when maintenance is someone else's job.) is it completely new and none of us know about it so we get blindsided unless everything goes exactly right every time? do we get visibility into what it's doing? can we fix it when (not if, when) it breaks? can everyone work on it or is it impossible for anyone but the person who set it up? they're good at thinking up things that should fix the problem but less good at things that will.I'm a fan of cross-functional feature teams because others in the software engineering ecosystem like QA, systems people, ops, etc. tend not to have this problem. programmers are accountable to the other stakeholders up front, bad ideas are handled in real time, and- this is the most important part- everyone learns. (I won't say all systems people are cantankerous bastards... but the mistakes they've harangued me for are usually the mistakes I don't make twice.)
MrThoughtful350 days ago
I never tried Podman. I guess the benefit is that it runs on demand and not as a always on demon?How does one install podman on Debian and how does one get a Debian image to run inside podman?
- pzmarzly350 days ago
 Runs on demand, doesn't require root, can be nested, usually uses newer and simpler primitives (e.g. a few nftables rules in Podman vs iptables spaghetti in Docker). In my experience it is ~90% compatible with Docker. The author explains the practical differences in the blog post <a href="https://www.edu4rdshl.dev/posts/from-docker-to-podman-full-migration-to-rootless/" rel="nofollow">https://www.edu4rdshl.dev/posts/from-docker-to-podman-full-m...</a>It is usually easier to install - most distros ship relatively recent version of Podman, while Docker is split between docker.io (ancient), docker-ce (free but non in repos) and docker-ee.Not everything is rosy, some tools expect to be talking to real Docker and don't get fooled by `ln -s docker podman`. But it is almost there.Regarding Debian, just `sudo apt install podman && podman run -it debian` - see <a href="https://wiki.debian.org/Podman" rel="nofollow">https://wiki.debian.org/Podman</a>
 - wink350 days ago
 Careful, the version in Debian 12 is old and apparently just barely predates the "good" versions.I had so many problems that I went back to Docker, because current Podman didn't seem to be trivially installable on Debian 12.
 - exceptione350 days ago
 In general, if one is happy to run very old versions of software Debian can be your driver. If not, you are in for pain in my experience. (That is also why Ubuntu as default Linux is a tragedy, old bugs and missing features mean that it is not really attractive to officially support Linux for vendors.)
 - wink350 days ago
 I've not experienced something on this scale for many years, "Debian stable packages are so outdated" is mostly a meme. Debian 12 was 1y old when I did this and very often you can relatively easily find a backport or build one - but I think in this case it was either glibc or kernel, that's why "just run upstream" didn't work.
 WD-42350 days ago
 What’s the point of using a distribution if you need to find back ports or build your own? Distros are, after all, mostly collections of installable software.
 wink350 days ago
 The point is that it works 95% of the time, or probably more like 98%.If this is a e.g. webserver and I only need my fastcgi backend built by myself, I can still have reverse proxy, database, and every other package be done by the distro.No one said you need backports. More like: If it fits 90% and one package doesn't work, you get it from somewhere else - that doesn't invalidate the concept of a distro for me. YMMV
 exceptione350 days ago
 Honest question: wouldn't that make you more nervous you now arrived at an unknown/unsupported configuration?Boring stability is the goal, but if Debian does not fit as is, then why not find a total package that is somewhat more cutting edge but does fit together? Especially given the fact that Debian does customization to upstream, so esoteric times esoteric.
 wink350 days ago
 It doesn't make me nervous because Debian has only let me down a couple of times over nearly 20 years and for example Ubuntu und RHEL and SLES have let me down dozens of times each.Also I don't usually run "supported". I just run a system that fits my needs.
 exceptione350 days ago
 Thanks for following up. Yeah, I should rather have said "tested/vetted".
 vq349 days ago
 I maintain a couple of Debian servers and this is how I do it too.Reverse proxy, DB, etc from Debian. The application server is built and deployed with nix. The Python version (and all the dependencies) that runs the application server is the tagged one in my nix flake which is the same used in the development environment.I make sure that PostgreSQL is never upgraded past what is available in the latest Debian stable on any on the dev machines.
 - righthand350 days ago
 I did not have this same experience, all my VPS successfully run Debian’s podman package with zero issue running containers.
 - wink350 days ago
 Glad to hear. When I brought it up somewhere I got exact the "oh you're running 4.x - we also had that problem, but 5 works fine".
- natebc350 days ago
 1) Podman is available in default debian repos. <a href="https://packages.debian.org/bookworm/podman" rel="nofollow">https://packages.debian.org/bookworm/podman</a>2) `podman run --entrypoint="" --rm -it debian:stable /bin/bash`in most instances you can just alias docker to podman and carry on. It uses OCI formatted images just like docker and uses the same registry infrastructure that docker uses.
 - aragilar350 days ago
 Installing `podman-docker` will do the aliasing for you.
 - MrThoughtful350 days ago
 Where does it pull the Debian image from?I would think the Docker infrastructure is financed by Docker Inc as a marketing tool for their paid services? Are they ok when other software utilizes it?
 - FireInsight350 days ago
 On my system it asks between a few different public registries, and dockerhub/docker.io is one of the choices.t's all public infrastructure for hosting container images, I don't think Docker-the-company minds other software interfacing with it. After all, they get to call them 'Docker images', 'Dockerfiles', and put their branding everywhere. At this point
 - natebc349 days ago
 By default it uses whatever is in registries.conf for unqualified-search-registries. You can specify in the fully qualified image name if you'd like.I can't speak to what Docker Inc. is okay with or not.
- vaylian350 days ago
 > I guess the benefit is that it runs on demand and not as a always on demon?Podman has much better systemd integration: <a href="https://www.redhat.com/en/blog/quadlet-podman" rel="nofollow">https://www.redhat.com/en/blog/quadlet-podman</a>
- qudat350 days ago
 And you can use systemd to be their supervisor via quadlet: <a href="https://www.redhat.com/en/blog/quadlet-podman" rel="nofollow">https://www.redhat.com/en/blog/quadlet-podman</a>
- 2OEH8eoCRo0350 days ago
 apt install podmanpodman run -it debian bash