You're that chain smoking black hat with a stack of computers, black out curtains several screens and not a single lightbulb.

Podman is unironically the better choice.

I like the idea of podman, but it’s just not stable. This meme was inspired by my frustration of trying to switch.

Just try to make docker comply with your firewall.

I literally did this yesterday and it wasn’t that hard. You just add iptables:False to the docker config file.

This + forwarding stuff to the docker namespace is working great for me. https://wiki.archlinux.org/title/Nftables#Working_with_Docker

Docker bypasses your firewall and runs as root. Only an idiot would allow that shit.... I'm an idiot. But I'm fixing that.

Cult

I am running my entire homelab from podman quadlets (systemd managed podman containers) and it’s honestly very dope. Podman gets a bad rap for being second tier to docker but they legit have a bunch of awesome features for Linux users specifically that make it way nicer. Using systemd for docker status can add some misdirection occasionally, but having the logs from containers directly in journalctl alongside the rest of my system logs is amazing

Hopefully none of those things have dependency version conflicts

🤘

I may be dumb but I apply the firewall at the router level (OPNsense). That should be fine, right?

I literally yesterday dealt with that. There’s an option to just turn off Docker’s firewall manipulation so you can do it manually.

Alternate universe with Digong and Seetrio.

This! Podman rootless quadlets is so powerful and beautifully simple. Just look at that faaar superior security model and hos it doesnt even need a service to manage services because it just integrates natively with systemd I replaced my entire container layer from Rocker Swarm way back with K8s. Then it dawned on me I dont want the pods to move to another node by themselves anyway and then I just moved to Podman quadlets managed Ansible. Oh, and the podman pods are awesome as well.

This meme was inspired by my frustration from trying to switch. I like the idea of podman, but it just doesn’t work. Tbf the bugs I encountered this time were with podman compose rather than podman itself, but still, I’d rather use the tools that work. I’ve had similar experiences when I’ve tried to switch to podman in the past.

Not the poster, but I kinda get this sentiment. For my laptop and things that I do for work, I prefer Podman. Better security posture out of the box, and I'm typically crafting my own pods to work a specific way.

But, if I am just trying to start up some app/service and I'm following the GitHub documentation with the project...I want to just copy and paste and there isn't a 1-for-1 for docker compose. Podman does have an alias package so you can say docker on the cli, but the "compose" part of it is not as good if I just want something to run without dicking with it.

So in short, if I'm making something with a container or want to have hands on control, I prefer Podman. If I'm running something "off the shelf", like just running someone's docker compose files files from their Github, I'm just running Docker man.

What's the benefit over Docker?

It also can integrate with Systemd via Quadlets. Let's you control containers as a sytemd service. I personally use them for my home server and have been happy with it.

Wtf I thought docker was foss. Fml man

Also it's more secure and performant as it's rootless and daemonless.

What exactly is your problem with Docker? It's open source.

Also closed-source container images exist.

It also works better sooo

Also, does Docker do rootless containers yet?

Docker is open source though. Docker desktop is not.

At least docker works

It doesn't and I'm sure there are benefits, but for basic home services daemonless translated directly into more work for no benefit.

I use docker since it's what I learned on a decade ago, and my nas that I started from supports docker bit not podman in the 'app store'. I have three other machines running plain Debian, but I would want everything to work together, y'know? I've got a set-and-forget setup and I'd rather not break things without substantial benefit...

Plus everybody is like 'it's the same thing, no learning curve' but then I start reading up on it and uhoh, learning curves :p

Why would you use podman when you could

#!/bin/ksh

daemon_execdir="/home/etebase/src"
daemon_logfile="/var/log/etebase"
daemon="/home/etebase/pyenv/bin/uvicorn"
daemon_flags="etebase_server.asgi:application --host 159.100.247.89 --port 8000"
daemon_user="_etebase"

. /etc/rc.d/rc.subr

rc_bg=YES
rc_reload=NO

pexp="/home/etebase/pyenv/bin/python3 ${daemon} ${daemon_flags}"

rc_start() {
        rc_exec ". ~/.profile; ${daemon} ${daemon_flags} >> ${daemon_logfile} 2>&1"
}

rc_cmd $1

Some containers don't like non-root setups.

There are still various incompatibilities between the two, and it becomes relevant if you need to work with any organization that has standardized on Docker-specific tooling.

They look like a water type dugtrio.

Also a solid technical reason for openSUSE

That's what I was thinking. I've barely ever understood it for deployments for large companies (even then I disagree, I think it's added overhead just to bypass poor processes) but at home? Nah, install everything together.

I mean, that definitely seems like a you problem.

Pomdan won't work on my system because that is my alias to send Dan a message that I would like some more Pom.

I dislike quadlets. Compose configs are way more concise, and just look nicer.

not much man how about you

Podman is the RedHat implementation of the Open Container Initiative (OCI).

A Dockerfile and a Containerfile are both OCI. Docker and Podman can generally both use either.

Contrasted with Docker, Podman has better security defaults, and installers and licenses that are both actually open source. (Parts of Docker are open source. Parts are not.)

Docker used to lead with additional features beyond OCI such as Docker Compose, but Podman Compose has been a thing for a while, now.

The more mature a product is, the more likely it works perfectly with any OCI compliant tool.

For rookie work, I feel like there's still fair odds the developer only uses Docker and may rely on some anti-pattern that requires setting "bad security=ok" settings before their project will work in Podman.

Your mileage may vary.

It's a daemonless client for managing Linux containers. So any "docker" container. Most Linux distros have a native package for it too

God I hate arguing with podman. Something doesn’t work and I can’t tell if it’s my quadlet or the app

Linkwarden would not run without root.

I just use rootless docker, it's way less hassle.

It's why I just ran portainer instead

Is your keyboard ok?

Through a hacky Python script (podman-compose), but apparently it works. But IMHO there's no reason not to just rewrite compose files as quadlets. I think it's so neat that they work pretty much just like normal systemd units, it makes it feel a lot more logical especially if you're used to pre-container workflows.

One problem with Podman is that there isn't a lot of newbie-proof documentation, tutorials etc. partially because it's not as popular as Docker and partially because it's developed by Red Hat and they want you to get a RHEL license to access learning resources and support. But if you're good with man pages, this shouldn't be much of a problem, it's easy enough to figure out what to do.

Probably as good as it can, you shouldn't use docker compose with podman anyway, there are two alternatives (quadlets - they describe everything as a systemd units and kube yaml - they use standard k8s yaml files including pods, deployments, secrets, etc.), both arguably better than compose.

I've always had issue with podman-compose. So I setup a podman socket and use it with docker compose.

There's podman-compose available through your package manager or pypi.

Surprisingly well?

It's rare when I have to look up special instructions for podman. Once þe setup is ironed out commands are mostly interchangeable.

Þe podman team have done a great job.

uh... yes, you can? docker doesn't even log to journald by default, and you can also just do docker run --log-driver=none ... if you want to completely disable saving any logs.

edit: there are also a bunch of alternate storage systems, i have docker set up to use btrfs subvolumes

Problem in chair, not in computer.