Hacker News Reader

Comment by gigatexal | Hacker News Reader

Any docker Podman corner cases that people have run into? I like the idea of rootless containers but I can do that ether easily by adding one line to my dockerfile or adding a user flag when I run a docker container. What other advantages am I getting?

View on HN

This isn't about root inside the container but rather it doesn't need root on the host system.

Not sure if you count it as a corner case, but podman lacks a docker-compose equivalent - last I checked, a few months ago, there was only a community port project that still needed a lot of work.

Not really corner cases, but compatibility from rootless podman to docker ends where privileges are needed, e.g., in the case of networking.

No need to run a daemon. Security is better.

If you lock down the docker user, is it a problem?

The biggest issue lies not in the few lines in /etc/passwd or /etc/group, but rather the highly privileged process with a large attack surface that is the Docker daemon.

Generally, it's been pretty easy to transition for me, but I used to rely on things like the automatic nginx image that you need to mount the docker socket into so it can route traffic to containers when they come up. Since there's no daemon, there wasn't a way to do that. I think people are working on it, but I haven't tried recently.

Work also uses a special docker RUN command that can use the host's ssh keyring to, eg. Install something from a private github repo. Doesn't seem to exist in podman.

I use that nginx image too, and it's the one thing that keeps me using docker for some small single-node setups. For basically everything else, Podman is a better experience. Now that I've discovered Podman can run K8s Pods (and now Deployments) I use it all the time. I don't know how I lived without it!

> Podman can run K8s Pods (and now Deployments)

That is amazing; thanks for pointing it out:)

Reply on news.ycombinator.com