So Podman is an open source container engine like Dockerā€”with "full"1 Docker compatibility. IMO Podmanā€™s main benefit over Docker is security. But how is it more secure? Keep readingā€¦

Docker traditionally runs a daemon as the root user, and you need to mount that daemonā€™s socket into various containers for them to work as intended (See: Traefik, Portainer, etc.) But if someone compromises such a container and therefore gains access to the Docker socket, itā€™s game over for your host. That Docker socket is the keys to the root kingdom, so to speak.

Podman doesnā€™t have a daemon by default, although you can run a very minimal one for Docker compatibility. And perhaps more importantly, Podman can run entirely as a non-root user.2 Non-root means if someone compromises a container and somehow manages to break out of it, they donā€™t get the keys to the kingdom. They only get access to your non-privileged Unix user. So like the keys to a little room that only contains the thing they already compromised.2.5 Pretty neat.

Okay, now for the annoying parts of Podman. In order to achieve this rootless, daemonless nirvana, you have to give up the convenience of Unix users in your containers being the same as the users on the host. (Or at least the same UIDs.) Thatā€™s because Podman typically3 runs as a non-root user, and most containers expect to either run as root or some other specific user.

The "solution"4 is user re-mapping. Meaning that you can configure your non-root user that Podman is running as to map into the container as the root user! Or as UID 1234. Or really any mapping you can imagine. If that makes your head spin, wait until you actually try to configure it. Itā€™s actually not so bad on containers that expect to run as root. You just map your non-root user to the container UID 0 (root)ā€¦ and Bobā€™s your uncle. But it can get more complicated and annoying when you have to do more involved UID and GID mappingsā€”and then play the resultant permissions whack-a-mole on the host because your volumes are no longer accessed from a container running as host-rootā€¦

Still, itā€™s a pretty cool feeling the first time you run a ā€œrootā€ container in your completely unprivileged Unix user and everything just works. (After spending hours of swearing and Duck-Ducking to get it to that point.) At least, it was pretty cool for me. If itā€™s not when you do it, then Podman may not be for you.

The other big annoying thing about Podman is that because thereā€™s no Big Bad Daemon managing everything, there are certain things you give up. Like containers actually starting on boot. Youā€™d think thatā€™d be a fundamental feature of a container engine in 2023, but youā€™d be wrong. Podman doesnā€™t do that. Podman adheres to the ā€œUnix philosophy.ā€ Meaning, briefly, if Podman doesnā€™t feel like doing something, then it doesnā€™t. And therefore expects you to use systemd for starting your containers on boot. Which is all good and well in theory, until you realize that means Podman wants you to manage your containers entirely with systemd. Soā€¦ running each container with a systemd service, using those services to stop/start/manage your containers, etc.

Which, if you ask me, is totally bananasland. I donā€™t know about you, but I donā€™t want to individually manage my containers with systemd. I want to use my good old trusty Docker Compose. The good news is you can use good old trusty Docker Compose with Podman! Just run a compatibility daemon (tiny and minimal and rootlessā€¦ donā€™t you worry) to present a Docker-like socket to Compose and boom everything works. Except your containers still donā€™t actually start on boot. You still need systemd for that. But if you make systemd run Docker Compose, problem solved!

This isnā€™t the ā€œPodman Wayā€ though, and any real Podman user will be happy to tell you that. The Podman Way is either the aforementioned systemd-running-the-show approach or something called Quadlet or even a Kubernetes compatibility feature. Briefly, about those: Quadlet is ā€œjustā€ a tighter integration between systemd and Podman so that you can declaratively define Podman containers and volumes directly in a sort of systemd service file. (Well, multiple.) Itā€™s like Podman and Docker Compose and systemd and Windows 3.1 INI files all had a bastard love childā€”and itā€™s about as pretty as it sounds. IMO, youā€™d do well to stick with Docker Compose.

The Kubernetes compatibility feature lets you write Kubernetes-style configuration files and run them with Podman to start/manage your containers. It doesnā€™t actually use a Kubernetes cluster; it lets you pretend youā€™re running a big boy cluster because your command has the word ā€œkubeā€ in it, but in actuality youā€™re just running your lowly Podman containers instead. It also has the feel of being a dev toy intended for local development rather than actual production use.5 For instance, thereā€™s no way to apply a change in-place without totally stopping and starting a container with two separate commands. What is this, 2003?

Lastly, thereā€™s Podman Compose. Itā€™s a third-party project (not produced by the Podman devs) thatā€™s intended to support Docker Compose configuration files while working more ā€œnativelyā€ with Podman. My brief experience using it (with all due respect to the devs) is that itā€™s total amateur hour and/or just not ready for prime time. Again, stick with Docker Compose, which works great with Podman.

Anyway, thatā€™s all Iā€™ve got! Use Podman if you want. Donā€™t use it if you donā€™t want. Iā€™m not the boss of you. But you said you wanted content on Lemmy, and now youā€™ve got content on Lemmy. This is all your fault!

1 Where ā€œfullā€ is defined as: Not actually full.

2 Newer versions of Docker also have some rootless capabilities. But theyā€™ve still got that stinky olā€™ daemon.

2.5 Itā€™s maybe not quite this simple in practice, because youā€™ll probably want to run multiple containers under the same Unix account unless youā€™re really OCD about security and/or have a hatred of the convenience of container networking.

3 You can run Podman as root and have many of the same properties as root Docker, but then whatā€™s the point? One less daemon, I guess?

4 Where ā€œsolutionā€ is defined as: Something that solves the problem while creating five new ones.

5 Spoiler: Red Hatā€™s whole positioning with Podman is like they see it is as a way for buttoned-up corporate devs to run containers locally for development while their ā€œproductionā€ is running K8s or whatever. Personally, I donā€™t care how they position it as long as Podman works well to run my self-hosting shitā€¦

  • lightree@kbin.social
    link
    fedilink
    arrow-up
    6
    Ā·
    1 year ago

    had a knowledge sharing meeting at work recently on container security. the guy was using podman like a docker cli, but it said ā€œthis is only an emulation of dockerā€ - is there any downsides to running podman like this? im very familiar with docker on the command line

    • loren@sh.itjust.works
      link
      fedilink
      arrow-up
      8
      Ā·
      edit-2
      1 year ago

      I think calling it an emulation downplays podman. Docker and podman are both container runtimes. Docker came first and is known synonymously with containers, whereas podman is newer and attempts to fix dockerā€™s problems.

      One outcome of this is podman chose to match dockerā€™s cli very closely so nobody needs to learn a new cli. You can even put podman on the docker socket so ā€œdocker [command]ā€ runs with podman.

    • witten@lemmy.worldOP
      link
      fedilink
      arrow-up
      3
      Ā·
      1 year ago

      So as far as Iā€™m understanding your description, heā€™s actually using Podman under the hood, just via its Docker compatibility CLI. The main downside of that IMO is you lose out on Podman-specific flags and features. Which, honestly are probably not a huge deal to you if you just want a thing that walks and talks like Docker while hopefully being more secure.

      The big caveat though is root vs. non-root. If heā€™s running his commands as root/sudo, itā€™ll work a whole lot like Docker just without a daemon (and without containers starting on boot). But if heā€™s running as a non-root user, wellā€¦ See my original post for some downsides.