49
Confused about Podman
(sh.itjust.works)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 05 Aug 2024
49 points (96.2% liked)
Selfhosted
39677 readers
360 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 1 year ago
MODERATORS
My major beef is we used to be able to run a Podman generate command to make a user systemd file and auto start and stop containers with that. Even entire clusters of pods with one easy command and then just use the system level start and stop. They removed it in favor of “quadlet”which works fine for single containers, but for a compose, they literally just use Kubernetes syntax and the official documentation says just use Kubernetes. Well, what the fuck is Podman for then?
The biggest problem everyone ever has with Podman is it’s frustratingly obedient to SELinux. Docker just kind of makes its own permissions and opens its own ports and steamrolls past whatever security you have. Podman will refuse to read or write a directory for stupid reasons until you’ve gone round and round with SELinux, and then just when you have it working, when the container updates it locks the directory all over again(in my case, updating a Minecraft server to latest version would crash the server and lock the data directory). Red Hat continues to insist SELinux is cool and this is working as intended. Again, Docker just doesn’t give a shit and barges into the directory without a problem.
There are .pod files for Quadlet now, which do what you want. No Kubernetes involved.
My impression is really the opposite. Podman is constantly being improved and nice features get added all the time.
If you don't like SELinux, just disable it. Nothing to do with Podman.
Now look here chap, Quadlet admittedly works fine. I personally just k3s anyway but .pod files work too.
Isn't being obedient to SELinux a good thing? You could set it to permissive if you want, but MAC systems are essential for security and I personally wouldn't go without them
Every complaint here is PEBKAC.
It's a legit argument that Docker has a stable architecture while podman is still evolving, but that's how software do. I haven't seen anything that isn't backward compatible, or very strongly deprecated with notice.
Complaining about selinux in 2024? Setenforce 0, audit2allow, and get on with it.
Docker doing that while selinux is enforcing is an actual bad thing that you don't want.
SElinux is needed for a secure system. It takes time to properly set up but it adheres to least privilege nicely
Well that can be understandable, but AFAIK podman generate still works, so if you can't do something with Quadlet, then you can stays with generate until then. For example, I'm using Quadlet and now podman generate too since my Rocky 9 podman can't be upgraded to podman 5 which means no pod support for you.