|
|
|
|
|
by CoolCold
1481 days ago
|
|
Article itself and the idea in general seems controversial at best for me. I could not find answer for myself why Docker is any close to be dead and why Podman is the thing I should use instead of Docker immediately. Q 1. Docker has some policy change and your company may need to pay for it - if you have > 250 persons/10 million revenue
A 1: Indi/Solo devs out of scope. Enterprises probably fine with that anyways. Q 2. Docker has limits for pulls from Docker hub!!!! You have 100 (200 with login) downloads/single IP for 6 hours interval.
A 2: It was already mentioned, switching to Podman, while using Dockerhub doesn't magically helps. Moreover, practically I find it totally fine for Indi/Solo dev. For companies, who's amount of pulls can be higher - you want and have in place your local registry anyways to ensure Business Continuity and this doesn't bother you much. Q 3. Running no background processes, running rootless is good because of ...
A 3: On dev env (your local laptop, for example) you do not care much - your goal is ease of use. On production, running rootless rises question from me:
* how you expect firewall (iptables) to be updated for port forwardings?
* how you expect networks and bridges organized without root?
* how you expect auto restart for container to happen on failure without supervising it?
* some security advises and mitigation guides mention disabling user namespaces and was/is disabled by default in some distros https://news.ycombinator.com/item?id=28054823 - your security & system administration team may have such limits in place on production
* those who care for intruder gets into container and can hijack system further use FireCracker or similar approach anyways [for production] So what is left in "pros" for Podman, have I missed anything? |
|