Docker or podman?

If you don't have strong opinions one way or the other, then docker is the easy answer. Way, way more widespread, which generally tends to mean better docs, more guides and examples, more tooling and open-source support...

47

I use podman with the podman-docker compatibility layer and native docker-compose. Podman + podman-docker is a drop-in replacement for actual docker. You can run all the regular docker commands and it will work. If you run it as rootful, it behaves in exactly the same way. Docker-compose will work right on top of it.

I prefer this over native Docker because I get the best of both worlds. All the tutorials and guides for Docker work just fine, but at the same time I can explore Podman's rootless containers. Plus I enjoy it's integration with Cockpit.

24

I would say Docker. There is no substantial benefit in running podman, while docker is a widely adopted tool (which means more tooling in the ecosystem, easier to find answers to questions etc.). The difference is not huge tbh, and some time ago the biggest advantage for podman was being able to run rootless, while docker was stuck with a root daemon. This is not the case anymore (docker can run rootless), so I would say unless you have some specific argument to use podman, stick with docker.

17

I personally prefer podman, due to its rootless mode being "more default" than in docker (rootless docker works, but it's basically an afterthought).

That being said: there's just so many tutorials, tools and other resources that assume docker by default that starting with docker is definitely the less cumbersome approach. It's not that podman is signficantly harder or has many big differences, but all the tutorials are basically written with docker as the first target in mind.

In my homelab the progression was docker -> rootless docker -> podman and the last step isn't fully done yet, so I'm currently running a mix of rootless docker and podman.

15

Podman is slightly better, but most tutorials are for docker.

So, podman if you're comfortable looking through docs, man-pages, scarce Internet resources, and trial and error for finding things out. Especially if you care about having better security with rootless mode.

Podman also has a different way for managing many containers at once, and the interaction between them.

15

Podman is significantly better if you want to leverage the Systemd integration it has out of the box.

But if you just want to run existing docker-compose scripts then Docker is easier.

14

It depends on what you want. Do you want containers that don't blow away your firewall? Podman is nice, but docker can be configured a little to avoid this. Want things that autostart and don't have issues with entry points that attempt to play with permissions/users? Docker or podman as root is necessary. Want reasonable compose support? Podman now needs a daemon/socket. Want to make build containers and not deal with permission/user remapping at all? Podman is really nice.

Do not attempt to use podman-compose. That app is dead.

Unfortunately if you want to make tools that will be used by other people then you must add docker support. It just owns too much of the market.

10

is podman-compose really dead? Their github page looks active at a glance. The tooling is so similar, I use podman for local testing, and deploy to docker, but I've also done the reverse. As long as your not using really exotic parameters its really just a drop in replacement, I've even used GPU passthrough for AI project no problem in both docker and podman. At the end of the day, they're just slightly different frontends for the same backend.

As far as docker support, its often as simple as just providing a Dockerfile, which is basically the same thing as your build scripts. These days I've often used the Dockerfile INSTEAD of the readme to find help compiling some projects.

5
- It was dead however long ago when I submitted a PR. Still unmerged with no activity on the request so I just never went back to check.
  
  It's good to hear that they are working on it again though, if that is the case.
  
  4

If docker works for you, then don’t change what’s not broken. If there are things you don’t like about docker (root access etc for example) then venture out and try others. At the end of the day, they’re just tools to get to the more interesting stuff — actually running applications and playing with them.

10

Just pointing out your response may be dated. Docker can run rootless: https://docs.docker.com/engine/security/rootless/

2
- Cool. Thanks! One less reason for me to even consider Porman on the radar. Personally, I really don’t care for the tool itself, and am way more interested in the apps that I can run and play with :)
  
  3

I like podman because rootless and daemonless are built-in and default. Yes, it can be done on docker, but you have to do a bunch of shit to get it set up.

You could create the alias alias docker="podman" and 99% of the time, you won't even be able to tell the difference since podman is a docker drop in replacement. All the docker documentation applies to podman as well. But since docker runs as root by default, some edge cases might not work out of the box (like binding to a port on the host less than 1000).

Podman comes with some neat tools like being able to create systemd service files to start and stop containers as services.

To use docker-compose, you'll need some additional packages. That's probably the biggest drawback to podman imo. Podman wants to use pods instead of docker-compose, but I think they gotta take their heads out of their asses and just support the more popular format on that one. Not to mention docker-compose is just plain better imo. Easier to define, easier to understand, easier to modify. The list goes on and on.

9

You could create the alias alias docker="podman"

There's even an official Debian package that takes care of this for you: https://packages.debian.org/bookworm/podman-docker

1
- That package actually does a bit more than that! If you don't need all the extras, then I say just add the alias and be done with it.
  
  1

Podman rootless, using quadlets for systemd services. :D

6

I like podman more because people told me it was better and it just worked for me :P

6

Honestly I use docker because by now I know docker and basically everything has support for it...

5

If you're just starting out and have never used containers before start with regular (rootful) docker. It's a much simpler mechanism to understand for a beginner and has more widespread support and documentation.

Once you understand containers and have used them for a few months you can start going down the rabbit hole, there's no shortage of technologies to explore.

Or, if you're only interested in self-hosting as a hobby and docker does what you need, you can also stop there. Not everybody needs a deep dive into technology.

5

I learned podman as a beginner. This isn't to say that what you're saying is wrong. It was much more difficult doing so. I am only commenting to say that its possible but needs patience.

1

Definitely podman + podman compose.

Its fully open source (docker isn't) and its secure by design (security has been added to docker as an after fought).

Also podman is rootless by design, docker takes a bit of effort to run root less.

5

Piggybacking on this… what’s the quickest way to deploy a docker container in Kubernetes short of having to hand create the deployment yaml? Or is that it, having to create one from scratch.

4

You have a bunch of options:

kubectl run $NAME --image=$IMAGE

this just creates a pod running the specific image. If you kill the pod, or it terminates, it won't be run again. In general though, you probably want to do some customization before running (maybe you need volumes, secrets, env, ports, labels, securityContext, etc.) and for that you can simply let kubectl generate the boilerplate YAML and then simply make some edit:

kubectl run $NAME --image=$IMAGE --dry-run=client -o yaml > mypod.yaml # edit mypod.yaml kubectl create -f mypod.yaml

You can do the same with a deployment or statefulset:

kubectl create deployment $NAME -n $NAMESPACE [...] --dry-run=client -o yaml > deployment.yaml

In case you don't need anything fancy, the kubectl create subcommand allows you to create simple workload, so probably that's the answer to your question.
6
- You rock! Yeah I just wanted to run the image first before building out the whole framework around it. This is what I was looking for.
  
  2
If you run it in podman, podman can export into a kubernete file, but its been a long time since I've tried it though. podman kube generate $CONTAINERNAME

4

I like the idea behind Podman, but it's not a suitable drop in replacement for Docker yet. Especially since it requires manual setup to auto-start stacks at boot, and can't import docker compose files easily.

Docker is easier to use, has many more examples and tutorials out there, and every project generally provides a docker compose file ready to go for quick setup.

4

There is now podman compose that can read and use docker-compose files. As for importing, I cannot tell.

2

Whichever one you want.

4

I would say podman by default. It has a better security architecture as it can run rootless.

However there are small differences from Docker so you may need use Docker if you are trying to run third-party services that rely on these differences.

3

Docker can run rootless too, see https://docs.docker.com/engine/security/rootless/

5

Podman. This is the way.

3

Docker is a great choice with lots of good tutorials. I personally use podman since all my servers are now running Fedora server and podman is installed by default.

1

They both kind of suck in their own way.

If you want to things to run at startup and you’re not on systemd, rootless docker is probably easier.

Otherwise podman is mostly fine but be careful of native overlay if you’re not on BTRFS, this causes some pretty long build times.

0

Takes 1 minute to write a non systemd startup script, come on.

I understand systemd "spoiled" people, but not having a potentially insecure always running daemon for no purpose at all (docker) beat the alternative for me.

1

No love for kubernetes?

0

I think k8s is a different beast, that requires way more domain specific knowledge besides server/Linux basic administration. I do run it, but it's an evolution of a need, specifically when you want to manage a fleet of machines running containers.

2
- Can be ott yeah. I set mine up to understand how it all works and just kept things going.
  
  1
- Even then, there's dockerswarm.rocks (linking directly to tutorial to show how easy it is!)
  
  0
Kubernetes? I've never even seen her netes.

-3

What no love for Incus round these parts?

0

Because the lxc way is inherently different from the docker/podman way. It's aimed at running full systems, rather than mono process containers. It has it's use cases, but they are not as common IMHO.

2
- Real men use Incus NixOS containers for reproducible builds instead of wimpy dockerfiles 😤😤
  
  /s -- for real though, I hope someday you finally remove the stick from where the sun doesn't shine ;)
  
  -4

I use Docker exclusively. Podman is the NIH syndrome response to an industry standard. It has its benefits but Docker just works.

-1

Podman wasn't built due to NIH. Docker has real problems (though many have been fixed), and Podman was built to fix those.

6
- Docker Engine is open source. They could’ve easily contributed patches to it which just further proves that it is a NIH syndrome response.
  
  -6

New Lemmy Post: Docker or podman? (https://lemmy.world/post/13073444)
Tagging: #SelfHosted

(Replying in the OP of this thread (NOT THIS BOT!) will appear as a comment in the lemmy discussion.)

I am a FOSS bot. Check my README: https://github.com/db0/lemmy-tagginator/blob/main/README.md

-5