Whereas when I install Docker in WSL it runs inside of my WSL VM.
You have piqued my curiosity. What does Docker Desktop do that the CLI cannot?
Or are there any lightweight hypervisor on top of firecracker alternative? At this point with the way systemd is going, we should just switch back to VM? Everything is just more mature on native OS install. Docker to Linux, just feels kinda like SPA reinventing the html parsing on top of a rendering engine.
On Apple Silicon machines however, latest podman version uses VM images which Rosetta doesn't work with, and hence it will use qemu for running amd64 containers. You can fix this by either installing podman 5.5 or create the VM from and older image [1]. My only complaint here is that the stock machine images are pretty large (~1G )
If you use containers to run tools that create files in your host (i.e. build tools), then you can use your host username as the default in the VM (machine init --username $(id -un)), and then run containers with --userns=keep-id. That way the the container command starts with the same username and uid as you host user - this is pretty tricky to get working with docker, from my experience.
We use Bazel as our build tool and we create a lot of images based on shared layers. Bazel produces oci layout directories that contain descriptors and symlinks to the actual layer tars. Podman can start a container "directly" from these directories[2], which speeds up image testing considerably, since it can detect known layers immediately. With docker you have to stream a tarball with all the layers and descriptors to the docker daemon, only for it to discover that it already knows most of the layers.
[1] https://docs.podman.io/en/latest/markdown/podman-machine-ini... - machine images https://quay.io/repository/podman/machine-os
[2] podman run oci://<path to oci-layout-dir>
Zero problems with Podman Desktop.
Cool for Podman Desktop though.
$ brew install podman-desktop
… play a little …
$ brew remove —zap docker-desktop
Have been happy ever since. No more smells of enshittification. Now if I could just zap slack and figma…
Figma is so slow on my 3-4 year old x64 mbp I couldn’t possibly use it.
( They have a pretty good ratio of seeds that grows into vs seeds that don’t. They also make minimal investment until the project is viable. This does not seem to be a common approach. )
Everything else has been working as a drop-in replacement.
Likewise, I am contributing to Rancher Desktop downloads with such kind of customers.
The only use case I encountered is people who want to run Docker without root or admin permissions and use Podman just as a drop-in replacement.
It lets you define a systemd job with some custom syntax and run it as a systemd service, and even stretches to allow some form of kubernetes YAML to be run as local (single node, rootless) containers!
Real nice.
See previous presentation on HN: https://news.ycombinator.com/item?id=43456934
_But why?_
I mean, if you have one container service only and everything else is ran by systemd, then it makes sense to keep it easy. But other than that, why? Systemd's syntax and docs aren't particularly friendly or easy, so it's not like you gain in simplicity vs just running docker/podman-compose, or even a lightweight orchestrator like Nomad.
> Error: creating container storage: the container name "..." is already in use by [hash]. You have to remove that container to be able to reuse that name: that name is already in use, or use --replace to instruct Podman to do so.
And then you try to run `podman compose up --replace` except that's not a recognized argument, so eventually you figure out that you have to run `podman compose down` to clean whatever state is causing issues. I find that I have to do that every time I CTRL+C quit out of `podman compose up` (even though I always let it clean up and then exit on its own), which is a hassle.
I'm considering going back to using Docker Engine.
[1] https://github.com/containers/podman-compose/issues/1072
Congrats to podman team.
With Docker, I found rootless setup to be a PITA, despite having experience with unprivileged LXC containers. The manager daemon constantly consumed system resources even when no containers were running. Docker upgrades sometimes refused to run my containers until I chased down whatever storage driver problem they introduced in the latest version.
When the most recent upgrade broke my containers yet again, I decided to give Podman a try. Setup was a breeze. There is no management daemon wasting resources. My containers just worked. Even the little cron script I wrote to query Docker for pending image updates just worked with Podman tools.
I think Podman also makes it easy to map host uids to non-root container uids, which ought to help me reduce attack surface. (I haven't actually tried this feature yet.) Last time I checked, Docker did not.
So far, I couldn't be happier.
Podman comes with an auto-update flag you can set for containers that uses systemd to do this for you. Takes a bit of reading to get it right but its smooth sailing mostly.