Kata Containers: The speed of containers, the security of VMs

Re:Kata Containers: The speed of containers, the security of... by alias_neo on Wednesday October 04, 2023 @06:34AM (#37763208)

This;

Podman is what Docker should have been, for me. Security first, no daemon, more Linux-like behavior (You can manage them with SystemD unit files if you wish) and it supports the same, usual container images you build/use with Docker.

The main part it was lacking is the compose equivalent, but that too is coming along.

[ Parent | on HN ]

Re:Kata Containers: The speed of containers, the security of... by XorNot on Wednesday October 04, 2023 @07:22AM (#37763576)

Honestly with quadlet it might be there on the compose front: being able to deploy either as systemd-like files or as Kubernetes manifests probably solves the entire problem in a very nice way (the K8S compatibility is the real magic IMO since it's the defacto cloud ecosystem).

[ Parent | on HN ]

Re:Kata Containers: The speed of containers, the security of... by alias_neo on Wednesday October 04, 2023 @07:43AM (#37763759)

I haven't played with any of Podman's Kubernetes YAML stuff yet, but we target Kubernetes.

Does it support higher-level declarations like Deployments and StatefulSets? I'm trying to understand how/if we could use this without having to write new manifests. A (very) quick search didn't clarify it for me.

[ Parent | on HN ]

Re:Kata Containers: The speed of containers, the security of... by goku12 on Wednesday October 04, 2023 @08:03AM (#37763931)

Quadlets just create a systemd unit file to launch containers with podman and have systemd manage its lifetime. Since systemd lacks the ability of controllers like Deployment and StatefulSets, I doubt that quadlets are able to achieve much more.

[ Parent | on HN ]

Re:Kata Containers: The speed of containers, the security of... by eliaspro on Wednesday October 04, 2023 @10:11AM (#37765466)

I'm pretty sure, that cleverly combining various unit types and their capabilities/attributes would allow to cover 90% of what's needed to emulate Deployments and StatefulSets.

[ Parent | on HN ]

Re:Kata Containers: The speed of containers, the security of... by goku12 on Wednesday October 04, 2023 @10:18AM (#37765578)

Yes. That's what I assume too.

[ Parent | on HN ]

Re:Kata Containers: The speed of containers, the security of... by Rapzid on Wednesday October 04, 2023 @07:35AM (#37763680)

Is it coming along? Last I saw they were moving away from the compose Schema to a k8s manifest and... Those are absolutely disgusting.

[ Parent | on HN ]

Re:Kata Containers: The speed of containers, the security of... by timost on Wednesday October 04, 2023 @07:42AM (#37763753)

You can use docker-compose with podman using podman's docker compatibility API.

See my other comment in a recent thread [0]

[0] : https://news.ycombinator.com/item?id=37661056

[ Parent | on HN ]

Re:Kata Containers: The speed of containers, the security of... by nine_k on Wednesday October 04, 2023 @08:42AM (#37764254)

(It's fun to note how systemd was an epitome of in-Linux-like software 7-8 years ago, and now it's the opposite. I'm not talking about systemd merits here, just about the change in perception.)

[ Parent | on HN ]

Re:Kata Containers: The speed of containers, the security of... by xorcist on Wednesday October 04, 2023 @09:51AM (#37765175)

Comparably little harsh criticism has been made for systemd the init system, most has concerned systemd-the-almost-ntp-client and systemd-the-binary-logfile, the various related xml documents, things like that.

[ Parent | on HN ]

Re:Kata Containers: The speed of containers, the security of... by Fire-Dragon-DoL on Sunday October 08, 2023 @12:03AM (#37807783)

From my understanding, it has serious limitations, for example since it's rootless, it can't bind on port 443

[ Parent | on HN ]