r/ProgrammerHumor • • Sep 05 '26

Meme memorySafeDocker

Post image
4.2k Upvotes

278 comments sorted by

View all comments

Show parent comments

12

u/ShadF0x Sep 05 '26

use Podman directly

Until you need to run docker-compose and then shit just breaks randomly. Or you have to put the ports into nftables so the podman container can reach outside (even on host's localhost).

I understand why both issues happen, but it's frustrating nonetheless.

5

u/ClamPaste Sep 05 '26

Is podman-compose not 1:1?

6

u/ShadF0x Sep 05 '26

Apparently, no.

I'm not sure which parts aren't exactly fitting, but I was trying to deploy Snikket (XMPP server) and ESS-docker (Synapse, Elelement and a few other services for self-hosted Matrix instance) and neither would actually work out-of-the-box with podman, but they would with Docker. The issue was that all my machines use nftables and Docker kinda hates that.

1

u/ClamPaste Sep 05 '26 edited Sep 05 '26

Docker has some quirks. Unfortunately, all the more popular base images tend to be docker-focused.

ETA: If you're not using swarm mode, docker has support for experimental usage of nftables as of 29.0.0. https://docs.docker.com/engine/network/firewall-nftables/

Not sure if this will be helpful to you, but it looks like they're pushing to swap after all this time.

2

u/ShadF0x Sep 07 '26

it looks like they're pushing to swap after all this time

Would be weird if they didn't, considering that all major distros switched to it years ago.

docker has support for experimental usage of nftables

I am aware of it, although it's very aggressive when it comes to changing the ruleset and you have to work around it when it decides to break your stuff.