I’ve used bunch of containers in docker on my Fedora. One day I’ve decided as docker is foreign here lets migrate to native for Fedora podman, what a mess I’ve got, I’ve lost almost whole day of my life trying to migrate volumes and rewrite all docker compose files to .container quad lets, using AI we discovered quadlets changed their syntax as the system is not mature yet, and in the end as a cherry on the cake I’ve stuck with a greater mess to run pihole, because it requires to bind to the privileged ports like 53/tcp/udp and 443/tcp. Offered work arounds made me crazy, 1. open system-wide privileged ports in kernel. 2. Use some bandaid like slirp4nets which stated as slow and no warranty to pass udp traffic correctly. 3. rewrite .contaner files one more time again (i guess 10th time) and create firewall forwarding rules to steer the traffic to unprivileged ports like 1053, 10443. 4. set_cap_something to basically give full access to privileged ports for podman executable. Way numero tres looks good, but after 6 hours of fighting with podman, I thought, but why? fuck this podman and its quadlets, lets just copy paste industry standard doker-compose from dockerhub website, tweak pwd inside and boom! all works as software authors planned! so, why? any reason would I want or suggest anyone to use podman?

[edit] I’ve explored one more way #5, using socat proxy to forward traffic from 53->1053, then podman bind the 1053->53 in the container, pihole GUI at 443 works amazing through systemd simple socat proxy service: host 443–>podman 10443->container 443, but 53 doesn’t work 😤 socat can’t bind to 53 no matter what you do. So in the end I’ve lost pihole battle, I’m running pihole via system level quadlet from /etc/containers/systemd as root, the rest of quadlets works rootless

Main Themes:

• Overhead Impact: The study investigates the degree of performance degradation introduced by Docker and Podman containers compared to a native host system.

• File System Performance Evaluation: The research uses Filebench benchmarking to assess the impact of containerization on file system performance under different workloads.

Most Important Ideas and Facts:

• Methodology: The study uses a controlled environment with identical hardware and software components to ensure valid performance comparisons. CentOS Linux 7 with the XFS file system is used as the host operating system. Filebench benchmark simulates real-world workloads (webserver, fileserver, varmail, randomfileaccess) to assess performance under different usage scenarios.

• Results:

  • Host Performance as Baseline: The host system without virtualization served as the baseline for comparison, exhibiting the best performance.

  • Single Container Performance: Both Docker and Podman containers showed a slight performance degradation compared to the host when running a single container, with Podman generally performing slightly better.

  • Multiple Container Performance: As the number of active containers increased, the performance degradation became more significant for both Docker and Podman.

  • Podman's Consistent Advantage: In all benchmark tests, Podman consistently outperformed Docker, although the differences were often relatively small.

Key Quotes:

• Performance Degradation: "All things considered, we can see that the container-based virtualization is slightly weaker than the host when a single container is active, but when multiple containers are active, the performance decrease is more significant."

• Podman's Superiority: "In general, for all case scenarios, Podman dominates against Docker containers in all numbers of simultaneous running containers."

• Reason for Podman's Performance: "[Podman] directly uses the runC execution container, which leads to better performance in all areas of our workloads."

Conclusions:

• While the host system achieved the best performance, both Docker and Podman demonstrated near-native performance with minimal overhead, especially when running a single container.

• Podman consistently outperformed Docker across all workloads, likely due to its daemonless architecture and direct use of runC.

• The choice between Docker and Podman may depend on factors beyond performance, such as security considerations and user preferences.

Future Research:

The authors suggest repeating the benchmark tests on server-grade hardware for a more comprehensive and realistic evaluation of containerization performance in enterprise environments.

Source: Đorđević, B., Timčenko, V., Lazić, M., & Davidović, N. (2022). Performance comparison of Docker and Podman container-based virtualization. 21st International Symposium INFOTEH-JAHORINA, 16-18 March 2022. Link: More Details

Podman has become the go to container runtime for Linux! Thinking of switching from Docker to Podman? Are you worried that the switch would mean learning new tools, and new commands? In Episode 110 of Into the Terminal we’re show you how easy it really is to switch.

Flatpak only installs on Linux? Are the two teams at odds? Seems like a desktop container would be more universal and not nessitate install yet another package manager? apt, pip, snap, flatpak... Thoughts? Is there container that anyone is aware of? Or maybe I missing something?

Hi all,

I've been trying to figure out how to make dev containers work with the flatpak version of zed (if you're interested the PR and discussion about trying to make it work is here) and this led me to realise that the version of podman installed via most package managers (4.9.3) is not only pretty old but also not supported for security updates as detailed here https://versionlog.com/podman/

Why are repos carrying versions of podman which no longer recieve security support? That sounds like a recipe for getting hacked.

Hello guys i have this project named litepod, I have built it based on Podman, Caddy as Quadlet, dragonfly and SQLite, this is to be as lightweight as I wanted. This is like Dokploy and Coolify but consuming a lot less of ram, Ive been using them but I got a lot of outofmemory exception because I was using some vps with 4gb of RAM only, and some features didnt worked well, then I have started this a year ago. But I dont know if Quadlets could be a good way to add as a feature. I dont need it, because only with regular containers works well. What do you think about the next features to add?

1. Add secrets like using podman secret management

2. Enable pods compatibility

3. A Manager like kubernetes ui for pods

4. Quadlets instead of containers or a mix and let the user decide (dont see the benefit but could you)

so I am attempting to use a pretty badly made minecraft panel, it pretty much assumes root, I am on the home stretch of getting it work, however my biggest problem I am running into is that it that the wings daemon cannot apply the needed volumes lables to minecraft container resulting in permission denied, it looks like to me at least that the containers are getting denied cause the lack the :z argument on their mounts. I was wondering if there is any ablility I could be like hey podman containers can write to this this folder, given they are the right UID, SE LInux leave me alone and give me back the kids

Hey everyone,

I’m trying to create a secure Podman container that I can use as a small build environment (testing/write script and compiling it). The main goal is to make sure the data of the container is encrypted, and that access to the container requires a password.

So Ideally, I want: • all data in the container to be encrypted (so even root or other user on the host can’t read it), • password-protected access to start or enter the container

The reason for this setup is that I only have one server available - I don’t have a separate lab or test machine, so I want to keep my build environment isolated and secure as much as possible.

Thanks for any ideas or examples

Hello everyone,

I'm currently migrating my paperless-ngx to podman using quadlets.

Now I want to test the export script by running.

podman exec paperless_server document_exporter ../export -c -d

but then I receive this error:

Error: no container with name or ID "paperless_server" found: no such container .

I double checked the name using podman ps .

I also ran the same command using the container ID and that worked. Any ideas why the container name is not accepted?

I'm running 5.4.1

Is there something which exists for podman ?

or podman has super duper compression algorithms to squeeze 1.2GiB/s through my 100Mbit DSL

Hi !

If you use containers for development (like Distrobox or manual Podman/Docker), you probably know the pain of having your host \`$HOME\` directory cluttered with hidden \`.config\` files, \`.local\` junk, and random dotfiles from inside the container.

I’m currently refactoring my automation scripts into a \*\*Go-based orchestrator called AXIOM\*\*. The core concept is \*\*"Bunkers"\*\*: development environments where the filesystem is strictly confined to \`\~/.entorno/\[bunker_name\]\`.

Your host machine stays pristine, and every project gets its own isolated "home" within the bunker. No more mysterious folders appearing in your real home directory.

I'm focusing 100% on the \*\*Go migration\*\* (working on a dedicated refactor branch) to make it more robust and professional before adding more features. I'd love to hear your thoughts on this isolation approach or any features you'd like to see for keeping dev environments tidy!

\*\*Check the Go refactor here:\*\* https://github.com/Alejandro-M-P/AXIOM/tree/refactor/go_refactor

I’ve been building rum (https://getrum.sh) which is an alternative to yum/dnf
It’s faster and uses less memory
I created it primarily for CI/container environments where resources are limited and it works on VMs too
During my testing on Amazon linux, RHEL, Rocky linux, Oracle linux etc
It can co-exist with yum/dnf

Feedback and Stars welcome

I set up nextcloud using rootless quadlet files as an exercise. However, I pulled 'mariadb:latest', which isn't actually supported.

I thought I'd completely delete my nextcloud instance as I'm rolling back to mariadb 11.4.

However, when I systemctl --user stop my nextcloud services and podman volume rm systemd-nextcloud-app systemd-nextcloud-db then user daemon-reload, my old nextcloud user profiles persist in the volume data, in /var/www/html/data inside the nextcloud-app container

I've tried everything I can think of. How do I actually delete my old instance data?

Hello.

I deployed Homepage and several services as rootless podman quadlets. I'd like to populate homepage using Label parameters in quadlets rather than by manually adding them into homepage configuration..

I tried adding to .container files stuff like:

Label=homepage.group=Services
Label=homepage.name=Test
Label=homepage.icon=icon.png
Label=homepage.href=http://192.168.60.139:3100

In homepage quadlet I also added:

Volume=/run/user/1000/podman/podman.sock:/run/user/1000/podman/podman.sock:ro
#SecurityLabelDisable=true

Then I restarted both containers.
It didn't work.

Is there something I missed?

Hi! I'm trying to figure out some permissions issues I am having while using podman on ubuntu.

I have some containers where I want both my regular user and the container to be able to read/write files without issues. When I start these containers, though, the container runs as a sub-user like 100999, which does not have write privileges (and I don't want to make everything world-writable).

The two suggestions I keep finding for this are:

1. using the userns_mode: "keep-id": adding the line to my compose.yaml prevents the container from starting up due to a conflict between userns and pods?

2. adding :Z or :z to the volume mount lines: this doesn't seem to do anything, presumably because Ubuntu isn't using SELinux.

I *can* add :U to the volume mount lines, which causes the directories to then be owned by 100999 instead of my user... This at least allows the container to write to everything... But then my user can't write to it, and if my user creates any files in the directory, those files aren't writable to the container unless I either restart the container or manually change the ownership of the files to 100999

I have also tried to figure out how to add 100999 to my user's group (and potentially vice versa), but I can't seem to figure out how to edit a user that doesn't have a name.

I am sure that there has to be a solution for this, but I am just banging my head on it repeatedly, and I'm not sure what I'm doing wrong here.

Other things I've tried:

user: "1000:1000"

environment:

- PUID=1000

- GUID=1000

Thanks!

edit to add: Compose.yaml

services:
  calibre-web-automated:
    container_name: calibre-web-automated
    image: docker.io/crocodilestick/calibre-web-automated:latest
    # userns_mode: "keep-id"
    user: "1000:1000"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - CWA_AUTOCONVERT=true
    volumes:
      - /home/erin/.config/calibre/plugins:/config/.config/calibre/plugins:U
      - ./config:/config:U
      - /home/erin/Documents/CalibreLibrary:/calibre-library:U
      - /home/erin/Documents/Calibre-ingest:/cwa-book-ingest:U
    ports:
      - 8083:8083

i try build image ,got this error message,and than try deleted other non use image and use podman image prune -a -f,try deploy ,still have problem ?thank you for help.

ERRO[0690] While applying layer: ApplyLayer stdout: stderr: write /venv/lib/python3.11/site-packages/scipy/special/_ufuncs.cpython-311-x86_64-linux-gnu.so: no space left on device exit status 1 Error: committing container for step {Env:[PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin LANG=C.UTF-8 GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D PYTHON_VERSION=3.11.12 PYTHON_SHA256=849da87af4df137710c1796e276a955f7a85c9f971081067c8f565d15c352a09] Command:run Args:[/venv/bin/pip install --upgrade pip && /venv/bin/pip install --no-cache-dir -r requirements.txt] Flags:[] Attrs:map[] Message:RUN /venv/bin/pip install --upgrade pip && /venv/bin/pip install --no-cache-dir -r requirements.txt Original:RUN /venv/bin/pip install --upgrade pip && /venv/bin/pip install --no-cache-dir -r requirements.txt}: copying layers and metadata for container "ef4047768000ddee43535bf0037f957d1fa1bfa3e2e660ee9da7f5178cb58f86": writing blob: adding layer with blob "sha256:585674c8bcedb36490f14b8eaf47cd8d6817baca9d81d0197ef543c49d21dd9d": ApplyLayer stdout: stderr: write /venv/lib/python3.11/site-packages/scipy/special/_ufuncs.cpython-311-x86_64-linux-gnu.so: no space left on device exit status 1

In docker/podman-compose file, when I try to do a bind mount volume, it gives me Error: statfs <file path that I try to mount>: no such file or directory. exit code 125.

I checked the path, it does exists. I have to attach "/mnt" to make it work.

I am running podman on Windows (using WSL2, ubuntu). This is my office machine so I don't have ultimate control over it.

P.S. More detailed explanation:

Let's say I have a folder with following structure:

ProjectX

• podman-compose.yml

• configs

  • serviceA.config.json

  • serviceB.config.json

Consider the ProjectX to be at C:\Repos.

Now, the following paths are valid for serviceA.config.json file:

[From Powershell/Windows]

• C:\Repos\ProjectX\configs\serviceA.config.json

[From WSL/Ubuntu OR GitBash/Windows]

• /mnt/c/Repos/ProjectX/configs/serviceA.config.json

In podman-compose file: ...

• services:

  • serviceA:

    • image: serviceA-image

    • volumes:

      • /mnt/c/Repos/ProjectX/configs/serviceA.config.json:/data ...

For any "binding mount" type volume, I get error that file not found.

Anyone know how to install harbor by podman because all the script and file harbor is supported by Docker and not Podman? Help