Podman, the open source Docker alternative ported to M1 (Apple Silicon) machines

https://github.com/simnalamburt/homebrew-x/blob/main/Formula/podman-apple-silicon.rb

by goranmoomin • 5 years ago

494 147 5 years ago

lox• 5 years ago

This looks like the podman client, effectively? Has anyone gotten `podman machine` working on M1?

kenada• 5 years ago

`podman machine` uses Fedora CoreOS, which doesn’t currently support aarch64. However, it [sounds like][1] that could change soon.

[1] https://github.com/coreos/fedora-coreos-tracker/issues/13

simnalamburt7• 5 years ago

The current version of podman-apple-silicon uses "testing-devel" version of official Fedora CoreOS aarch64.

simnalamburt7• 5 years ago

One of the main reason that I made podman-apple-silicon was to make `podman machine` work properly. It works!

athorax• 5 years ago

Linking to the homebrew installer for this is an...odd... Choice. Never the less, congrats podman devs!

pcr910303• 5 years ago

Mostly because the dev linked to the Homebrew installer when announcing(?) it on her Twitter account[0], but also because the forked repo[1] that contains the patches just shows the original README.

This isn’t an official port to the M1 — it’s a custom version patched by a different dev.

[0] https://twitter.com/simnalamburt/status/1434244533001224192

[1] https://github.com/simnalamburt/podman

phinnaeus• 5 years ago

It looks like the real nice thing here is having a formula for QEMU with the ARM patch applied: https://github.com/simnalamburt/qemu/tree/hvf

With this I believe you could also used [nerd](https://github.com/containerd/nerdctl) instead of podman but I haven't tested it yet.

Edit: It works. Had a bit of trouble since I wanted to uninstall the "real" QEMU first, but `lima` still depended on it, and then installing the patched QEMU needed to update the version of `lima` I had installed, which then tried to reinstall QEMU, which failed because of some symlinks which were now owned by the patched QEMU...

kitd• 5 years ago

OT, but I'm impressed you managed to make all those changes within the HN-comment-edit-timeout!

piaste• 5 years ago

With this I believe you could also used [nerd](https://github.com/containerd/nerdctl) instead of podman but I haven't tested it yet.

This is the first time I hear of nerdctl and it's _very_ interesting.

M1 aside, does it work fine on regular arm64 linux? I run a small Raspberry Pi 4B homeserver and I would have used podman for improved security, were it not for the poor/incomplete Compose support, while nerdctl seems to explicitly support it.

gizdan3• 5 years ago

TIL of nerdctl. Anyone know what the differences between nerdctl and podman are?

whimsica1• 5 years ago

Anyone tried this? How's the performance compared to Docker Machine in Mac (notoriously slow on storage).

initplus• 5 years ago

I assume it's pretty slow, not on storage but on compute. x86 docker/podman on M1 must use QEMU software emulation, rosetta doesn't support x86 virtualization.

vbezhenar• 5 years ago

Why do you think that it uses x86? I assume that it just runs ordinary ARM linux in VM which just works (I also don't really understand this title post, surely podman worked on ARM linux since the beginning).

slpnix• 5 years ago

Behind the scenes, it's using QEMU with Alex Graf's patches for hvf (Hypervisor.framework) support, so it's Virtualization, not emulation. In other words, the performance is really good ;-)

BTW, in case you don't want to depend on a fork, upstream podman is going to gain M1 support (in the sense of 'podman-machine' knowing how to start aarch64 VMs with hvf) very soon.

infogulch6• 5 years ago

Tangentially, I wonder if Moby underestimated the amount of human hours that were instantly allocated to alternatives as soon as they announced Docker Desktop was going paid. (I don't know if this project is a consequence of that announcement or not.)

Hopefully Podman will be able to capitalize on this event and get the polish needed for widespread use.

SilverRed• 5 years ago

I suspect the push for podman was more about how docker ignored CGroupsV2 for so long that Fedora eventually turned it on anyway which broke docker and then told users to switch to podman.

cozzyd• 5 years ago

And EL8 for that matter

kbenson4• 5 years ago

I think a really big part of it was where Red Hat asked Docker to accept their patch that allowed people to run docker with local registries only (no docker.io), and were told Docker would not be accepting that patch, and to go pound sand if they didn't like it (eh, so maybe not so forcefully).

The first thing I tried to figure out when looking into Docker for work was how to limit the registries it would look at to only be our own when used in production, and I was surprised to find out you can't (at least not without a hack to make it think it's using a mirror and just hitting your registry first).

infogulch6• 5 years ago

I hadn't heard about CGroupsV2. Apparently it's been in the kernel since 2015. Seems like a better design.

https://thenewstack.io/linux-cgroups-v2-brings-rootless-cont...

https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2...

alibarber2• 5 years ago

Podman's been a great tool (on Linux) for a while, it's my daily driver. Rootless, no daemon and networking nonsense, and docker-compose can be replaced with real K8s pod definitions for the most part. I'm actually really happy to see the zeal that has come to it from docker's changes - thank you docker ;)

alias_neo2• 5 years ago

docker-compose can be replaced with real K8s pod definitions for the most part

Could you elaborate on this part? Are you running in Kubernetes or somehow using the pod definition format with Podman? I'd like a way to declaratively specify my Podman pods without docker-compose and friends.

DocTomoe• 5 years ago

Moby has the power of using a well-established name ("I want to have Docker on my desktop, let's google that, oh, hi Docker Desktop!") that also appears in a lot of tutorials and training material, both aspects that developers tend not to spend time on.

Given how often I still stumble over massively obsolete documentation and "helpful" articles from 15 to 20 years ago, I'd say they are safe.

hda1113• 5 years ago

They are as safe as MySQL is

Thaxll• 5 years ago

Most people don't care about Podman and will keep using Docker. There is no alternative on Windows so how exactly podman is a replacement?

Also I don't trust Red Hat / IBM with the CentOS fiasco.

cmeacham98• 5 years ago

Not everyone has to use the same tool. Even if you continue to use only docker, podman helps you by competing with docker and driving them to improve their software (ex: cgroupsv2).

Also, I believe podman works in WSL with some tweaks.

WhyNotHugo• 5 years ago

FWIW, docker itself doesn't run on Windows either -- you have to run docker on Linux on Windows.

You can do the same thing for podman: run podman on Linux on Windows.

Probably the link on this very article is a good starting point for doing that.

nsonha4• 5 years ago

Idk why people keep pushing for this, on a personal dev machine, root is not a problem, and then there is QEMU

denkmoon2• 5 years ago

I think you'd be surprised how often the route from dev to prod is "copy it from my machine into the cloud".

Good practices start at home.

eru2• 5 years ago

Well, it's also a good practice the other way round:

If you can make your dev setup model the production setup, that's one less thing to worry about.

nsonha4• 5 years ago

it's docker that requires root, you don't use root yourself

stavros9• 5 years ago

It certainly is a problem. We want to run local development stacks with Docker, but, since it runs as root, it leaves files into your home directory (database and other files mounted from the guest) that are owned by root, so you can never delete them.

It's really bad UX.

hda1113• 5 years ago

Rootless Podman does this as well but with the subuid owned files. For instance you run postfix in a container and it has files owned by postfix. You can’t change the files outside of the container. You can make yourself root in the namespace and delete with podman unshare however. But it isn’t optimal from UX perspective either.

wiredfool• 5 years ago

Home directory, /etc, or /root/.ssh/authorized_keys, depending on what arguments you pass to -v.

nickjj• 5 years ago

If you create a user inside of your Dockerfile and switch to that your files will be owned by whoever is assigned to uid:gid 1000:1000 on your dev box if you use a volume mount. This solves the problem in nearly every case because your primary dev box user is almost always going to be 1000:1000. It'll work on native Linux, Windows (WSL) and macOS using Docker Desktop or not.

Here's a bunch of complete web app examples of it working: https://github.com/nickjj?tab=repositories&q=docker-*-exampl...

simnalamburt7• 5 years ago

The main motive for me to make podman-apple-silicon was due do Docker Desktop's pricing model change.

fiddlerwoaroof2• 5 years ago

Is there anyway to make docker-style Darwin containers?

takeda4• 5 years ago

I don't see reason why it wouldn't be possible. Windows did just that.

Although at that point having x86_64-linux, x86_64-windows and armv8-darwin would further remove benefits of docker reducing it to a fancy tarball.

jamesfinlayson• 5 years ago

I don't think Mac/Darwin has cgroups but it's based on BSD to it might have jails?

yjftsjthsd-h• 5 years ago

So my somewhat shaky understanding is that Apple does have some form of jails in Darwin, because they use it on iOS (hence, "jailbreaking"), but for some reason doesn't ship it in desktop Darwin (aka macOS).

takeda4• 5 years ago

A lot of people assume that, but it's only partially true.

Darwin's userland is taken from FreeBSD, the kernel is from NeXTSTEP, although it also borrowed some things from FreeBSD, but I don't think they incorporated jails[1].

[1] https://github.com/apple/darwin-xnu/search?q=jail

shilch• 5 years ago

MacOS doesn't have jails as FreeBSD does. But they are using some kind of isolation for Mac applications, so they can not see data of other applications.

kf6nux• 5 years ago

The closest you're probably going to get is sandbox-exec https://jmmv.dev/2019/11/macos-sandbox-exec.html

theThreeTuples• 5 years ago

Probably should look at https://veertu.com/

Hackbraten2• 5 years ago

Are those containers or VMs?

pojzon• 5 years ago

Demn after Docker Desktop announcment this podman gets posted almost daily on HackerNews.

I understand its a good moment do advertise, but good tools happen to advertise themselves.

stavros9• 5 years ago

good tools happen to advertise themselves.

Nothing advertises itself. People advertise things, by posting about them.

mdoms• 5 years ago

Podman, the open source alternative to the open source parts of Docker. To be clear.

slimsag4• 5 years ago

This looks more like the Podman version of Docker Desktop (which is closed source, and no longer free), effectively, as it's handling the virtualization aspects for you according to[0].

[0] https://twitter.com/simnalamburt/status/1434244533001224192

zapita4• 5 years ago

The Docker CLI is also available for Mac, and is open-source.

ur-whale• 5 years ago

the open source Docker alternative

I was under the impression that docker was open source.

I am mistaken?

slimsag4• 5 years ago

Docker Desktop (the software people must use to run Docker under any Mac or Windows machines) is closed source.

The_Colonel• 5 years ago

... and podman is not an alternative for Docker Desktop.

scandinavian• 5 years ago

You can run docker on Windows without Docker Desktop. I think the only thing that requires Docker Desktop on windows is if you want windows containers, but I don't really think that's a common usecase.

zapita4• 5 years ago

Calling podman “the open-source docker alternative” is disingenuous. The Docker engine which it competes with is also open-source. The only closed Docker product is their desktop wrapper, for which podman is not an alternative.

Podman people, you’re better than this.

kodah• 5 years ago

This has little or nothing to do with "podman people". The stuff people are talking about in the top comments have everything to do with people (and corporations) trying to figure out how to run podman efficiently on MacOS. It certainly can be done by bundling QEMU or through a VM.

Second, Docker Desktop for MacOS and Windows are not open source, hence this repository is empty: https://github.com/docker/for-win

brodock• 5 years ago

Docker is open-core.

j16sdiz2• 5 years ago

Docker Desktop is not

hda1113• 5 years ago

Docker isn’t true open source in my opinion. With true open source you can compile your own version of the software with your own changes and it works just like the official release. You can’t do this with Docker Engine afaik.

qwerty4561275• 5 years ago

Planning to buy a new MacBook for a family member I have some question to whoever is into the Apple wold: is that true that the next generation of MacBooks is going to have classic Esc&F# buttons, MagSafe, SD card reader and HDMI? When is it expected to be released? How is a MacBookPro better than a MacBookAir of the same specs (RAM&SSD)? We were going to buy a new MacBook now but the classic parts returning sound really motivating to wait.

konradkpl2• 5 years ago

We don't know anything for sure, only rumors: https://www.macrumors.com/guide/14-inch-macbook-pro/

qwerty4561275• 5 years ago

Thank you. This answer all the questions except the Pro-vs-Air difference.

lucian19004• 5 years ago

The only difference between the current Pro and Air is that the latter can thermal throttle.

I got the Air and I have managed to make it throttle while running x86 games. However, it wasn’t by much. The games remained playable.

Overall, it’s great. Very fast and entirely silent.

qwerty4561275• 5 years ago

You mean Pro can not throttle even when you want it to? It sounds nice to have a full power at my disposal when I actually want it but most of the time I want a laptop to run near its minimum power to prevent heating, avoid noise and save battery. Even when I run a computation-heavy task I still want to be able to force it to run slowed-down and take its time. Is this not possible with Pro? Even with 3-rd party tools?

sdze• 5 years ago

What hypervisor is used for that?

simnalamburt7• 5 years ago

QEMU with Hypervisor.framework patch has been used!

simnalamburt7• 5 years ago

Hi, podman-apple-silicon developer here! I want to share some FAQs about this project. :)

Q: Does this run amd64 docker images or aarch64 docker images?

A: aarch64 images currently, but I'm going to patch podman to make it possible to run both amd64 image and aarch64 image. All I have to do for this is to make QEMU call and Linux image configurable, so it won't be very hard. However, if you are running amd64 images, you will have to bear the performance overhead due to CPU emulation.

Q: Is this toy or are you actually going to maintain this?

A: I'm DevOps engineer and I made podman-apple-silicon to actually use this in my day job.

Q: Are you going to merge this to the upstream?

A: I'll keep trying, but it won't be easy unless QEMU merges Alex Graf's Hypervisor.framework patch.

I may forgot to check HackerNews, so please feel free to ask me anything about podman-apple-silicon at https://twitter.com/simnalamburt

traverseda• 5 years ago

I'm going to patch podman to make it possible to run both amd64 image and aarch64 image

From what I understand, if you had working QEMU-static and binfmt, wouldn't cross-architecture containers just work? I've used that a lot in chroots, and I'm confused as to why that wouldn't just transparently work in this case.

Are you talking about just making that process easier? Does podman enforce extra checks that prevent you from using binfmt?

simnalamburt7• 5 years ago

If you just switch the binary you’re 90% finished but there are some chores to make it perfect

1. The arguments given to the qemu should be changed by the CPU arch. For example, AArch64 uses ‘-accel=hvf’ while amd64 in Apple Silicon must use ‘-accel=tcg’. AArch64 requires ‘-cpu’ option whild amd64 does not. etc. And currently, the arguments of QEMU is half-way hardcoded to the podman source code.

2. You should change the linux image when you change the CPU arch. Currently, podman always downloads the Linux image whose CPU arch is same with host’s CPU arch. This is where configuration should be added.

3. aarch64 uses UEFI while amd64 don’t need to (I don’t know why)

nickysielicki• 5 years ago

Q: What sort of contributions/help are you looking for?

simnalamburt7• 5 years ago

A: Testing, dogfeeding, bug reports! I can handle code-related jobs but I alone cannot handle testing all variable usecases! ;) Thanks!

whckt• 5 years ago

Very nice! I’m keen to do away with the VirtualBox on my current Intel when I make the transition to M1.

nsonha4• 5 years ago

I'm not on M1 so QEMU kind of puts me off . Is there a way to use this with any of hyperkit, virtualbox, or vmware?

imwillofficial2• 5 years ago

Trust me, learn QEMU, worth the time.

nsonha4• 5 years ago

how do you mean learn it? So far I've only used these as drivers to run other things so my only concern is that QEMU is supposed to be slow. I don't really do anything directly with it.

awild2• 5 years ago

I'm curious every post on podman had a very positive thread. We were kinda forced to use podman and while we enjoy rootless containers conceptually they have caused us a lot of issues. After every restart of a node when a user had pods running, said user will not be able to use podman. Often times, bugs can only be solved by completely resetting your user. It's also not as straightforward to configure as the documentatiom let's on.

Overall I don't have an opinion on the software, it's just confusing to me how much praise it receives?

michaelcampbell• 5 years ago

bugs can only be solved by completely resetting your user.

What does "resetting your user" mean?

dotancohen4• 5 years ago

Presumably there is a config file somewhere that is causing issues. Resetting the user might be a way of saying rm -rf /home/someuser. That said, I've never used podman and this is the first that I've heard of it.

awild2• 5 years ago

I meant user config sorry.

alibarber2• 5 years ago

Podman does rely on a lot of files in the /tmp/run-... directory and this has caused us some similar issues. There was some info somewhere on how to change this to somewhere more suitable.

Sorry it's not too helpful, but might be some clues for you.

jedahan• 5 years ago

I made a dumb shell script alternative to Docker Desktop. works on M1, fork unneeded. Uses multipass and podman.

https://github.com/jedahan/podman-desktop

OneTimePetes• 5 years ago

Is the name a Blindsight reference?

seba_dos1• 5 years ago

My first reaction was "what the hell? podman has already worked on aarch64 machines for ages".

Turns out the title is missing a vital piece of information that this is a port that targets macOS.

Podman, the open source Docker alternative ported to M1 (Apple Silicon) machines

Related Stories