Podman Quadlets with Podman Desktop

https://podman-desktop.io/blog/podman-quadlet

by teleforce • 1 year ago

180 85 1 year ago

nashashmi• 1 year ago

I have been trying to use podman with docker containers to avoid the docker license fee, yet to no avail. Wish there was a tutorial. The docker desktop is a nice interface to interact with containers and podman did not have that last time I checked.

edit: Looks like it changed quite a lot. this looks so much nicer

edit2: I still need a tutorial. had so many errors come up. :(

mdaniel3• 1 year ago

I don't want to dissuade you from Podman Desktop, because Podman is awesome in its own way, but I do hear you about the "uncanny valley" part.

I wanted to offer that you don't have to jump all the way to podman (and Podman Desktop) just to escape the Docker Desktop licensing problem. There are a lot of alternatives which a whole spectrum of "I am CLI savvy or not" interaction experiences

- Rancher Desktop is A++ and carries a friendly license https://rancherdesktop.io/ -> https://github.com/rancher-sandbox/rancher-desktop/blob/v1.1...

- colima (and the lima it wraps) -> https://github.com/abiosoft/colima#readme

- there's one from AWS called Finch <https://github.com/runfinch/finch> that some of my colleagues like better than colima; YMMV <https://aws.amazon.com/blogs/opensource/introducing-finch-an...>

kristianp• 1 year ago

What OS are you running it on?

chuckadams• 1 year ago

If you’re on a Mac, I highly recommend OrbStack. Perfect Docker compatibility so far, actually better Rosetta support than Docker itself.

infogulch3• 1 year ago

Quadlets came up recently:

Quadlet: Running Podman containers under systemd (mo8it.com) | 298 points | 68 comments | https://news.ycombinator.com/item?id=43456934

Where do quadlets fit in the container management landscape?

Running individual services that would have been RPMs? Docker compose? K8s?

WesolyKubeczek2• 1 year ago

I run container sets (like you'd probably run with docker-compose) as systemd services using this.

infogulch3• 1 year ago

How do you manage and deploy it? Git a systemd directory?

pydry12• 1 year ago

quadlets is an answer to the question "but what if we also threw a docker compose substitute into the systemd kitchen sink"?

steeleduncan3• 1 year ago

Running individual services that would have been RPMs?

Essentially this. Rather than adding anything on top of systemd (which is almost certainly running anyway) quadlets are a way of turning containers into systemd units, and directing systemd to run them

I think it is the lightest weight, but still convenient, way of running a container as a daemon, with all the pros and cons that implies

andreldm2• 1 year ago

I have a RPi 2 that’s more than enough for my home server needs and I’ve tried to migrate from docker to podman, it simply failed miserably with weird errors, on my laptop everything worked fine, so maybe that’s an issue with Arch ARM or the 32-bit version of it, but really, I wish they could abstract away quadlet, service files generation and so on.

Alupis• 1 year ago

If you install the `podman-docker` package, you get compatibility with docker commands. If you have errors during runtime, it's probably something in your container/config that's assuming a docker socket/runtime. Some of which can be remedied by pointing `DOCKER_HOST` to your podman socket, etc.

andreldm2• 1 year ago

The problem wasn’t running the containers with plain podman, they worked. Auto restart is something podman delegates to quaqlet/systemd, I tried to migrate my docker-compose files to quadlet’s config, the containers were up, supposedly listening to the bound ports but connecting simply didn’t work. I tried rootless, slirp4netns and pasta, nothing worked, then I gave up, some other day I might try again.

orthoxerox• 1 year ago

What is the killer feature that will make me want to switch from Docker Compose to Podman Quadlets?

dharmab3• 1 year ago

I prefer quadlet for 2 reasons:

1. Podman is simpler than Docker. There is no long-running daemon. Rootless is default.

2. Quadlets can be managed as systemd services, giving me the same tools to manage and view logs for system daemons and containers.

Quadlets have been especially nice for bundling up an AI app I wrote as a cloud-init file, making it easy to deploy the hardware, software and models as one artifact.

pydry12• 1 year ago

quadlets == systemd which requires root to run. this is NOT the same thing as "systemd cant run non root containers". OBVIOUSLY it can, just as docker can run non root containers.

Making systemd a necessary dependency to run > 1 container kinda negates many of the the nice advantages that podman has of not requiring root.

podman compose doesnt require root and would serve as a substitute but it's a very neglected piece of software.

steeleduncan3• 1 year ago

Podman seems to have lower memory overhead than Docker. I assume that is a consequence of your point 1

eriksjolund3• 1 year ago

Podman quadlet supports "Socket activation of containers" https://github.com/containers/podman/blob/main/docs/tutorial... This allows you to run a network server with `Network=none` (--network=none). If the server would be compromised, the intruder would not have the privileges to use the compromised server as a spam bot. There are other advantages, such as support for preserved source IP address and better performance when running a container with rootless Podman + Pasta in a custom network.

infogulch3• 1 year ago

That's neat. Does it require 1 connection = 1 process to work? I don't see how you can have a long running server with this feature.

anonfordays• 1 year ago

What's old is new again. That's effectively how inetd worked circa 1986. The inetd daemon had some serious security vulnerabilities so the world move away from using "socket activated daemons" to having always listening services (performance reasons as well).

philips• 1 year ago

I really like the user namespace handling `--user-ns=keep-id`. It makes it easy for me to create a new Linux user and then have that user run some container and have bind mounts, etc just work correctly. It is the least fuss way I have found of running little services that need access to the host filesystem.

https://docs.podman.io/en/latest/markdown/podman-run.1.html#...

tiew9Vii• 1 year ago

For local development I found no advantages, if anything I found it a little less convenient.

For servers where you don’t need the complexities of Kubernetes etc, using Quadlets is nice as you can manage containers as regular systemd services and no Docker daemon running as root.

scheme271• 1 year ago

The biggest one is probably that podman runs as a user and doesn't need suid normally. So you can run services and have more assurances that container breaches won't give someone root on your system.

jabl• 1 year ago

For a docker-compose replacement you should probably look at the 'podman kube' support. That supports a subset of the kubernetes API that roughly matches the docker-compose features.

Then for deployment to a Kubernetes cluster you can reuse your podman kube yaml.

For deployment to a single machine where the full Kubernetes is overkill, you can use the podman quadlet support. Quadlets support a "[Kube]" section where you can point to the yaml file, so you don't have to write all your port and volume etc mappings again in a slightly different syntax.

discardable_dan• 1 year ago

And why are they called quadlets?

pjd7• 1 year ago

I started looking into podman quadlets on the weekend. All because docker & nft (nftables firewall) don't play nice together.

I have my finely crafted nftables ruleset that I want to keep. Docker is going to abuse the crap out of my ruleset/make me jump through extra hoops to have it work.

Having the containers operate under systemd looks fine (ignoring the fact that it is systemd, I guess I have finally accepted systemd is here to stay).

I was interested in using traefik & docker labelling to have ingress sorted out and I believe this will all play nicely enough to replace docker-compose on a single server.

esseph5• 1 year ago

If you are an individual dev and coming from the docker swarm / compose world, podman will drive you mad.

If you are a sysadmin / platform engineer / etc type familiar with kubernetes / k3s, podman has some pros and cons about it that make working in that ecosystem (systems, platforms) much nicer to manage.

What we are missing right now is a bridge between the two that podman-compose doesn't exactly fulfill for a lot of people.

haolez• 1 year ago

This made me remember Fleet[0], which I used in the past on CoreOS. It was a very good abstraction for my simple cluster. It felt as robust as a managed cloud service. It's a shame it didn't catch on (and also what happened to CoreOS).

[0] https://github.com/coreos/fleet

mdaniel3• 1 year ago

(and also what happened to CoreOS)

Arguably worse, IMHO, is that the name lives on but does something wholly different, polluting search results

Anyway, I wanted to plug Flatcar which forked CoreOS back when the nonsense started and have been pretty pleasant to work with. They are still misguided about user-data management, and have since been acquired by Microsoft(!), but the code lives on https://github.com/flatcar/Flatcar#readme and https://www.flatcar.org/docs/latest#upgrading-from-coreos-co...

ldmosquera• 1 year ago

Small note - https://github.com/flatcar/Flatcar has no code in any branches:

Flatcar project repository for issue tracking, project documentation, etc.

Per the building page https://www.flatcar.org/docs/latest/reference/developer-guid...

the actual code seems to be at https://github.com/flatcar/scripts.git

esseph5• 1 year ago

Hm. I'm actually deploying some CoreOS systems this weekend as a test.

sudomateo• 1 year ago

Thanks for sharing this. For some reason I haven't heard of Podman Quadlets until this post. I can think of a few places where Quadlets would work better than Kubernetes or Compose. I'll give them a tinker.

bjackman• 1 year ago

Yeah I recently put together a home NAS and was dismayed that I had to use Docker Compose. (There's podman-compose but it's... incomplete).

Immediately after I finished the project I discovered the Quadlet thing!

Seems like the userbase is there, the technology is there, and now the two just need to be put together with some awareness.

bjoli• 1 year ago

Can I use podman desktop to manage my quadlets on a server over ssh? That would be awesome.

axel7083• 1 year ago

I would say yes, but never tried:

1. enable remote connection in podman desktop (https://podman-desktop.io/docs/podman/podman-remote)

2. try the quadlet extensions (https://podman-desktop.io/blog/podman-quadlet)

I am curious to have feedback if you give it a try (https://github.com/podman-desktop/extension-podman-quadlet/i...)

Havoc• 1 year ago

Is this essentially a compose file in systemd format? Or is there some other complexity that I’m missing

esseph5• 1 year ago

Yes and no.

This is more a bridge between system level container orchestration and kubernetes.

cassepipe• 1 year ago

Some help in case you got lost in the terminolgy as I did :

Containers: Encapsulate application and its environment

Pods: Group one or more containers in Kubernetes

Kubernetes: Orchestrates containers across clusters.

Quadlets: Declarative container management with Podman and systemd

Podlet: Tool to generate Quadlet file from existing podman configuration

esseph5• 1 year ago

Podlet is more than that.

It will generate Podman Quadlet files from a Podman command, docker / compose file, or existing object. It can also create kubernetes pod yaml.

Podman Quadlets with Podman Desktop

Related Stories