<story><title>Exploring Podman: A More Secure Docker Alternative</title><url>https://betterstack.com/community/guides/scaling-docker/podman-vs-docker/</url></story><parent_chain><item><author>tekeous</author><text>Podman was good when it supported systemd unit files, so I could auto start and auto update containers, even entire pods with systemd.&lt;p&gt;Then they removed that in favor of Quadlet. Now in order to do a single container I can do a unit file, but for a pod, I need to use a Kubernetes cluster definition.&lt;p&gt;Plus, unlike Docker their containers bow to SELinux definitions, so I have repeatedly struggled with containers unable to access mapped directories.&lt;p&gt;So what is it, Podman? Should I just use Kubernetes? Should I just make dedicated directories for everything instead of mapping logical places for things?</text></item></parent_chain><comment><author>lolinder</author><text>I already was defining my infrastructure with docker-compose.yml files, and found out that podman-compose has a poorly documented feature that generates systemd units. It doesn&amp;#x27;t use the now-deprecated podman feature, it writes the unit files itself, and I find the process much smoother than the podman feature anyway.&lt;p&gt;To enable the feature:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    $ podman-compose systemd -a create-unit
&lt;/code&gt;&lt;/pre&gt;
To register a systemd unit:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    $ podman-compose systemd -a register
    $ systemctl --user enable --now &amp;quot;podman-compose@$PROJECT_NAME&amp;quot;
&lt;/code&gt;&lt;/pre&gt;
Updating looks like this:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    $ podman-compose pull
    $ systemctl --user restart &amp;quot;podman-compose@$PROJECT_NAME&amp;quot;
&lt;/code&gt;&lt;/pre&gt;
($PROJECT_NAME is usually the directory name.)&lt;p&gt;Source code for the feature is here if you care to inspect it:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;containers&amp;#x2F;podman-compose&amp;#x2F;blob&amp;#x2F;f6dbce36181c44d0d08b6f4ca166508542875ce1&amp;#x2F;podman_compose.py#L1817-L1896&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;containers&amp;#x2F;podman-compose&amp;#x2F;blob&amp;#x2F;f6dbce3618...&lt;/a&gt;&lt;p&gt;Admittedly, I&amp;#x27;m still on podman 4.3.1, but I don&amp;#x27;t see any reason why this would stop working in later versions of podman.</text></comment>
<story><title>Exploring Podman: A More Secure Docker Alternative</title><url>https://betterstack.com/community/guides/scaling-docker/podman-vs-docker/</url></story><parent_chain><item><author>tekeous</author><text>Podman was good when it supported systemd unit files, so I could auto start and auto update containers, even entire pods with systemd.&lt;p&gt;Then they removed that in favor of Quadlet. Now in order to do a single container I can do a unit file, but for a pod, I need to use a Kubernetes cluster definition.&lt;p&gt;Plus, unlike Docker their containers bow to SELinux definitions, so I have repeatedly struggled with containers unable to access mapped directories.&lt;p&gt;So what is it, Podman? Should I just use Kubernetes? Should I just make dedicated directories for everything instead of mapping logical places for things?</text></item></parent_chain><comment><author>bonzini</author><text>&amp;gt; unlike Docker their containers bow to SELinux definitions,&lt;p&gt;That&amp;#x27;s a bug in docker. If your system isn&amp;#x27;t configured for SELinux, disable it.&lt;p&gt;Also the systemd files generated by podman-generate-systemd are just executing &amp;quot;podman start containername&amp;quot;, you can write them on your own easily but (unlike e.g. docker-composr) the containers are black boxes pretty much.&lt;p&gt;The advantage of quadlet is that the definition of the container is declared in the .container file; before I used to write the podman run command line manually in a handwritten systemd unit, and quadlet is a big improvement in that respect and can be an alternative to docker-compose (with advantages and disadvantages).</text></comment>