Larvitz  1d ago

Running Podman  in production for years now, and I don't miss the Docker daemon one bit.

I just published a deep dive on managing OCI containers the Unix way: daemonless, rootless, and natively integrated with systemd via Quadlets.

I cover:
- Real secrets management
- Auto-updates via systemd timers
- The Docker compatibility layer

This is the guide I wish I had when making the switch.

Read it here: https://blog.hofstede.it/podman-in-production-quadlets-secrets-auto-updates-and-docker-compatibility/

#Podman #Linux #DevOps #Systemd #Homelab #Sysadmin #Containers

Podman in Production: Quadlets, Secrets, Auto-Updates, and Docker Compatibility

An opinionated production-ops guide to Podman on Linux servers - why I prefer it over Docker, how Quadlets replace Compose files, and practical patterns from real deployments including secrets mana...

Larvitz Blog
Show threadpixelschubsi12h ago

@Larvitz So the post starts with how podman is great because it supports rootless containers and then goes at length to describe a full example setup of not using rootless containers.

I do struggle with a great setup of podman rootless in production setups. More documentation on that would be much appreciated - like having the full forgejo example just rootless.

Show threadLarvitz  12h ago

@pixelschubsi Even rootful, Podman has the advantage of cleanly forked, seperate processes and the absence of a central daemon. That's already a better security posture than Docker has and it simply feels "cleaner".

I did opt for rootful containers in my setup because of the networking. If I'd run containers in user-contexts, then my Traefik setup with automatic ingress routing based on labels wouldn't work so frictionless, because the networks are user-specific and countainers wouldn't be able to find each other.

I run some containers rootless ($HOME/.config/containers/systemd/*.container), but that's usually not web-applications.

Show threadpixelschubsi
@Larvitz
Yeah, that's what I meant with things get more complicated when running rootless. I have a hacky setup where I have one user per pod and each user/pod gets its own ip address (I happen to have a few available), but I don't really like it either, hence I was looking for alternatives.
9:42amWeb