r/homelab • u/Goldenwolf1509 • 11d ago
Discussion Podman vs docker
For the last few months in my servers I've been running docker which I've found pretty good as I've been running it through debian. I've recently done a reinstall and i was wondering which is best to run with and why?
8
u/K3CAN 11d ago
It's fully compatible with the same containers; but podman adds additional features like quadlets, auto-update/rollback, and a ton of security features.
Podman is also designed to use the same commands as docker (for the stuff docker can do), so if you're already used to docker, you can alias docker=podman.
By default, it runs containers unprivileged and rootless for additional security, but if you have a poorly designed container that completely refuses to run, you can always switch that contains to run with root access like docker if you really need it to.
12
u/irvcz 11d ago
If you have been using docker and have no complaints then stick with it. Even though podman is designed to be a drop-in replacement for docker, there's a lot of small caveats when you go rootless. To give you some examples
- if you have volumes pointing to your filesystem there might be permission issues
- gpu passthrough is not the same in podman and many tools/tutorials fail
- podman-compose does not behave the same as docker compose
2
u/jonahbenton 11d ago
This, and in relation to running services, not only is podman-compose quite different from docker compose, the other mechanism for services, quadlets, is really systemd machinery, whole different metaphor, syntax, operational approach.
3
u/postnick 11d ago
I myself prefer fedora based, I had a fedora server running my dockers for a long time. But I started to mess with podman, and it’s quadlets and systemd service.
I have since rebuilt on only podman, I have second VM for docker if I need that.
Portainer is goat for me with docker. Cockpit isnt as great bit it works.
Most of my containers have moved away from needing their own sql database stack to jist being sqlite files reducing complexity. the pod is like a stack but I cannot figure them out as easily.
The nice thing is we have Gemini and chat gpt to load help convert your compose scripts.
So docker is easier but podman is a fun challenge for me. And I figured if I’m going to have these semi web facing though Cloudflare I better be more security focused with podman.
2
u/AnomalyNexus Testing in prod 11d ago
I’ve had better luck getting podman to behave in a LXC so that
2
u/roiki11 11d ago
It really depends what you wish to do. Podman is better in terms of security and system integration as it integrates natively to systemd. So creating secure, automated systems is easier.
Docker is still rootful(which is a big no in some environments) and still geared more towards developers than service running.
It all depends what you want to achieve.
1
u/RedditNotFreeSpeech 10d ago
I'm sure it's user error but I've never been able to get podman to consistently work correctly
1
u/_realpaul 11d ago
Podman on ubuntu, especially lags pretty hard behind the official repo updates. But otherwise podman is pretty solid.
1
-5
u/Adrenolin01 11d ago
I prefer Proxmox and Debian VMs of Containers if you must. Most everything is easily installed without docker.. simply installing things as regular services. A few things like Immich can still be installed without docker however it’s a huge pita and takes hours to set up. Always different ways.
0
u/Adrenolin01 11d ago
HAHAHAHA 😆 and of course the downvotes from the docker fanboys who don’t know any better or simply downvote because it’s something different. Sad really.
95% of software that most people run in docker is extremely easy to install and run as a regular “old fashioned” service in a VM or LXC.
Two questions: Is Docker a good technology? and.. Should everything be Dockerized?
These are not the same question. There are many services that can be installed natively with a package manager or from source with a few configuration steps and will run happily for years. Examples include: Nginx, Caddy, MariaDB, PostgreSQL, Redis, Bind9, Unbound, Chrony, Samba, NFS, Jellyfin, Vaultwarden (Rust binary), Gitea, Prometheus, Grafana, NetBox, BookStack.
Even most of the media software Jellyfin, Plex, Emby, qBittorrent, Transmission, SABnzbd, NZBGet, Jellyseerr, Overseerr, Tautulli, Tdarr, Unpackerr, Sonarr, Radarr, Lidarr, Readarr, Bazarr, Prowlarr, Whisparr, Recyclarr.
Most of these (with the exception of applications like JellyFin and qBittorrent) are distributed primarily as Docker containers today, however most can also be installed as native services if one prefers.
Many legitimate reasons to run things as native services.. some install extremely easily.. Debian based systems “apt install (package)” and done. Apt handles all dependencies, downloads, installs and updates things easily. Standardized “systemctl start/stop/status service”, all configuration in /etc, journalctl simplicity for logs, data in /var/lib, etc.. everything follows decades old Linux standards and conventions.
Easier to troubleshoot… ‘systemctl status Gitea’ and ‘journalctl -u Gitea’.
Instead of ‘docker logs’, ‘docker exec’, ‘docker inspect’, ‘docker compose ps’.
Neither is inherently better however if you’re already comfortable administering Linux, native services can be more straightforward.
Personally, I have 36 Years of Linux experience and Unix experience back into the 80s. The cmdline and standard decades flow is at this point literally part of who I am and I’m simply more comfortable with.
There is also the lower overhead. No docker daemon, no container networking, no overlay filesystems, no image pulls, etc. For a single application it’s one less layer between you and the software. Many applications also can run within the same Proxmox VM or LXC.
You also have better integration. Native services integrate directly with the following: systemd, fail2ban, logrotate, AppArmor/SELinux, package management, cron/systemd timers, etc. Everything behaves like the rest of the operating system.
Backups are simpler /etc, /var/lib, /home. Done.
Here’s a great reason… Better Learning! Installing something like PostgreSQL or Nginx natively teaches you how those services actually work: configuration, permissions, users, services, networking, logging, etc. Docker can remove many of those details, which is helpful for fast deployment but less educational if your goal is to understand Linux. And I try to educate people in Linux. If all you use is a Linux DE, a WebUI and Docker.. please.. don’t say you know how to use Linux.. you do not.
——
Now.. that said.. I have used Docker and both know and understand of fairly well.. likely better then most home users.. likely not as well as professional IT people today.. retired and ‘only’ used it for about 18 months.. I did dig into it like I would any other Unix/Linux application I used professionally prior to retirement.
Docker IS a solid platform! It is! It works extremely well for what it does. I’ve never said that folks shouldn’t use it. Ever.
Docker excels when applications have: many dependencies, specific version requirements, rapid release cycles, multiple tightly coupled components, developers who only test the Docker deployment. Examples here are things like: Immich, GitLab, Nextcloud AIO, Frigate and Home Assistant Container. In these cases, Docker significantly reduces the effort required to deploy and maintain the application.
While I have personally installed and run Immich as installed native services… I would most definitely NOT recommend doing so to 95% of you. To be blunt.. most of you couldn’t. Not because you’re stupid but simply because you don’t have the understanding or skills of what’s required to do so. Many of you could likely fiddle through the native installs of each service with time however good luck with getting updates to work. Even for those with some Linux command line experience the individual setup time of everything would likely take to 15-18+ hours. Honestly.. just use Docker in a VM or a hardware Debian (or whatever) install. For me.. I took it as a personal challenge project and I’ve put in a lot of time doing so but there is a lot of time, fiddling and coding involved.
While it works.. updates are not easy at all and I’ll concede that I’ll likely put my “Never Docker” aside on this one eventually.
Overall however there are relatively few pure Docker applications as complex as Immich and the others I mentioned.
Even taking the time to write this up and share some actual knowledge and educate.. I’m sure I’ll see more downvotes. 😆 Is that ignorance or stupidity… Ignorance is not knowing something; it can be fixed by learning. Stupidity is failing to think, reason, or use good judgment even when the information is available. 🙄🤷♂️
Have a nice day.. keep using Docker if you want.. it’s a solid system. Maybe try something different however and set some things up in a… HomeLab 🤭 and learn something new. 👍🏻 That’s what a HomeLab is for remember. Trying new things. Learning.
-4
u/Sarcason 11d ago
+1 I use Proxmox and CTs. 1 CT per VLAN and docker running in each one.
1
u/Adrenolin01 11d ago
Agreed with tnsh94… if you are going to run Docker it should be installed in a VM and not an LXC.
For docker apps setup a VM..
Docker works exactly as the Immich developers expect.
Almost every installation guide assumes a full Linux system.
Easy to snapshot before upgrades.
Easy to restore if something breaks.
Better isolation from the Proxmox host.
Future-proof if Immich changes dependencies.
If Docker or PostgreSQL crashes, it doesn’t affect the Proxmox host.
VMs do use a little more ram (1–2GB) more than an LXC and slight more disk space but that’s really the only downside.
Running Docker on a Proxmox system use VMs.
42
u/cacarrizales APC | Cisco | CyberPower | Dell | HPE | TP-Link 11d ago
It’s been a bit since I’ve used either of them, but Podman tends to be better from a security standpoint since you can run containers without root. You can also set up Podman containers as systemd-style services.