Since late June, I've been looking at Podman and considering making it my default tool for building container images and running containers.
That has gone great. I'm using Podman to build all of my images, including multiplatform ones, both from the command line and in GitHub actions. I've replaced my Nomad installations with collections of Podman Quadlets that run IO in root mode (for now) and all of my applications in rootless mode. I've also found that it's easy to set up sandboxes that force all application network traffic through IO.
There are other ways to use IO, but for now, my main focus is on using IO with Podman and finding ways that this can be made even better and easier.
Pros
- Podman is rootless, appears simpler than Docker, and has interesting integration with systemd.
- Quadlets allow me to use
systemdfor job monitoring and restarts without the (bloat) complexity of multi-node container managers like Nomad and Kubernetes.
Cons
- Hefty multi-node container managers have more features and are basic expectations for some users.
Notes
I used this to build an IO image with Podman:
podman manifest create io
podman build --platform linux/amd64,linux/arm64 --manifest io .
Multiplatform builds required qemu:
sudo apt-get install qemu-user-binfmt
IO is often used to listen to low ports, and for that it should be run with host networking. This runs IO with host networking and a volume that mounts the default directory used by local IO binaries.
$ podman run --volume /home/tim/.local/share/io:/io --network host io
Another way to allow IO to bind to low ports is to follow this discussion and make this configuration change to your host:
sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80