Dominik Szymański's article "Why I Ditched Docker for Podman (And You Should Too)" argues for migrating from Docker to Podman, primarily citing Docker's daemon-centric, root-privileged architecture as a significant security vulnerability and resource hog. Podman is presented as a superior, daemonless, and rootless alternative that offers enhanced security, lighter resource usage, and seamless integration with Linux system management (Systemd) and Kubernetes workflows. The author highlights the ease of migration due to CLI compatibility and Dockerfile reusability, providing a FastAPI application migration guide as a practical example.
The accompanying Hacker News discussion reveals a mixed but generally supportive sentiment towards Podman, acknowledging its security and operational benefits. Users frequently echo concerns about Docker's licensing and corporate procurement complexities. However, many also detail practical challenges with Podman, including compatibility issues with complex Docker setups, varying performance (especially in rootless networking), and installation difficulties on non-Red Hat Linux distributions. The debate extends to the efficacy of rootless containers for true security, the role of alternative tools (Rancher Desktop, OrbStack, Colima), and the trade-offs between containerization complexity and simpler deployment methods.
Why I Ditched Docker for Podman (And You Should Too)
0:00 Early Docker Excitement: The author, a long-time industry professional, initially embraced Docker for its revolutionary approach to reproducible, isolated development environments, using it as a go-to solution.
0:00 Docker's Core Vulnerability: Over time, concerns grew regarding Docker's persistent, root-privileged dockerd daemon, identifying it as a single point of failure and a significant security risk, evidenced by a list of CVEs (CVE-2019-5736, CVE-2022-0847, CVE-2022-0492, CVE-2024-21626, CVE-2024-23651/23652/23653).
0:00 Podman: Daemonless Architecture: Podman's fundamental appeal is its daemonless design, where containers run directly as child processes of the user's command, eliminating a persistent, root-privileged background service.
0:00 Enhanced Security: This architecture drastically reduces the attack surface; even if a container's privileges are escalated to root internally, it remains an unprivileged user on the host system.
0:00 Improved Reliability & Resource Footprint: Podman offers a more robust system as a single container crash does not affect others, and the absence of a constantly running daemon leads to lower memory usage and a lighter resource footprint.
0:00 Systemd Integration: Podman excels in Linux server environments by natively generating systemd unit files, allowing containers to be managed as first-class citizens in the service ecosystem, including automatic restarts and resource limits.
0:00 Kubernetes Alignment: Designed with Kubernetes in mind, Podman supports native pods for prototyping multi-container applications locally and can generate Kubernetes YAML directly using podman generate kube.
0:00 Unix Philosophy: Podman adheres to the Unix philosophy by focusing on container execution and delegating specialized tasks like image building (Buildah) and inspection (Skopeo) to purpose-built tools.
0:00 Seamless Migration: Switching from Docker to Podman is described as almost seamless, with existing Dockerfiles working without modification and common commands like podman run behaving identically to their Docker counterparts, often enabling a simple alias docker=podman.
0:00 Common Migration Gotchas & Solutions:
Privileged Ports: Rootless Podman prevents binding to ports below 1024, enforcing better architecture through reverse proxies.
Volume Permissions: Quirks exist, but they promote better security practices by limiting attack scope.
Docker Socket: Podman can expose a Docker-compatible API if legacy tools require it.
Docker Compose: Complex workflows can be converted to Kubernetes YAML for consistency.
0:00 Real-World Benefits: The author reports better sleep due to improved security and cleaner resource usage patterns after six months of using Podman in production, advocating it as an evolution in container technology for new projects.
0:00 Practical FastAPI Migration: A step-by-step guide demonstrates migrating a FastAPI application, covering Dockerfile usage, image building (podman build), container execution (podman run), systemd deployment (podman generate systemd), multi-service pods (podman pod create), and Docker Compose compatibility (podman-compose or kompose).
Hacker News Discussion Summary:
Docker's Enduring Value: Many users defend Docker for its proven reproducibility, ease of dependency management in complex microservice architectures (45+ services cited), and solving the "it works on my machine" problem across diverse OS environments (macOS, Debian, NixOS, Windows WSL). It's also praised for its massive ecosystem and tooling.
The "Docker Overhead" Debate: Some argue that Docker's daemon, resource usage, and the complexity of docker-compose are unnecessary for simpler deployments, with a preference for git push live master or simple bash scripts/VMs.
Licensing as a Migration Driver: Docker Desktop's paid license for larger enterprises is a major "deal breaker" for many, not due to the cost itself, but the associated procurement bureaucracy, vendor management, and compliance overhead. This pushes companies towards free alternatives.
Podman's Perceived Advantages (Confirmed by Users):
Daemonless/Rootless Security: Widely appreciated for reducing the attack surface, though some argue it's not a complete security panacea compared to VMs.
Systemd/Kubernetes Integration: Praised for native systemd unit file generation and podman generate kube for K8s YAML, which aligns development with production environments.
Resource Efficiency: Many report lighter resource usage and better performance compared to Docker Desktop, especially on macOS.
Seamless CLI (for simple cases): Users confirm that alias docker=podman often works for basic operations.
Rootless Mode Pain Points: Frequently cited issues include volume permission quirks, UID/GID mapping complexities, and interaction with SELinux (on Fedora/RHEL). Solutions often involve specific mount options (:z, :Z) or careful configuration.
Docker Compose Incompatibility:podman-compose is often described as not a 1:1 drop-in replacement, with missing features (e.g., watch), different behaviors, and performance issues. Some suggest using Docker Compose v2 (Go implementation) with Podman or converting to Kubernetes YAML with kompose.
Distribution & Updates: The lack of official, up-to-date .deb packages for Ubuntu/Debian is a significant barrier, leading to outdated versions or complex manual installations.
Networking Issues: Reports of "unreliable" networking with random disconnects and packet drops, particularly with complex services or kubectl port-forward. Rootless networking performance can be slow with slirp4netns (improved with passt/pasta in Podman 5.0).
General Flakiness/Bugs: Some users report persistent "wonky bugs," strange errors, or certain containers failing to run reliably compared to Docker.
Alternative Container Runtimes & Tools:
Rancher Desktop: A popular free alternative to Docker Desktop, offering Docker-compatible CLI and local Kubernetes.
OrbStack: Highly praised for macOS for its speed, UI, resource efficiency, and features (local K8s, custom VMs, debug shell), despite being a paid product.
Colima: Another Docker Desktop alternative for macOS, generally well-regarded but with occasional brew update breakage.
NixOS: Mentioned as an alternative for declarative, reproducible environments, though with a higher learning curve.
FreeBSD Jails, QEMU, systemd-nspawn, nerdctl, Apple Container: Also discussed as various containerization or virtualization options.
Security vs. Convenience: A recurring theme is the trade-off between absolute security (often requiring full VMs like Firecracker, as used by cloud providers) and the convenience of containers. Rootless containers are seen as a good compromise, but not perfect.
"Old Man Yells at Cloud" Sentiment: Some arguments against containers are dismissed as resistance to new layers of abstraction or a lack of understanding of complex modern deployment needs.
Conclusion: Podman is seen as a strong evolution in container technology with significant advantages, especially for security-conscious and Linux-native deployments. However, Docker's massive momentum, mature ecosystem, and 1:1 compatibility (where Podman still struggles) mean it retains a dominant position, particularly for local development on non-Linux platforms or with complex legacy setups.