Exploring Podman: A Extra Safe Docker Different

Containerization has turn out to be a vital device for builders and system
operators to package deal and deploy functions on varied methods and platforms
effectively. Many containerization options exist right now, however no doubt,
Docker has emerged because the de facto commonplace. That is largely as a consequence of its
glorious tooling, robust neighborhood, and huge ecosystem of pre-built photos that
will be simply shared and used throughout completely different environments.

Docker has held this place for a few years, and it has actually revolutionized
how functions are shipped. On the identical time, its vast adoption impressed the
growth of many different containerization options providing much more options
and capabilities. One such answer is Podman.

Podman is an open-source container engine that goals to supply a safer and
light-weight different to Docker. It permits customers to run containers with out
requiring a daemon, making it simpler to handle and deploy containers on a
number of methods. Moreover, Podman provides higher safety defaults by means of
options corresponding to rootless containers (i.e., operating containers by means of non-root
customers), person namespaces, and a extra cautious utilization of kernel capabilities,
all of which may defend the host system from potential vulnerabilities and
safety threats.

With its rising neighborhood and shut compatibility with Docker photos and
instructions, Podman has gained vital traction amongst builders and system
directors searching for different containerization options.

On this article, we’ll discover among the key options and advantages of utilizing
Podman as a containerization device. We’ll additionally focus on the way it compares to Docker
and see why it has turn out to be a preferred different selection within the trade.

Let’s dive proper in.

Stipulations

Earlier than continuing with this text, be certain that you meet the next
conditions:

• Good Linux command-line expertise.
• Prior expertise with Docker.
• (Non-compulsory) A Docker Hub account to observe the non-public registry setup examples.

Podman vs Docker Comparability

Whereas each Podman and Docker permit customers to run, handle, and deploy containers
in an environment friendly and scalable method, there are some key variations between the
two. On this part, we’ll discover a number of of those variations:

1. Structure variations

One of many important variations between Podman and Docker lies of their
structure. Whereas Docker depends on a client-server mannequin, Podman employs a
daemonless structure. With Podman’s method, customers handle containers
immediately, eliminating the necessity for a steady daemon course of within the
background. This direct administration usually leads to Podman containers launching
considerably sooner, typically as much as 50% faster than Docker, relying on the
picture used.

This structure additionally enhances safety. In Docker, initiating a container
means sending a request to the Docker daemon through the Docker shopper which
subsequently launches the container, which implies that the container processes
are youngsters of the Docker daemon, not the person session:

In consequence, any vital occasion coming from a container course of that is picked
up by the Linux Audit system (auditd) specifies its audit person ID as unset
fairly than the precise ID of the person who began the respective container in
the primary place. This makes it extraordinarily tough to hyperlink malicious exercise to
a selected person and taints the safety of the system.

With Podman, since every container is instantiated immediately by means of a person login
session, the container course of information retains this info and auditd can
precisely detect and checklist the ID of every person who began a selected container
course of, sustaining a transparent audit path.

2. Container lifecycle administration

The absence of a daemon in Podman results in a definite method to managing
container lifecycles in comparison with Docker. On Linux, Podman depends extensively on
Systemd for this function. As an illustration, to accurately
implement restart insurance policies for containers utilizing the --restart all the time flag,
Podman depends on a systemd service known as podman-restart. This service
robotically restarts all designated containers after every system reboot.

Furthermore, Podman exposes a helpful command for producing Systemd service recordsdata
from operating containers. This lets you convey your containers below
systemd administration to begin, cease, and examine the varied providers operating
inside them extra simply. In distinction, Docker handles all these duties
internally by means of the daemon itself.

3. Container orchestration

When growing domestically, Docker customers usually attain for
Docker Compose to outline and handle
multi-container functions extra simply. Whereas Podman would not help Compose
recordsdata out of the field, it supplies a appropriate different known as
Podman Compose, which usually
works seamlessly with current docker-compose.yml recordsdata. For a local
expertise, you might also use pods, an idea that Podman borrows from
Kubernetes and permits customers to handle a gaggle of
containers as one uniform unit.

In the case of manufacturing deployment, Podman lacks a device like
Docker Swarm for orchestrating
multi-container software workloads. The absolute best different in such
circumstances is to make use of an exterior orchestration system corresponding to Kubernetes, which
provides comparable options and integrates nicely with Podman, though it could require
some extra configuration and setup to make sure that all the pieces works
accurately.

4. Safety issues

Containers intention to isolate functions from the host system securely, minimizing
compatibility points and enhancing safety. A main safety concern is the
threat of container breakout, the place an attacker might compromise the host system.
To mitigate such dangers, operating containers with minimal privileges is important.

Podman is designed to assist with this by offering stronger default safety
settings in comparison with Docker. Options like
rootless containers,
user namespaces, and
seccomp profiles, whereas
out there in Docker, aren’t enabled by default and infrequently require additional setup.

Podman’s default setup contains rootless containers operating in remoted person
namespaces, limiting the affect of any potential breakout. In distinction, Docker’s
default setting runs container processes as root, posing the next threat in case
of a breakout.

Furthermore, Podman containers, tied to person classes, permit audit methods to hint
malicious actions again to particular customers, in contrast to Docker, the place tracing to a
person is difficult because of the system-wide daemon.

Podman and Docker use Linux kernel capabilities and seccomp profiles to manage
course of permissions. By default, Podman launches containers with a narrower set
of 11 capabilities in comparison with Docker’s extra permissive default setting of 14
capabilities.

Usually, whereas each Podman and Docker will be configured for sturdy safety,
Podman usually requires much less effort to succeed in a safe configuration.

Be taught Extra: Docker Security: 14 Best Practices You Should
Know

To sum it up, each Docker and Podman are succesful instruments, and figuring out the primary
variations between the 2 may also help you select the best one to your particular
wants. Please check with the desk beneath for among the main variations between
the 2, and you’ll assume full parity for many different options.

With all of this clarified, let’s go forward and set up Podman domestically.

Putting in Podman

Like Docker, Podman can run with out a drawback on all widespread working methods.
This contains macOS and Home windows, in addition to all main Linux distributions. The
solely vital distinction to notice is that whereas Podman can run natively on
Linux, it requires a digital machine to work on Home windows and macOS. This provides a
few additional steps to the set up course of on these methods, however aside from
that, the core performance stays the identical.

This tutorial assumes that you’re utilizing a Debian-based Linux distribution such
as Ubuntu, Mint, or Debian itself. The set up course of for different working
methods may be very comparable and will be utilized by referring to the official
Podman installation instructions.

Just remember to are utilizing a comparatively latest model of your most well-liked
distribution, as PPA repositories on older variations might not have the most recent
Podman out there for set up. As an illustration, on the time of this writing,
the most recent main model of Podman is 4.x, but the latest LTS model of
Ubuntu
(Ubuntu 22.04 LTS)
locks you in to Podman 3.x. Due to this fact, this tutorial relies on a more moderen
non-LTS model
(Ubuntu 23.10).

Begin by downloading the most recent info from all configured upstream package deal
sources:

Then run the next command to put in Podman:

You will note an output much like:

Studying package deal lists... Achieved
Constructing dependency tree... Achieved
Studying state info... Achieved
The next extra packages might be put in:
  aardvark-dns buildah catatonit conmon containernetworking-plugins crun fuse-overlayfs golang-github-containers-common golang-github-containers-image libslirp0 libsubid4 libyajl2 netavark slirp4netns uidmap
Instructed packages:
  containers-storage libwasmedge0 docker-compose
The next NEW packages might be put in:
  aardvark-dns buildah catatonit conmon containernetworking-plugins crun fuse-overlayfs golang-github-containers-common golang-github-containers-image libslirp0 libsubid4 libyajl2 netavark podman slirp4netns uidmap
0 upgraded, 16 newly put in, 0 to take away and 37 not upgraded.
Must get 28.4 MB of archives.
After this operation, 116 MB of extra disk area might be used.
Do you need to proceed? [Y/n] Y

Kind Y when prompted, then hit Enter to proceed.

After the set up is accomplished, you may confirm that Podman is obtainable by
typing:

The output signifies that model 4.3.1 was efficiently put in domestically,
and you’ll run podman instructions. You are actually able to launch your first
container.

Operating your first container

Let’s confirm that the set up works by operating the well-known
“Hello World!” image from
Docker Hub:

podman run --rm hello-world

You’ll observe an output much like:

Resolved "hello-world" as an alias (/and so on/containers/registries.conf.d/shortnames.conf)
Attempting to drag docker.io/library/hello-world:newest...
Getting picture supply signatures
Copying blob 719385e32844 executed
Copying config 9c7a54a9a4 executed
Writing manifest to picture vacation spot
Storing signatures

Hey from Docker!
This message reveals that your set up seems to be working accurately.

To generate this message, Docker took the next steps:
 1. The Docker shopper contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" picture from the Docker Hub.
    (amd64)
 3. The Docker daemon created a brand new container from that picture which runs the
    executable that produces the output you might be at the moment studying.
 4. The Docker daemon streamed that output to the Docker shopper, which despatched it
    to your terminal.

To strive one thing extra formidable, you may run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share photos, automate workflows, and extra with a free Docker ID:
 https://hub.docker.com/

For extra examples and concepts, go to:
 https://docs.docker.com/get-started/

This output reveals one thing essential. Despite the fact that the “Hey World!” picture was
constructed with instruments from the Docker ecosystem, Podman was nonetheless in a position to run the
container.

That is as a result of each Docker and Podman observe the OCI
(Open Container Initiative) requirements. The OCI
defines an
image format specification
and a runtime specification
enabling completely different container runtimes, corresponding to Podman and Docker, to
interoperate.

In consequence, Podman can seamlessly work with most Docker photos and containers.
This compatibility lets you migrate your current workloads to Podman
simply with out having to make any modifications and likewise to leverage the huge
library of Docker photos out there on Docker Hub.

Let’s additional break down the output from the command above. The primary line says:

Resolved "hello-world" as an alias (/and so on/containers/registries.conf.d/shortnames.conf)

This message signifies that Podman referenced a configuration file to acquire the
absolutely certified identify of the hello-world picture. In contrast to Docker, Podman
recommends in opposition to utilizing quick names to refer to pictures and doesn’t default to
a selected registry, until explicitly instructed to take action through its configuration
recordsdata. Docker, however, all the time makes use of Docker Hub (docker.io) as its
default registry and tries to find each picture there when a completely certified
identify shouldn’t be explicitly supplied.

You possibly can additional examine the shortnames.conf file and make sure that the
hello-world alias maps to the picture docker.io/library/hello-world:

grep hello-world /and so on/containers/registries.conf.d/shortnames.conf

"hello-world" = "docker.io/library/hello-world"

The subsequent few traces say:

Attempting to drag docker.io/library/hello-world:newest...
Getting picture supply signatures
Copying blob 719385e32844 executed
Copying config 9c7a54a9a4 executed
Writing manifest to picture vacation spot
Storing signatures

These messages point out that the most recent model of the hello-world picture was
efficiently downloaded to your native machine.

You possibly can confirm this by issuing:

REPOSITORY                     TAG         IMAGE ID      CREATED       SIZE
docker.io/library/hello-world  newest      9c7a54a9a43c  6 months in the past  19.9 kB

The remaining output (the “Hey from Docker!” message and all subsequent traces)
show a message that is hard-coded into the
hello
binary that ships with the hello-world picture. This message might be slightly
deceptive because it means that the Docker engine executed the container when, in
actuality, Podman did. It is essential to know that neither the Docker shopper
nor the Docker daemon have been in any method concerned within the course of.

Earlier than you progress on additional, take away the hello-world picture, because it’s not
wanted:

The output signifies that the picture was eliminated, displaying its tag and ID for
reference:

Untagged: docker.io/library/hello-world:newest
Deleted: 9c7a54a9a43cca047013b82af109fe963fde787f63f9e016fdc3384500c2823d

Subsequent, let’s study what occurs whenever you try to run an arbitrary picture
utilizing solely its quick identify.

Utilizing quick picture names

As we mentioned beforehand, Podman suggests utilizing fully-qualified names for
container photos to keep away from ambiguity and be certain that the right picture is all the time
referenced from a selected registry.

Let’s strive operating a container utilizing the
official Caddy image from Docker Hub. If
you are unfamiliar with Caddy, it is a light-weight net server and reverse
proxy recognized for its ease of use and implausible efficiency. By operating Caddy as a
container, you may rapidly spin up a neighborhood net server for testing functions.

Coming from a Docker background, you’d usually use the next command
to begin the container:

docker run --rm -p 8080:80 caddy

This interprets to the next command in Podman:

podman run --rm -p 8080:80 caddy

More often than not, transitioning from Docker to Podman is a matter of adjusting
docker to podman in your command. In reality, many customers add
alias docker=podman to their shell config recordsdata and use Podman as an alias for
docker instructions.

The flags are additionally an identical:

• --rm specifies that the container ought to be robotically eliminated after it
  exits, so it would not muddle up your system.
• -p 8080:80 specifies that port 8080 on the host machine ought to map to port
  80 within the container, to be able to entry the net server operating inside
  the container by typing localhost:8080 in your browser.

Attempt operating the command. If all the pieces goes nicely, a container ought to launch,
permitting you to open localhost:8080 in a browser to see the built-in Caddy
take a look at web page.

Opposite to what you would possibly anticipate, the command fails and returns the
following error:

Error: short-name "caddy" didn't resolve to an alias and no unqualified-search registries are outlined in "/and so on/containers/registries.conf"

The command did not work as a result of Podman could not perceive the place to drag the
caddy picture from.

It first regarded up shortnames.conf for an alias named caddy however couldn’t
discover one. Attempt a grep on shortnames.conf, and you will note that it returns no
matches certainly:

grep caddy /and so on/containers/registries.conf.d/shortnames.conf

It then regarded up the registries.conf file for a listing of so-called unqualified
search registries. An unqualified search registry is the one which Podman tries
to contact every time a non-fully certified picture identify is equipped with the run
command.

There are three doable options to the problem that you simply encountered. Let’s
discover all of them:

1. Specifying a fully-qualified identify

You possibly can specify the fully-qualified identify:

podman run --rm -p 8080:80 docker.io/library/caddy

This works! Nonetheless, coming from a Docker background, you could discover utilizing quick
names extra ergonomic, as a result of that is the workflow that you simply’re used to. That is
completely doable with Podman, utilizing both aliases or unqualified search
registries which we’ll discover beneath.

2. Defining an alias

You might determine to outline an alias for caddy as a substitute. When doing so, maintain in
thoughts that the /and so on/containers/registries.conf.d/shortnames.conf file shouldn’t be
meant to be modified immediately, as it’s shipped as a part of the
shortnames project. The proper method
to outline a brand new alias is by including an [aliases] part to your
registries.conf file like this:

[aliases]
"caddy"="docker.io/caddy"

The default registry configuration for Podman is positioned at
/and so on/containers/registries.conf, however modifying this file requires root
privileges. This barely defeats the thought of rootless entry that Podman goals
to help. Nonetheless, Podman provides a mechanism to beat this limitation. You
can put your configuration into $HOME/.config/containers/registries.conf, and
it can take priority over /and so on/containers/registries.conf. This requires no
root privileges.

Go forward and create the $HOME/.config/containers/registries.conf file in your
system:

mkdir -p $HOME/.config/containers && contact $HOME/.config/containers/registries.conf

Then add the next line to your file:

[aliases]
"caddy"="docker.io/caddy"

Now re-run:

podman run --rm -p 8080:80 caddy

You will note the next output indicating that the answer works:

Resolved "caddy" as an alias (/residence/<your_user_name>/.config/containers/registries.conf)
Attempting to drag docker.io/library/caddy:newest...
...

Whereas this answer works, including aliases for each picture that you simply plan on utilizing
might be tedious and time-consuming in the long term. This leads us to the third
doable answer—configuring an unqualified search registry.

Earlier than you do this, revert the modifications that you simply did up to now so you can begin with
a clear state.

Hit Ctrl+C to terminate the Caddy container and return to your terminal. Then
take away the [aliases] configuration from the registries.conf file by
truncating all the file:

echo > $HOME/.config/containers/registries.conf

Take away the caddy picture that Podman simply downloaded:

As anticipated, the output reveals the tag and ID of the picture that was eliminated:

Untagged: docker.io/library/caddy:newest
Deleted: 70c3913f54e294079c54cc8b651576b08dd4add42a0f4c0bc93d539913ae335d

You are actually able to outline an unqualified search registry.

3. Defining an unqualified search registry

Open your $HOME/.config/containers/registries.conf file and paste the
following contents:

unqualified-search-registries=["docker.io"]

Now re-run:

podman run --rm -p 8080:80 caddy

You will note the next output:

Resolving "caddy" utilizing unqualified-search registries (/residence/<your_user_name>/.config/containers/registries.conf)
Attempting to drag docker.io/library/caddy:newest
...

The caddy picture was efficiently downloaded, a container was launched, and
Caddy is now able to serve net requests.

To substantiate that all the pieces works, you may navigate to localhost:8080. There,
you need to see the Caddy take a look at web page:

Utilizing an unqualified search registry is definitely a greater choice than
utilizing aliases, particularly in case you intend to make use of Podman as a drop-in substitute
for Docker, as a result of you may proceed utilizing quick names the way in which that you’re used
to, and they’ll resolve from Docker Hub by default.

Earlier than you proceed additional, return to your terminal and hit Ctrl+C to cease
the container, then take away the Caddy picture:

Untagged: docker.io/library/caddy:newest
Deleted: 70c3913f54e294079c54cc8b651576b08dd4add42a0f4c0bc93d539913ae335d

Utilizing non-public picture registries

You might be possible used to working with non-public registries that host your
group’s proprietary photos. Docker can undoubtedly facilitate that, and
so can Podman. The method may be very comparable for each instruments.

This instance assumes that you’ve got a working Docker Hub account. In case you do not
have an account, you may register one for free.
The free tier lets you preserve one non-public repository freed from cost.

Log into your Docker Hub account and navigate to
Account Settings:

Go to Security and click on on New
Entry Token:

Specify Podman tutorial as the outline and Learn & Write because the
desired permissions, then click on Generate:

Copy the generated entry token and retailer it someplace protected. We’ll check with
this token as <your_access_token>:

The token ought to now be listed below the out there entry tokens in your Docker
Hub account:

Navigate again to Repositories and create
a brand new non-public repository as follows:

If all goes nicely, you need to see the repository listed in your Docker Hub
account:

Let’s now configure Podman to run together with your non-public repository.

Kind the next command:

Right here, docker.io will be omitted you probably have listed it as the primary
unqualified-search-registries entry in your registries.conf file.
Nonetheless, it is nonetheless thought-about observe to specify the registry
explicitly.

In any other case, podman login will fail with the next error:

Error: no registries present in registries.conf, a registry have to be supplied

Kind in your username and entry token when prompted, and you need to obtain the
following output:

Username: <your_user_name>
Password: <your_access_token>
Login Succeeded!

Proceed by downloading the official hello-world picture domestically:

podman pull docker.io/hello-world

A profitable output will appear like this:

Attempting to drag docker.io/library/hello-world:newest...
Getting picture supply signatures
Copying blob 719385e32844 executed
Copying config 9c7a54a9a4 executed
Writing manifest to picture vacation spot
Storing signatures
9c7a54a9a43cca047013b82af109fe963fde787f63f9e016fdc3384500c2823d

Now checklist your native Podman photos:

It is best to see the next output:

REPOSITORY                     TAG         IMAGE ID      CREATED       SIZE
docker.io/library/hello-world  newest      9c7a54a9a43c  6 months in the past  19.9 kB

Go forward and add a replica of the hello-world picture to your non-public
repository.

podman push docker.io/library/hello-world docker.io/<your_user_name>/hello-private

You’re going to get the next output:

Getting picture supply signatures
Copying blob 01bb4fce3eb1 skipped: already exists
Copying config 9c7a54a9a4 executed
Writing manifest to picture vacation spot
Storing signatures

Navigate again to your non-public repository on Docker Hub to confirm that the picture
was efficiently uploaded:

Now you can take away the general public hello-world picture out of your native machine:

Untagged: docker.io/library/hello-world:newest
Deleted: 9c7a54a9a43cca047013b82af109fe963fde787f63f9e016fdc3384500c2823d

Now, strive operating a container utilizing the picture out of your non-public repository:

podman run --rm docker.io/<your_user_name>/hello-private

Podman goes forward, efficiently pulls the non-public picture, and launches a
container utilizing the picture:

Attempting to drag docker.io/<your_user_name>/hello-private:newest...
Getting picture supply signatures
Copying blob 719385e32844 executed
Copying config 9c7a54a9a4 executed
Writing manifest to picture vacation spot
Storing signatures

Hey from Docker!
...

With out legitimate login credentials, you’d have obtained the next error
as a substitute:

Attempting to drag docker.io/<your_user_name>/hello-private:newest...
Error: initializing supply docker://<your_user_name>/hello-private:newest: studying manifest newest in docker.io/<your_user_name>/hello-private: errors:
denied: requested entry to the useful resource is denied
unauthorized: authentication required

As you may see, utilizing Podman with a personal registry is nearly an identical to
utilizing Docker for a similar function. The one distinction is that you simply prefixed your
instructions with podman as a substitute of docker. Similar to Docker, you need to use Podman
with all widespread non-public registries.

Earlier than you proceed additional, ensure that to logout:

Eliminated login credentials for docker.io

Additionally, take away the non-public picture out of your native machine:

Untagged: docker.io/<your_user_name>/hello-private:newest
Deleted: 9c7a54a9a43cca047013b82af109fe963fde787f63f9e016fdc3384500c2823d

With this, you may proceed to the following part and learn to orchestrate
a number of containers with Podman.

Orchestrating a number of containers

Thus far, you could have solely been launching one container at a time to discover how
Podman works. Sooner or later, you may certainly discover it essential to run a number of
containers working collectively as a unit. On this part, you may discover certainly one of
the doable methods to do this with
Podman Compose.

Podman provides a number of choices for orchestrating a number of containers, however Podman
Compose is essentially the most much like what’s used within the Docker world. Different choices
are pods and Kubernetes manifests, however each name for a deeper comprehension of
Podman (and Kubernetes), so we’ll go away them out for now.

Within the following instance, you may use the Docker Compose directions equipped
with the official WordPress image on
Docker Hub to launch a easy
WordPress set up backed by a
MySQL database server. In case you’re unfamiliar with WordPress, it’s a widespread
running a blog and content material administration platform written in PHP.

Within the Docker ecosystem, Compose lets you outline and handle a number of
containers by means of definitions saved inside a docker-compose.yml file. Being
used to working with Docker Compose, you may proceed utilizing your current
docker-compose.yml recordsdata with Podman with the assistance of Podman Compose.

Podman Compose is a community-driven device that implements the
Compose specification and seamlessly integrates with
Podman. It depends on Python 3 to work, and one of many best methods to get
began with it’s by means of pipx.

In case you do not have already got Python 3 or pipx put in in your system, you may
set up them by operating:

You possibly can confirm that pipx is working by typing:

This may output a model identifier much like:

The output confirms that model 1.2.0 is of pipx is put in in your
system, and also you’re prepared to begin utilizing it.

You possibly can run the next command to put in Podman Compose:

pipx set up podman-compose

If all the pieces goes nicely, you need to see:

put in package deal podman-compose 1.0.6, put in utilizing Python 3.11.6
These apps are actually globally out there
  - podman-compose
⚠️ Observe: '/residence/<your_user_name>/.native/bin' shouldn't be in your PATH surroundings variable. These apps is not going to be globally accessible till your PATH is up to date. Run `pipx ensurepath` to robotically add it, or manually modify your PATH in your shell's config file (i.e. ~/.bashrc).
executed! ✨ 🌟 ✨

The output signifies that pipx was positioned in your $HOME/.native/bin folder.
Nonetheless, that folder is probably going not included in your $PATH variable, which means if
you sort podman-compose proper now, you’ll get the same error:

Command 'podman-compose' not discovered, however will be put in with:
sudo apt set up podman-compose

Do not be confused by this error. Podman Compose was efficiently put in, however
you might want to add its set up folder to your $PATH.

You possibly can tackle this by operating:

This command will be certain that $HOME/.native/bin is appended to your $PATH
by means of certainly one of your shell’s config recordsdata (.profile, .bash_profile,
.bashrc, and so on. relying in your particular setup).

After operating the command, you will note the next output:

/residence/<your_user_name>/.native/bin has been added to PATH, however you might want to open a brand new terminal or re-login for this PATH change to take impact.

You will want to open a brand new terminal or re-login for the PATH modifications to take impact.

In any other case pipx is able to go! ✨ 🌟 ✨

You possibly can observe the directions and re-open your terminal session.
Alternatively, if you already know exactly which shell config file was modified, you
can supply the file for the modifications to take fast impact.

For instance:

To substantiate that the $PATH is ready accurately, you may run:

echo $PATH | tr ':' 'n' | grep -F .native

It is best to see /residence/<your_user_name>/.native/bin listed within the output:

/residence/<your_user_name>/.native/bin

Create a brand new folder and cd into it:

mkdir podman-tutorial && cd podman-tutorial

Create an .env file and outline the next variables:

DB_USER=<your_example_username>
DB_PASS=<your_example_password>
DB_NAME=<your_example_database>

Then, create a brand new docker-compose.yml file and paste the next contents:

model: '3'

providers:

  wordpress:
    picture: wordpress
    container_name: wordpress
    restart: all the time
    ports:
      - '8080:80'
    surroundings:
      WORDPRESS_DB_HOST: db
      WORDPRESS_DB_USER: ${DB_USER}
      WORDPRESS_DB_PASSWORD: ${DB_PASS}
      WORDPRESS_DB_NAME: ${DB_NAME}
    volumes:
      - wordpress:/var/www/html

  db:
    picture: mysql:5.7
    container_name: db
    restart: all the time
    ports:
      - '3306:3306'
    surroundings:
      MYSQL_DATABASE: ${DB_NAME}
      MYSQL_USER: ${DB_USER}
      MYSQL_PASSWORD: ${DB_PASS}
      MYSQL_RANDOM_ROOT_PASSWORD: '1'
    volumes:
      - db:/var/lib/mysql

volumes:
  wordpress:
  db:

Save the file, then run:

Let’s study the output phase by phase.

Initially, podman-compose launches and begins analyzing the
docker-compose.yml file:

podman-compose model: 1.0.6
['podman', '--version', '']
utilizing podman model: 4.3.1
** excluding:  set()
['podman', 'ps', '--filter', 'label=io.podman.compose.project=podman-tutorial', '-a', '--format', '{{ index .Labels "io.podman.compose.config-hash"}}']

It detects two providers named wordpress and db, and begins processing them
in sequential order.

First, it finds out that the wordpress service requires an exterior quantity. It
tries to find the amount by issuing podman quantity examine <volume_name>, however
because it would not exist, it goes forward and creates one by issuing
podman quantity create <volume_name>:

podman quantity examine podman-tutorial_wordpress || podman quantity create podman-tutorial_wordpress
['podman', 'volume', 'inspect', 'podman-tutorial_wordpress']
Error: inspecting object: no such quantity podman-tutorial_wordpress
['podman', 'volume', 'create', '--label', 'io.podman.compose.project=podman-tutorial', '--label', 'com.docker.compose.project=podman-tutorial', 'podman-tutorial_wordpress']
['podman', 'volume', 'inspect', 'podman-tutorial_wordpress']

Subsequent, it checks whether or not there’s a appropriate community for deploying the
wordpress service. It would not discover one, so it creates it after which performs
one other verify to substantiate that the community exists:

['podman', 'network', 'exists', 'podman-tutorial_default']
['podman', 'network', 'create', '--label', 'io.podman.compose.project=podman-tutorial', '--label', 'com.docker.compose.project=podman-tutorial', 'podman-tutorial_default']
['podman', 'network', 'exists', 'podman-tutorial_default']

Lastly, with an acceptable community and an exterior quantity in place, Podman Compose
launches the wordpress container:

podman run --name=wordpress -d --label io.podman.compose.config-hash=c3e51c9a26e54848a06f92083413698bee90acd721b4aa3054280e110819a68c --label io.podman.compose.venture=podman-tutorial --label io.podman.compose.model=1.0.6 --label PODMAN_SYSTEMD_UNIT=podman-compose@podman-tutorial.service --label com.docker.compose.venture=podman-tutorial --label com.docker.compose.venture.working_dir=/residence/<your_user_name>/podman-tutorial --label com.docker.compose.venture.config_files=docker-compose.yml --label com.docker.compose.container-number=1 --label com.docker.compose.service=wordpress -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=testuser -e WORDPRESS_DB_PASSWORD=testpass -e WORDPRESS_DB_NAME=testdb -v podman-tutorial_wordpress:/var/www/html --net podman-tutorial_default --network-alias wordpress -p 8080:80 --restart all the time wordpress

Since Podman can not discover a wordpress picture out there domestically, it goes forward
and appears up the unqualified search registry that you simply configured earlier
(docker.io), then downloads it:

Resolving "wordpress" utilizing unqualified-search registries (/residence/<your_user_name>/.config/containers/registries.conf)
Attempting to drag docker.io/library/wordpress:newest...
Getting picture supply signatures
Copying blob c5d33b602102 executed
...
Copying config bc823df9ea executed
Writing manifest to picture vacation spot
Storing signatures
980f5792fb9c34ea9357ffa290d5d79ac0b48b70701cd4693f5d7e2b4f2312f1
exit code: 0

Subsequent, Podman Compose proceeds with processing the directions for the db
service.

First, it creates its exterior quantity:

podman quantity examine podman-tutorial_db || podman quantity create podman-tutorial_db
['podman', 'volume', 'inspect', 'podman-tutorial_db']
Error: inspecting object: no such quantity podman-tutorial_db
['podman', 'volume', 'create', '--label', 'io.podman.compose.project=podman-tutorial', '--label', 'com.docker.compose.project=podman-tutorial', 'podman-tutorial_db']
['podman', 'volume', 'inspect', 'podman-tutorial_db']

It then ensures that there’s a appropriate community for its deployment:

['podman', 'network', 'exists', 'podman-tutorial_default']

Lastly, it launches the db container:

podman run --name=db -d --label io.podman.compose.config-hash=c3e51c9a26e54848a06f92083413698bee90acd721b4aa3054280e110819a68c --label io.podman.compose.venture=podman-tutorial --label io.podman.compose.model=1.0.6 --label PODMAN_SYSTEMD_UNIT=podman-compose@podman-tutorial.service --label com.docker.compose.venture=podman-tutorial --label com.docker.compose.venture.working_dir=/residence/<your_user_name>/podman-tutorial --label com.docker.compose.venture.config_files=docker-compose.yml --label com.docker.compose.container-number=1 --label com.docker.compose.service=db -e MYSQL_DATABASE=testdb -e MYSQL_USER=testuser -e MYSQL_PASSWORD=testpass -e MYSQL_RANDOM_ROOT_PASSWORD=1 -v podman-tutorial_db:/var/lib/mysql --net podman-tutorial_default --network-alias db --restart all the time mysql:5.7

Similar to with the wordpress picture, Podman can not discover a mysql:5.7 picture
domestically, so it goes forward and obtains it from Docker Hub:

Resolving "mysql" utilizing unqualified-search registries (/residence/<your_user_name>/.config/containers/registries.conf)
Attempting to drag docker.io/library/mysql:5.7...
Getting picture supply signatures
Copying blob 62aca7179a54 executed
...
Copying config bdba757bc9 executed
Writing manifest to picture vacation spot
Storing signatures
21615c3d36236f181b94831b5c1eb699153f7cf912fdefcb342732069f99c09d
exit code: 0

At this level, Podman Compose exits efficiently, and all the pieces seems to be
launched accurately. Let’s go forward and confirm this.

First, attempt to open localhost:8080 in a browser. It is best to see the WordPress
set up web page:

Now, return to your terminal and sort in:

Certainly, each the wordpress container and the db container are up and
operating:

CONTAINER ID  IMAGE                               COMMAND               CREATED        STATUS            PORTS                 NAMES
980f5792fb9c  docker.io/library/wordpress:newest  apache2-foregroun...  3 minutes in the past  Up 3 minutes in the past  0.0.0.0:8080->80/tcp  wordpress
21615c3d3623  docker.io/library/mysql:5.7         mysqld                2 minutes in the past  Up 2 minutes in the past                        db

You can too go forward and discover the checklist of obtainable photos:

The checklist incorporates all the mandatory photos for operating MySQL and WordPress:

REPOSITORY                   TAG         IMAGE ID      CREATED       SIZE
docker.io/library/wordpress  newest      bc823df9ead2  28 hours in the past  683 MB
docker.io/library/mysql      5.7         bdba757bc933  4 weeks in the past   520 MB

You possibly can additional discover the checklist of obtainable networks:

Two networks present up:

NETWORK ID    NAME                     DRIVER
2f259bab93aa  podman                   bridge
3f5fa386b31c  podman-tutorial_default  bridge

The podman community is created by default whenever you set up Podman for the primary
time. It’s used for launching containers when no different community is explicitly
specified. Then again, the podman-tutorial_default community is created
by Podman Compose to isolate the containers outlined in your docker-compose.yml
from some other containers doubtlessly operating on the identical system.

Lastly, let’s verify the out there volumes:

As anticipated, two exterior volumes seem:

DRIVER      VOLUME NAME
native       podman-tutorial_db
native       podman-tutorial_wordpress

You possibly can go forward and cease the containers:

Podman Compose stops and removes the containers out of your system however retains the
community and volumes:

podman-compose model: 1.0.6
['podman', '--version', '']
utilizing podman model: 4.3.1
** excluding:  set()
podman cease -t 10 db
db
exit code: 0
podman cease -t 10 wordpress
wordpress
exit code: 0
podman rm db
db
exit code: 0
podman rm wordpress
wordpress
exit code: 0

You possibly can confirm that no containers are operating by typing:

The end result reveals an empty output, which confirms that the entire containers have been
stopped and eliminated.

CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES

If you wish to take away the volumes as nicely, you may sort in:

podman quantity rm podman-tutorial_db podman-tutorial_wordpress

To take away the community, sort in:

podman community rm podman-tutorial_default

As you may see, the instructions are an identical to what you’d usually use with
Docker and Docker Compose. The one noticeable distinction is that as a substitute of
docker and docker-compose, you sort in podman and podman-compose.

Last ideas

Podman is a succesful containerization know-how that provides a viable different
to Docker for operating container workloads. Whether or not you select Podman or Docker
relies upon completely in your particular wants and preferences.

Podman can do many of the issues that Docker can do, with the additional advantage of
not requiring a daemon operating within the background. On high of that, Podman provides
some options that Docker doesn’t, corresponding to working with Kubernetes manifest
recordsdata and organizing particular person containers into pods.

The ultimate choice is yours. In case you require a extra light-weight and safe
container administration answer, Podman is likely to be a more sensible choice. Nonetheless, Docker
will be the method to go in case you prioritize a sturdy ecosystem with in depth
neighborhood help. Finally, each instruments provide highly effective containerization
capabilities to satisfy your necessities.

To discover Podman additional, think about visiting the
official Podman website, exploring its
documentation, and becoming a member of its rising
community.

Thanks for studying!

Article by

Marin Bezhanov

Marin is a software program engineer and architect with a broad vary of expertise working with Go, Java, PHP, and JS. He’s enthusiastic about exploring new applied sciences and staying up-to-date with the most recent trade tendencies, and he loves sharing his data by means of technical writing and educating.

Received an article suggestion?
Let us know

This work is licensed below a Inventive Commons Attribution-NonCommercial-ShareAlike 4.0 Worldwide License.