Umair Khurshid writes that although Docker revolutionized container workflows and application portability, it has lost its status as the single essential tool for all developers. As standardized OCI runtimes have matured, specialized alternatives now offer more targeted solutions for security-focused workloads, production environments, system-level needs, and standalone image creation.
- Podman enables rootless containers by launching processes directly from the CLI without a central daemon
- containerd provides an efficient, lightweight runtime often used in Kubernetes architectures
- Incus specializes in system containers that behave like complete Linux installations with init systems
- Buildah focuses specifically on building images rather than managing container execution
- Podman enables rootless containers by launching processes directly from the CLI without a central daemon
- containerd provides an efficient, lightweight runtime often used in Kubernetes architectures
- Incus specializes in system containers that behave like complete Linux installations with init systems
- Buildah focuses specifically on building images rather than managing container execution
Red Hat principal engineer Sally O'Malley has released Tank OS, an open source tool designed to improve the safety and management of OpenClaw AI agent deployments. By utilizing Podman containers on Fedora Linux, Tank OS allows for secure, rootless execution that isolates AI agents from the underlying system. This makes it easier for IT professionals to manage large fleets of autonomous agents in enterprise environments while minimizing security risks like unauthorized data access or accidental file deletion.
Key points:
- Introduction of Tank OS for safer OpenClaw deployment
- Use of Podman containers to provide rootless, isolated execution
- Support for managing multiple independent agent instances with separate credentials
- Designed specifically to help IT pros scale AI agents in corporate settings
Key points:
- Introduction of Tank OS for safer OpenClaw deployment
- Use of Podman containers to provide rootless, isolated execution
- Support for managing multiple independent agent instances with separate credentials
- Designed specifically to help IT pros scale AI agents in corporate settings
An exploration of transitioning from Docker to Podman within a home lab environment. The author details a weekend project setting up an Ubuntu-based Podman server on Proxmox, highlighting the key architectural differences such as the absence of a central daemon and the benefits of rootless container execution for enhanced security.
Key topics include:
- Comparison between Docker's daemon-based model and Podman's daemonless architecture.
- The advantages of rootless containers for improved host security.
- Utilizing systemd integration through Quadlets for more native Linux service management.
- Practical steps for installation on Ubuntu and Rocky Linux.
- Maintaining compatibility with tools like Portainer via the Podman API socket.
Key topics include:
- Comparison between Docker's daemon-based model and Podman's daemonless architecture.
- The advantages of rootless containers for improved host security.
- Utilizing systemd integration through Quadlets for more native Linux service management.
- Practical steps for installation on Ubuntu and Rocky Linux.
- Maintaining compatibility with tools like Portainer via the Podman API socket.
This article details the journey of deploying an on-premise Large Language Model (LLM) server, focusing on security considerations. It explores the rationale behind on-premise deployment for privacy and data control, outlining the goals of creating an air-gapped, isolated infrastructure. The authors delve into the hardware selection process, choosing components like an Nvidia RTX Pro 6000 Max-Q for its memory capacity. The deployment process starts with a minimal setup using llama.cpp, then progresses to containerization with Podman and the use of CDI for GPU access. Finally, the article discusses hardening techniques, including kernel module management and file permission restrictions, to minimize the attack surface and enhance security.
Run, validate and execute GitHub Actions locally. WRKFLW is a powerful command-line tool for validating and executing GitHub Actions workflows locally, without requiring a full GitHub environment.
The article discusses Apple Container, a new tool for running Linux containers on macOS, comparing its performance and efficiency to Docker Desktop. It highlights its ease of setup on Silicon Macs, compatibility with Dockerfiles, and potential as a lightweight alternative for home lab enthusiasts.
Learn how to get started with Podman, a daemon-less and secure containerization tool that's a great alternative to Docker.
A user is facing an issue with running WireGuard in a Podman container without using the privileged flag. They encounter an iptables-restore error and have tried troubleshooting steps without success.
For anyone who finds this in the future I needed to add --cap-add=NET_RAW
For anyone who finds this in the future I needed to add --cap-add=NET_RAW
An open source extension for Podman Desktop to work with large language models (LLMs) on a local environment
Podman AI Lab is an open source extension for Podman Desktop that allows users to work with LLMs on a local environment, featuring a recipe catalog with common AI use cases, a curated set of open source models, and a playground for learning, prototyping, and experimentation. It uses Podman machines to run inference servers for LLM models and supports various formats like GGUF, Pytorch, and Tensorflow.
