The Container Ecosystem: Podman, containerd, Kaniko & Friends

In one line

Docker popularised containers, but the ecosystem is open standards (OCI) with many tools: Podman for daemonless and rootless containers, containerd and nerdctl underneath Kubernetes, Buildah and Kaniko for building without a daemon, and Swarm vs Kubernetes for orchestration.

0/4 · 0%

Think of it like this

Shipping containers. The standard box size (OCI image and runtime specs) is what matters; many different cranes, ships, and lorries (tools) can handle the same box. Docker is one popular crane, not the only one.

Key ideas

01
OCI STANDARDS: the image spec (layers + config + manifest), the runtime spec (how to run a container, implemented by runc/crun), and the distribution spec (how registries serve images). Any compliant tool builds or runs any compliant image (Phase 9, runtime stack).
02
PODMAN: a Docker-compatible CLI without a central daemon, running rootless by default, with pods (groups of containers sharing a network, like Kubernetes pods) and podman generate kube. alias docker=podman works for most commands; it's the default on RHEL/Fedora.
03
containerd + nerdctl: containerd is the runtime Kubernetes uses on most clusters (Docker is no longer involved there); nerdctl is a Docker-like CLI for it, and crictl debugs containers on Kubernetes nodes. BUILDERS without a Docker daemon: BUILDAH (scriptable OCI builds), KANIKO (builds inside a Kubernetes pod without privileges), BuildKit rootless, and JIB (builds Java images straight from Maven/Gradle without a Dockerfile).
04
ORCHESTRATION: DOCKER SWARM is simple, built into Docker, and fine for small setups, but the industry standard is KUBERNETES (Kubernetes course); managed alternatives include ECS/Fargate (AWS course) and Cloud Run. Nomad is a simpler general-purpose scheduler.

Code & diagrams

same image, different toolsbash

podman run -d --name web -p 8080:80 docker.io/library/nginx:1.29   # daemonless, rootless
nerdctl run -d --name web -p 8080:80 nginx:1.29                     # straight on containerd
sudo crictl ps                                                      # containers on a Kubernetes node
./mvnw compile jib:build -Dimage=ghcr.io/shoplite/api:1.4.0         # Java image, no Dockerfile, no daemon

Explain it without notes

Kubernetes removed 'dockershim'. Do Docker-built images still run on Kubernetes?

Practice

Your CI runs on Kubernetes and security forbids privileged pods and Docker-in-Docker. How do you build images?

Trade-offs

↔
Docker's developer experience is excellent and ubiquitous; Podman and containerd-based tools avoid a root daemon and fit Kubernetes and locked-down environments better. The OCI standards make switching cheap.

Done when you can

I understand OCI and that images are portable across tools
I can pick a daemonless builder for locked-down CI