upvote

points

by darkwi11ow13 hours ago |
comments
upvoteby alienbaby13 hours ago|
next
[-]
The article specifically calls this out as a preferred option.
reply
upvoteby IsTom10 hours ago|
prev|
next
[-]
I've used docker until recently just because it was what I was used to. It turned out I can basically just `apt install podman` and it'll just work. I might have stayed a bit behind the times with having podman slotted as a redhat thing.
reply
upvoteby 0xbadcafebee1 hours ago|
prev|
next
[-]
Is it opposite day already?
reply
upvoteby nkydr0i013 hours ago|
prev|
next
[-]
that's what I do and what the author recommends as well
reply
upvoteby phoronixrly13 hours ago|
parent|
[-]
Somehow I doubt DHH and company would be OK sacrificing ""developer experience"" for security... There is still a non-trivial amount of docker-compose files and Docker incantations that don't work 1:1 with podman and podman-compose. Adjusting them would require Omarchy's users underatanding podman, and I doubt this will align with the opinionated nature of Omarchy..
reply
upvoteby PuercoPop9 hours ago|
parent|
next
[-]
Don't use podman compose unless you want to have a bad experience. Play kube is podman's API for orchestration.
reply
upvoteby psjs13 hours ago|
parent|
prev|
next
[-]
Omarchy is an agent first experience, no? just ask your agent!
reply
upvoteby 13 hours ago|
parent|
prev|
next
[-]
deleted
reply
upvoteby ecshafer13 hours ago|
parent|
prev|
[-]
Come on. I am sure you don’t like DHH. But he’s always taken security seriously in Rails.
reply
upvoteby 12985-128612 hours ago|
parent|
next
[-]
Shopify forced him to be a vibe coder now. Omarchy is a vibe coding distribution.

In the AI world, security issues are just another marketing opportunity.

EDIT: Downvote all you want. He was anti-AI, got a board seat at Shopify and then became an AI influencer. Now additional money is rolling in to Omarchy from Lütke and Steinberger.

reply
upvoteby newspaper110 hours ago|
parent|
[-]
It's really disturbing that there's a group of these CEO/investor types that are openly white nationalists, and they're joining forces. I'll never touch any of their products, and I hope they continue to expose themselves on social media.
reply
upvoteby 9 hours ago|
parent|
[-]
deleted
reply
upvoteby phoronixrly13 hours ago|
parent|
prev|
[-]
As I said, podman requires effort and thought on the user's side, as the rootless part incurs complexity. I do not think that this aligns with the omakase mantra of omarchy. I do not think that DHH does not take security seriously. I think that Omarchy is not meant to sacrifice devex for security.
reply
upvoteby isityettime12 hours ago|
parent|
[-]
Rootless Podman (and rootless Docker for that matter) is not difficult to set up automatically. There is a little complexity involved, namely in configuring subuid and subgid mappings, but not much.

That said, I think Arch Linux itself has a culture that values the wrong kind of simplicity (implementation simplicity) that perversely leads to a failure to adequately grapple with inherent complexity. This leads to brittle implementations, "buyer beware" norms, "you should have run the notes", "this command should never be used", etc. Omarchy inherits all of that from Arch. It also, it seems, carried its own perverse notion of "simplicity".

reply
upvoteby phoronixrly12 hours ago|
parent|
[-]
I was not referring to the setup complexity. Setup is performed just once. I was referring to the runtime complexity that comes naturally from having to take into account non-root user permissions and lack thereof. These peculiarities are quite a low bar, but they are still a non-trivial hurdle in the way of devex.

I am a fedora/opensuse user and happily use podman with selinux.

reply
upvoteby isityettime8 hours ago|
parent|
[-]
IME it's not too bad, but I see what you're saying. I guess we're mostly in agreement.
reply
upvoteby iririririr12 hours ago|
prev|
next
[-]
because the distro is all about convenience over security, while selling an aura of technical superiority. Which is the modus operandi that worked for the distro author in the past, when he sold VPS with a big markup, because he also gave a script that did "ssh vps -- curl somebashscript" to do basic webdev taks.

> The security tradeoff was made for them, applied to the default account, and the tradeoff was not explained to the user.

just like the vps era. it's all about convenience.

reply
upvoteby hemlock459310 hours ago|
prev|
[-]
Rootless docker is also an option.

> Podman works much better than Docker today.

Nah absolutely not. Especially compose files and networking can be an absolute nightmare with podman.

reply
upvoteby drnick17 hours ago|
parent|
[-]
Compose files work just fine. The gap with Docker has basically closed, and the few things you can't do or that behave differently are precisely the things Docker shouldn't be doing.
reply