# macOS
brew install podman
podman machine init
podman machine start

# Linux (Fedora/RHEL already has it)
sudo dnf install podman

# Verify
podman run --rm docker.io/library/alpine echo "Podman works!"

# Docker: daemon-based (root privilege required)
# dockerd runs as root, all containers are children of root process

# Podman: daemon-free (user privilege)
# Each container runs as a child of your user process
# No root daemon = no root vulnerabilities

# Podman 5.x (2026) features:
# - Rootless containers by default
# - Pods (like Kubernetes pods)
# - cgroups v2 fully supported
# - Kubernetes YAML support (podman generate kube)
# - Docker-compatible CLI (alias docker=podman works)

# Create a pod with multiple containers
podman pod create --name myapp-pod \
  -p 8080:80 \
  -p 5432:5432

# Add containers to the pod
podman run -d --pod myapp-pod --name nginx nginx:alpine
podman run -d --pod myapp-pod --name postgres postgres:16

# All containers in the pod share the network namespace
# Access localhost:80 → nginx
# Access localhost:5432 → postgres

# Generate Kubernetes YAML from the pod
podman generate kube myapp-pod > myapp.yaml
# Now deploy to Kubernetes with zero changes

# Podman runs as your user, not root
$ podman run --rm alpine id
uid=0(root) gid=0(root)

# Wait, root? This is actually correct inside the container
# The container's root is mapped to an unprivileged user on the host

# Check on the host
podman unshare cat /proc/self/uid_map
# Shows: 0 1000 1 (container root = host user 1000)

# This means even if a container escapes, it has limited host access

# Podman uses Dockerfiles directly
# Just point to your existing Dockerfiles

podman build -t myapp:latest .
podman push myapp:latest docker://registry.example.com/myapp:latest
# or
podman push myapp:latest containers://registry.example.com/myapp:latest

# The container registries support both:
# docker:// (Docker registry protocol)
# containers:// (OCI registry protocol)

# Docker Desktop:
# - Runs a full Alpine Linux VM (2-4GB RAM)
# - Shares your file system via osxfs (slow)
# - Virtual USB/Network stack
# - $0-$21/month depending on company size

# Lima:
# - Uses macOS native virtualization (Hypervisor.framework)
# - Better performance
# - Native file sharing (virtiofs)
# - Free and open source

# Install
brew install lima

# Create a template
limactl start

# It creates an Alpine Linux VM with:
# - containerd + nerdctl
# - BuildKit
# - BuildPull-Through caching
# - Rootful + Rootless support

# Use it like Docker
limactl shell default docker build -t myapp .
limactl shell default docker run -p 8080:80 myapp

# lima.yaml (or any .yaml in ~/.lima/_config/)
images:
  - location: "https://deps.sh/lima/alpine/3.19.1/lima.yaml"
    arch: "x86_64"
  - location: "https://deps.sh/lima/alpine/3.19.1/lima.yaml"
    arch: "aarch64"

provision:
  - mode: system
    script: |
      # Install containerd and dependencies
      apk add --no-cache \
        containerd \
        docker \
        docker-cli-compose \
        buildkit

  - mode: user
    script: |
      # User-level setup
      systemctl --user enable containerd
      systemctl --user start containerd

provision_scripts:
  - mode: system
    script: |
      cat > /etc/docker/daemon.json <<'EOF'
      {
        "registry-mirrors": ["https://mirror.gcr.io"],
        "storage-driver": "overlay2"
      }
      EOF
      rc-service docker start

mounts:
  - location: "~"
    writable: true
  - location: "/tmp/lima"
    writable: true

networks:
  - lima: bridged

cpu: 4
memory: 8GB
disk: 100GB

# Docker stack (Docker Inc.'s product):
# docker CLI → dockerd (daemon) → containerd → runc → containers

# containerd directly:
# ctr CLI (or nerdctl) → containerd → runc → containers

# Benefits:
# - Smaller attack surface (no dockerd)
# - Direct access to OCI images
# - Better integration with Kubernetes
# - Simpler debugging

# Install
apt install containerd

# Pull images
ctr images pull docker.io/library/nginx:alpine

# List images
ctr images ls

# Run containers
ctr run -t --rm docker.io/library/alpine:latest test-container ash

# Manage namespaces (like docker ps)
ctr ns ls
ctr -n k8s.io containers ls

# Install nerdctl
brew install nerdctl

# nerdctl works like docker but uses containerd
nerdctl build -t myapp:latest .
nerdctl run -p 8080:80 myapp:latest
nerdctl compose up

# Extra features nerdctl adds:
# - Image encryption (--encrypt)
# - BuildKit with containerd snapshotter
# - Gzip compression for images
# - Lazy pulling (stargz)

# /etc/buildkit/buildkitd.toml
[registry."docker.io"]
  mirrors = ["registry.docker.io"]

[registry."gcr.io"]
  insecure = true  # For air-gapped environments

[worker.oci]
  max-parallelism = 4  # Limit concurrent builds

[driver]
  snapshotter = "overlayfs"  # Faster than native

# Build with inline cache (embed cache metadata in image)
docker build --build-arg BUILDKIT_INLINE_CACHE=1 -t myapp:latest .

# Build with cache mount (persist package manager caches)
docker build -t myapp:latest . <<'EOF'
# syntax=docker/dockerfile:1.7
FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN --mount=type=cache,target=/root/.npm \
    npm ci --only=production
COPY . .
EOF

# The npm cache persists across builds
# `npm ci` runs with the cached node_modules

# Build for multiple architectures simultaneously
docker buildx create --use
docker buildx inspect --bootstrap

docker buildx build \
  --platform linux/amd64,linux/arm64 \
  --tag myapp:latest \
  --push \
  .

# This builds simultaneously on:
# - amd64 (Intel/AMD)
# - arm64 (Apple Silicon, ARM servers)
# and pushes a manifest list to the registry

# Kubernetes node configuration for containerd
# /etc/containerd/config.toml

version = 2

[plugins."io.containerd.grpc.v1.cri"]
  sandbox_image = "registry.k8s.io/pause:3.9"

  [plugins."io.containerd.grpc.v1.cri".containerd]
    default_runtime_name = "runc"
    snapshotter = "overlayfs"

    [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
      runtime_type = "io.containerd.runc.v2"
      privileged_without_host_devices = false

      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
        BinaryName = "/usr/bin/runc"
        SystemdCgroup = true

  [plugins."io.containerd.grpc.v1.cri".registry]
    config_path = "/etc/containerd/certs.d"

# Docker Desktop pricing (2026):
# - Individuals: Free
# - Small business (<250 employees, <$10M): Free
# - Medium business: $21/month/user
# - Large business: Commercial license required

# Alternatives:
# - Podman: Free
# - Lima: Free
# - Rancher Desktop: Free (macOS/Windows)
# - OrbStack: Free (macOS, faster than Lima)