Podman and Docker Engine differences cause infinite drift

[johnkeates]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and docker Provider) Version

Terraform v1.5.1
on darwin_arm64

• provider registry.terraform.io/kreuzwerker/docker v3.6.2

Affected Resource(s)

• docker_container

Terraform Configuration Files

terraform {
  required_providers {
    docker = {
      source  = "kreuzwerker/docker"
      version = "~> 3.0"
    }
  }
}

resource "docker_image" "nginx" {
  name = "nginx:1.25-alpine"
}

resource "docker_container" "web_server" {
  image = docker_image.nginx.image_id
  name  = "terraform-demo-server"

  ports {
    internal = 80
    external = 8080
  }
}

Expected Behaviour

This should pull an image and then create a container using that image. On subsequent applies, it should not show any changes, regardless of the engine or runtime used.

Actual Behaviour

On Rancher Desktop this works as expected.
On Podman Desktop this will forever require replacement due to different defaults:

      - pid_mode                                    = "private" -> null # forces replacement
      - ulimit { # forces replacement
          - hard = 4194304 -> null
          - name = "RLIMIT_NPROC" -> null
          - soft = 4194304 -> null
        }

Steps to Reproduce

Using Podman with the Docker compatibility socket enabled:

1. terraform apply will create as expected
2. terraform apply will show drift (or differences), not expected

Important Factoids

This is likely due to the stateless/rootless nature of Podman.
Adding the pid_mode and ulimit settings will make it work fine on Podman, but will no longer work for Rancher Desktop, since it doesn't support that pid_mode.

Ideally we'd be able to either ignore those, natively load defaults, do it conditionally, or have a data source that informs us enough to allow for different resources to be created depending on what 'flavour' of container runtime we're talking to.

References

• Support for Podman #113

[ianwremmel]

For what it's worth, I'm running into something similar using docker. I'm pretty sure the ports blocks are somehow not ending up in state correctly. Adding the following lifecycle block solves my problem (admittedly, not ideal):

  lifecycle {
    ignore_changes = [
      ports,
    ]
  }