From what I have seen, rootless podman seems to take more effort (even if marginal) than rootful one. I want to make a more informed decision for the containers, so I would like to ask.

  1. What is a rootless podman good for? How much does it help in terms of security, and does it have other benefits?
  2. One of the benefits commonly mentioned is for when container is breached. Then, running container on sudo-capable user would give no security benefits. Does it mean I should run podman services on a non-privileged user?

Thank you!

  • cmgvd3lw@discuss.tchncs.deEnglish
    0·
    1 month ago

    One of the main advantage of podman is that, it respects the firewall rules. Docker don’t do that. Also having rootless podman means if somehow the container went rogue, it cannot have access to your root directory and perform malicious actions.

    Also podman is a drop in replacement for docker. It does not need much configurations to setup. If you need compose, you might need to install podman-compose as well.

    • Railcar8095@lemm.eeEnglish
      1·
      1 month ago

      I always hear podman is a drop in replacement, but every time I try most of my stack doesn’t work. Permissions seem to be the issue most of the times, even when I create new volumes. I will try again in a few years probably, but I’m not holding my breath

      • asap@lemmy.worldEnglish
        0·
        1 month ago

        You need to add :Z to the end of your volume lines, or lowercase z for shared volumes.

        I’m running 50+ containers, probably most of the popular ones, and all working fine.

        • Railcar8095@lemm.eeEnglish
          1·
          1 month ago

          You made me try again, and I again failed. For example, Navidrome has this issue: https://github.com/navidrome/navidrome/issues/2967

          It seems aside from :z i have to remap the user namespace, which I remember trying in the past too and getting mixed results (some worked, some still didn’t). I get this is not a podman issue (also affects rootless docker), but given the default behavior of docker is root, I am not having this issue.

          The others didn’t seem to fail at creation, which is a good thing, but I recall some had issues interacting with each other (files created by one not being readable by another and such). Might try with some other navidrome image (or equivalent subsonic server) but unless it’s as easy as adding :z, I don’t think ill be able to continue Thanks in any case :)

    • someonesmall@lemmy.mlEnglish
      0·
      1 month ago

      How would a rogue container be able to access the root directory of the host? Wouldn’t it just be able to access the data on the docker volumes? Thank you.

  • glizzyguzzler@lemmy.blahaj.zoneEnglish
    0·
    1 month ago

    This answers all of your questions: https://github.com/containers/podman/discussions/13728 (link was edited, accidentally linked a redhat blog post that didn’t answer your Q directly but does make clear that specifying a user in rootless podman is important for security for the user running the rootless podman container if that user does more than just run the rootless podman container).

    So the best defense plus ease of use is podman root assigning non-root UIDs to the containers. You can do the same with Docker, but Docker with non-root UIDs assigned still caries the risk of the root-level Docker daemon being hacked and exploited. Podman does not have a daemon to be hacked and exploited, meaning root Podman with non-root UIDs assigned has no downsides!