I use podman because it’s more secure. I’m willing to put in the extra effort so that all my services aren’t running as root. If it turns out a vulnerability is discovered in lemmy tomorrow that allows people to access my server through my lemmy container, the attacker will only have access to a dummy account that hosts my containers. Yes, they could stop all my containers, but they can’t delete the volumes or any other data on my server.
Podman might have a “more secure” design but you can run the docker daemon as rootless. Podman itself is not immune to vulnerabilities and will not solve all your security problems.
Don’t let perfection be the enemy of good. Security is not all or nothing. Reducing the attack surface is still important.
Can you elaborate on running docker daemon as rootless? It’s my understanding that you can add your account to a group to access the docker daemon rootless, but the containers are still running as root, as the daemon itself raises the access to root.
but the containers are still running as root, as the daemon itself raises the access to root.
No. The daemon can run without root, as such the containers don’t have root. My docker install doesn’t have root access. None of my stacks / containers need any root access tbh. I don’t have any troubles with deplyong stuff.
Not sure relying on podman alone as a security tool might be advisable. Podman is a container technology first, security is not the main goal.
Read more about rootless docker here.
