Re:Podman: A Daemonless Container Engine
by zaarn on Thursday February 11, 2021 @10:53AM
(#26102896)
Rootless Docker is basically a joke, I've tried to run production workloads on it for about a year before I gave up. Numerous docker images will refuse to work, a bunch of things will subtly fill your error logs with warnings and it doesn't mesh well with running docker swarm at all.
Re:Podman: A Daemonless Container Engine
by raesene9 on Thursday February 11, 2021 @10:57AM
(#26102972)
Rootless docker only left experimental status with 20.10 which came out in December 2020, so maybe they would have addressed some of those issues...
As to swarm, I was comparing Docker rootless to podman, which is more a developer use case than prod. container clusters.
Second point, yep if you run Docker as root and someone can access the socket file they get root.
If that's a concern, you can run Docker rootless.
And as we're talking file permissions on a local host to allow that access, the same applies to podman containers does it not? If there are permission issues allowing another user to use access the container filesystems, you have the same problem.