Docker is dead? Podman – an alternative tool?

Re:Docker is dead? Podman – an alternative tool? by the8472 on Saturday June 04, 2022 @04:38AM (#31618237)

The problem with rootless is that you don't get a native network stack since setting up bridges and veth devices still requires some elevated capabilities. But instead of running full root this could be outsourced to a helper executable with some caps set (a narrower version of suid).

> Permission issues with bind mounts just totally disappear when you go rootless.

Recent kernel versions have gained uid mapping capabilities on mounts. Hopefully future docker will make use of it. Then we can run entire containers as different users.

[ Parent | on HN ]

Re:Docker is dead? Podman – an alternative tool? by phoronixrly on Saturday June 04, 2022 @06:41AM (#31618866)

TBH I don't want to expose the native network stack to containers

[ Parent | on HN ]

Re:Docker is dead? Podman – an alternative tool? by the8472 on Saturday June 04, 2022 @09:13AM (#31619912)

If your concern is kernel attack surface then I have bad news for you. Inside the container's network namespace it's still using standard syscalls. Only on the host side it takes a detour through userspace. So you get all the downsides, none of the native performance and very few upsides. It only benefits firewalls that still assume a machine has a single network interface without bridging/natting/forwarding.

[ Parent | on HN ]