Docker is dead? Podman – an alternative tool?

Re:Docker is dead? Podman – an alternative tool? by RyEgswuCsn on Saturday June 04, 2022 @06:50AM (#31618910)

No it’s not. File written from inside the container into a mounted volume as root will be owned by root outside the container (uid 0, to be specific; doesn’t matter what the user is named).

Edit: I might have misunderstood parent, who might be referring to Podman attempting to manage the uid mapping.

[ Parent | on HN ]

Re:Docker is dead? Podman – an alternative tool? by gnfurlong on Saturday June 04, 2022 @07:16AM (#31619058)

The parent comment is still talking about rootless podman (and really just user namespaces). Root in the container is absolutely mapped to the user executing podman outside the container.

If it mapped to root outside the container, you could just use podman to create setuid scripts owned by root for very trivial privelege escalation.

[ Parent | on HN ]

Re:Docker is dead? Podman – an alternative tool? by RyEgswuCsn on Saturday June 04, 2022 @08:40AM (#31619621)

Yes I think you are right --- I was mistaken. Docker without the rootless operate in the way I described.

[ Parent | on HN ]

Re:Docker is dead? Podman – an alternative tool? by weitzj on Saturday June 04, 2022 @07:06AM (#31619004)

Last thing I remember you can tweak your /etc/setuid, setgid to properly map between the user inside the container and outside

[ Parent | on HN ]