Hacker News new | past | comments | ask | show | jobs | submit login

I used instead of Docker for a while because it came by default on RHEL (I'm using 8).

It has very impressive compatibility with Docker. For 99% of use cases you will not even know you are using Podman. The one case that forced me to uninstall it and use Docker was running `gitlab-runner`'s integration tests which do some funny things with Vagrant and VMWare, and Podman didn't like it. But overall I am very impressed with the compatibility.

There aren't really any advantages to using it for individual users. Being rootless is a huge upside on the server though. At my previous company I accidentally deleted all the containers running on a server because I naively assumed that Docker followed the normal permission model and would only let me delete my containers. Imagine my surprise when I learned that Docker basically runs as root and all users that have access to Docker have root access!

Of course I only made that mistake once, but still... Crazy design.




> There aren't really any advantages to using it for individual users.

Cheers, but his is not true.

Running a container without root privilege is a security advantage for users who run containers that (inevitably) contain vulnerabilities.


This is so true… also different users on the same machine can have their own podman daemon mimicking their own private docker daemon.

In some cases it can be useful to run different containers as different users.


Even more so if said containers contain Trojans.

Bit more secure than running directly, but if the container is broken out of, attacker directly gets root.


Adding to the parent's point. The docker hub is full of malware images and the docker devs could not care less.1.2.3.

1. https://www.bleepingcomputer.com/news/security/docker-hub-re...

2. https://sysdig.com/blog/analysis-of-supply-chain-attacks-thr...

3. https://www.bleepingcomputer.com/news/security/thousands-of-...


It's often the case with software "repositories". Pypi, npm, Maven... Security is expensive.

An organisation needs money, on-staff security professionals, and (of course) lawyers to explicitly commit to maintaining a package system.

Even MAAMAN (was FAANG) app stores have been exploited.

FYI your second link is broken or dead.


You have sudo though presumably, so there's not much difference between giving it access to your account and directly giving it root.


Important to note: docker now supports running everything as rootless, with the same caveats as Podman.


>There aren't really any advantages to using it for individual users.

I'd consider not having to run a service I give root on my machine just to run some containers an advantage as a individual (dev) user.

And however crap RH/IBM itself is, not dealing with Docker corp is also quite good.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: