Enterprise Podman Security: Rootless Containers, SELinux, Backups & Docker Comparison
blog.nviso.eu
Reduce attack surface using Podman's rootless daemonless model, SELinux integration & Docker comparison
  • trolololol@lemmy.worldEnglish
    2·
    10 hours ago

    I’ve heard of podman quite a bit but never tried it.

    Is it truly free and open source?

    Does it run only in Linux?

    • Spore@lemmy.mlEnglish
      3·
      8 hours ago

      Is it truly free and open source?

      Yes, both podman and podman-desktop are FOSS under Apache-2.0 license. And they prefer more open image hosts like quay.io by default (dockerhub is still available OOTB for it to be a drop-in replacement of docker)

      Does it run only in Linux?

      No, it runs on Linux, Windows and MacOS (through VMs on the latter two) and my experience is that it works better than docker on non-Linux machines.

    • chicuongle@lemmy.worldEnglish
      2·
      7 hours ago

      I think that is a question about trust and time. As long as Redhat does not change their policy, YES. For an open source project is it very important if the community is big enough to defense big tech desire for money. In my opinion, Red Hat hat a very good business model to balance and in long time Podman will be free

  • lambalicious@lemmy.sdf.orgEnglish
    8·
    1 day ago

    It’s pretty great, and I like that the workflow for creating containers is sliiiightly easier than on Docker. I switched from Docker to Podman for most stuff about a year ago and so far there are only two hiccups that I lament:

    • the higher disk consumption due to not being able to share image storage. (I’ve tried with additionalstorages but that seems to only be respected for podman run; podman build and podman compose seem to ignore it and always pull images from the registries)

    • Some annoying isses with fule permissions due to rootless design - running rootless containers will create files under your user storage that you as a user have no permission to transfer or remove for cleanup or security, and severely breaks the output of tools like du or find due to error spammage.

    • Jayjader@jlai.luEnglish
      5·
      15 hours ago

      In case you omitted the following out of ignorance and not by deliberate choice:

      podman unshare can be used to (mostly) painlessly access the files created by rootless podman.

      • lambalicious@lemmy.sdf.orgEnglish
        3·
        12 hours ago

        Oh thanks, I know well about it. podman unshare is the reason why those permission issues are not major (eg.: you don’t need to ever sudo to solve the permission issues rootless causes, I think?). But my going to was more focused o borking the output or workflow of using some of the “usual” tools of a Linux console, such as needing to account for the potential existence of a podman environment on the user account (or any given user account, if doing house cleaning under root) if you ever need to rely on the recursive results of things like chmod or find.