• hottari@lemmy.ml
    link
    fedilink
    English
    arrow-up
    0
    ·
    1 year ago

    Any time I always read how to accomplish something in podman-land , the action takes like 5 extra steps compared to docker, is probably an experimental feature that’s not supported and is always from a non-official source or some random blog.

    • Dandroid@dandroid.app
      link
      fedilink
      English
      arrow-up
      0
      ·
      1 year ago

      I use podman because it’s more secure. I’m willing to put in the extra effort so that all my services aren’t running as root. If it turns out a vulnerability is discovered in lemmy tomorrow that allows people to access my server through my lemmy container, the attacker will only have access to a dummy account that hosts my containers. Yes, they could stop all my containers, but they can’t delete the volumes or any other data on my server.

      • hottari@lemmy.ml
        link
        fedilink
        English
        arrow-up
        0
        ·
        1 year ago

        Podman might have a “more secure” design but you can run the docker daemon as rootless. Podman itself is not immune to vulnerabilities and will not solve all your security problems.

        • Dandroid@dandroid.app
          link
          fedilink
          English
          arrow-up
          0
          ·
          1 year ago

          Don’t let perfection be the enemy of good. Security is not all or nothing. Reducing the attack surface is still important.

          Can you elaborate on running docker daemon as rootless? It’s my understanding that you can add your account to a group to access the docker daemon rootless, but the containers are still running as root, as the daemon itself raises the access to root.

          • hottari@lemmy.ml
            link
            fedilink
            English
            arrow-up
            0
            ·
            1 year ago

            Not sure relying on podman alone as a security tool might be advisable. Podman is a container technology first, security is not the main goal.

            Read more about rootless docker here.

            • Dandroid@dandroid.app
              link
              fedilink
              English
              arrow-up
              0
              ·
              1 year ago

              I never said I was relying on it alone. Not sure why you think that.

              That’s a great link. Thank you for sharing. It’s good that docker supports this functionality now.

              • hottari@lemmy.ml
                link
                fedilink
                English
                arrow-up
                0
                ·
                1 year ago

                I never said I was relying on it alone. Not sure why you think that.

                …all my services aren’t running as root.

                If it turns out a vulnerability is discovered in lemmy tomorrow that allows people to access my server through my lemmy container, the attacker will only have access to a dummy account that hosts my containers.

                This was your argument according to you for why you think podman is more secure (than docker I presume). Seemed to imply rootless podman will save you from an attacker. I was simply disproving the flawed notion.

                • BlueBockser@programming.dev
                  link
                  fedilink
                  English
                  arrow-up
                  0
                  arrow-down
                  1
                  ·
                  1 year ago

                  I think you’re interpreting too much. Security is about layers and making it harder for attackers, and that’s exactly what using a non-root user does.

                  In that scenario, the attacker needs to find and exploit another vulnerability to gain root access, which takes time - time which the attacker might not be willing to spend and time which you can use to respond.

                  • hottari@lemmy.ml
                    link
                    fedilink
                    English
                    arrow-up
                    0
                    ·
                    1 year ago

                    You don’t know enough about security to lecture me. The kernel has before/continues to suffer(ed) from successful root shell exploits, particularly in this case via unprivileged userns. Something podman or even rootless docker can’t do anything about.