7 ms·

> Because of its daemonless architecture, Podman can perform truly rootless operations. Daemonless isn't really relevant to rootless. containerd/buildkitd/doc

> Because of its daemonless architecture, Podman can perform truly rootless operations. Daemonless isn't really relevant to rootless. containerd/buildkitd/dockerd have been supporting rootless mode too, and lots of rootless codes have been mutually ported over across containerd/buildkitd/dockerd and Podman.

mekster 4y ago
What exactly does rootless achieve? Is it some slight security benefit as in running OpenBSD instead of Linux but no difference for day to day usage? What are the advantage of running Podman over Docker except Podman ecosystem is less mature?
- taftster 4y ago
  The biggest problem with Docker is that its containers are effectively running as root. This is basically OK when the containers you want to run are more like traditional daemons. But if you allow normal users to run containers, in a shared multiuser system, you are basically giving them root to do what they want with your system. e.g. if a normal user can execute a docker container, they can create a mount point for anywhere in your system. They can mount /etc or any other spooky place and be able to read from it like they are root. This is also potentially bad, for example, if you have a network facing daemon, like a web server. Let's say that you bind mount a directory on the host (because yeah, you want to serve up those static HTML files). The privileges of that container (Apache httpd or whatever) are basically running as root on the host system. Not good. There are solutions for all this, of course. But this is really where Podman was trying to bring in advantage and added-value over Docker. That and just running as a normal process rather than as a daemon.
  - AkihiroSuda 4y ago
    > The biggest problem with Docker is that its containers are effectively running as root. Both Docker and Podman support rootless mode (and rootful mode).
    - rhatdan 4y ago
      Sure but to me, and I am obviously biased, if I want to run a container on my system I don't want to fire up multiple daemons in my homedir and then have them sitting out there using resources, when all I want to do is run a containerized application. One beautiful thing about Podman is it can fire up, pull the image from the container registry, start the container and then go away. Leaving you with only the containerized application running in rootless mode. To do this with Docker, you fire up the entire Docker infrastructure, then launch the docker client, once the application is up and running, you still need to shut down the docker infrastructure. Even if you run with podman socket activated server, the podman service will not be running until someone connects to the service, once the connection to the service goes away, the podman service shuts down no longer using system resources.
    - taftster 4y ago
      I mean, that's totally fair response. I should have provided a caveat, "historically speaking", that Docker has lacked support for rootless containers. But yes, solutions have emerged recently. Podman out the gate has had the facility, which I think it used as a means to distinguish itself. This is great, because maybe that helped push Docker in the right direction.
      - AkihiroSuda 4y ago
        Not really recently. Both were implemented almost simultaneously in circa June 2018. https://github.com/AkihiroSuda/docker/commit/588a4e91fc8cb99af040dcde795ba6722a162127 https://github.com/AkihiroSuda/docker/commit/588a4e91fc8cb99... https://github.com/containers/podman/commit/19f5a504ffb1470991f331db412be456e41caab5 https://github.com/containers/podman/commit/19f5a504ffb14709... Rootless Docker wasn't merged/released until Docker 19.03, though , but still it is already nearly 4 years old.
        taftster 4y ago
        The older I get, the more it is that "4 years" ago feels like 4 days ago. You calling out my perspective of "recently" is totally fair, because to me, it feels like recently, whereas truthfully maybe not so. Thanks for the reply, I appreciate the facts.

mekster 4y ago

What exactly does rootless achieve? Is it some slight security benefit as in running OpenBSD instead of Linux but no difference for day to day usage? What are the advantage of running Podman over Docker except Podman ecosystem is less mature?

taftster 4y ago
The biggest problem with Docker is that its containers are effectively running as root. This is basically OK when the containers you want to run are more like traditional daemons. But if you allow normal users to run containers, in a shared multiuser system, you are basically giving them root to do what they want with your system. e.g. if a normal user can execute a docker container, they can create a mount point for anywhere in your system. They can mount /etc or any other spooky place and be able to read from it like they are root. This is also potentially bad, for example, if you have a network facing daemon, like a web server. Let's say that you bind mount a directory on the host (because yeah, you want to serve up those static HTML files). The privileges of that container (Apache httpd or whatever) are basically running as root on the host system. Not good. There are solutions for all this, of course. But this is really where Podman was trying to bring in advantage and added-value over Docker. That and just running as a normal process rather than as a daemon.
- AkihiroSuda 4y ago
  > The biggest problem with Docker is that its containers are effectively running as root. Both Docker and Podman support rootless mode (and rootful mode).
  - rhatdan 4y ago
    Sure but to me, and I am obviously biased, if I want to run a container on my system I don't want to fire up multiple daemons in my homedir and then have them sitting out there using resources, when all I want to do is run a containerized application. One beautiful thing about Podman is it can fire up, pull the image from the container registry, start the container and then go away. Leaving you with only the containerized application running in rootless mode. To do this with Docker, you fire up the entire Docker infrastructure, then launch the docker client, once the application is up and running, you still need to shut down the docker infrastructure. Even if you run with podman socket activated server, the podman service will not be running until someone connects to the service, once the connection to the service goes away, the podman service shuts down no longer using system resources.
  - taftster 4y ago
    I mean, that's totally fair response. I should have provided a caveat, "historically speaking", that Docker has lacked support for rootless containers. But yes, solutions have emerged recently. Podman out the gate has had the facility, which I think it used as a means to distinguish itself. This is great, because maybe that helped push Docker in the right direction.
    - AkihiroSuda 4y ago
      Not really recently. Both were implemented almost simultaneously in circa June 2018. https://github.com/AkihiroSuda/docker/commit/588a4e91fc8cb99af040dcde795ba6722a162127 https://github.com/AkihiroSuda/docker/commit/588a4e91fc8cb99... https://github.com/containers/podman/commit/19f5a504ffb1470991f331db412be456e41caab5 https://github.com/containers/podman/commit/19f5a504ffb14709... Rootless Docker wasn't merged/released until Docker 19.03, though , but still it is already nearly 4 years old.
      - taftster 4y ago
        The older I get, the more it is that "4 years" ago feels like 4 days ago. You calling out my perspective of "recently" is totally fair, because to me, it feels like recently, whereas truthfully maybe not so. Thanks for the reply, I appreciate the facts.