The docker daemon has historically had some stability issues as well as some security implications. Running a command line tool like rkt is a vastly smaller attack surface and less complex stack overall.
You are namespaced, so the linux kernel promises that even though you're root, you're not dangerous, and there is syscall filtering and shit going on.... but that historically has not really fared that well!
But your statement is false. You're root with and without privileged. Privileged gives you back CAPABILITIES which are different than USER, so your claim is bullshit.
That is objectively false.
uid = 0 is "privileged" basically everywhere in the kernel, from filesystem management (reading a file bindmounted in that's owned by root e.g.) to binding to low ports (like 80).
As you can see from the docs, it says "the most important security improvement is that, by default, container processes running as the root user will have expected administrative privilege (with some restrictions) inside the container but will effectively be mapped to an unprivileged uid on the host."
This implies the reverse, that if you don't use userns then your process as root in the container will be mapped to a privilege uid on the host.
This is all I'm saying is true. You clearly don't understand what I'm saying.
This API has to enabled explicitly. Docker daemon works by using a unix socket instead ( "/var/run/docker.sock" ).
> acts more or less like an init for containers
There is Docker daemon and there is Docker CLI. Both have separate scopes.
Docker CLI is glorified curl, everything happens in the daemon (containerd being logically -- but finally not physically -- part of the daemon).
If you'll indulge me putting on my corporate hat for a minute: we've had some customers very happy scheduling a high volume of containers at a high rate on nomad:
- https://www.hashicorp.com/c1m.html (mentions a docker bug even)
- https://www.youtube.com/watch?v=MRtRwhL5lwM
If at all possible I'd recommend using our Java or exec drivers as they use builtin containerization and avoid the overhead of docker or rkt.