Hacker News Reader

Comment by andor | Hacker News Reader

The post links to "Podman - The next generation of Linux container tools" (https://developers.redhat.com/articles/podman-next-generatio...), in which the author notes that Docker "requires anyone who wants to build a container image to have root access. That can create security risks".

I'm extrapolating that an advantage of Podman is that it should not require root permissions. But almost every call to podman in the article involves sudo. Can anyone clarify?

View on HN

It's probably people using podman incorrectly. You can sudo with podman but you don't have to. Check out a recent talk on podman from the last Kubecon by Dan Walsh (https://www.youtube.com/watch?v=HIM0HwWLJ7g&t=1885).

Also, another benefit of podman is that it doesn't use the client-server model, it's just fork+exec no daemon needed. Dan has a bunch of talks that are great introductions to podman and container security in general:

- https://www.youtube.com/watch?v=ZE2nI1SwSVk

- https://www.youtube.com/watch?v=msdaf3lBOn0

- https://www.youtube.com/watch?v=YkBk52MGV0Y

- https://www.youtube.com/watch?v=40ynATurI7k

[EDIT] - I did not realize that non-root podman was a 1.0 feature -- as others have noted, podman <1.0 required sudo.

Well rootless podman works before 1.0, but we have had many issues to work out. Overall it works very well.

Yeah, basically the "sudo" commands all over the Internet are just legacy. Historically, root was required (like docker - most people don't understand they are talking to a daemon which has root), but recently we added running as a user (aka rootless). Still the vast majority of docs you will see will refer to running with sudo or as root.

That should change as rootless matures.

Since there are two redhat/podman powerhouses in this thread, first of all thanks for all the hard work! It's not like I'm anti-docker, but it has some hangups that I'll be happy to get away from when I have the chance. I feel like being tied to docker for so long made it harder to understand other tools like ctr/critool/containerd early on.

Second thing -- I haven't looked into it much but do you know how the docker in docker support is in podman? Is this thread (https://github.com/containers/libpod/issues/746) the right one to watch?

The author explained that his version of podman (0.9.3) required root, but version 1.0 doesn't. And, indeed, version 1.0 does not. I use it regularly. It's an amazing improvement over the docker tooling. [disclaimer: I work for Red Hat]

(not a Red Hat employee)

My understanding is that many, if not most, operations should not require sudo as of version 1.0.

For example, try the commands at https://github.com/containers/libpod/blob/master/docs/tutori...

In some situations rootless works better, e.g. I was not able to use podman with sudo in a container that had `ping` in it [1]. OTOH rootless uses `fuse-overlayfs` instead of the in-kernel overlay2 driver, and initially I ran into a few bugs since it is not yet a fully POSIX filesystem (much like how the initial overlay kernel driver was buggy , and it wasn't only until overlay2 when it started working reliably with docker). Having said that I've been using only podman as an experiment at home, and upstream is very responsive in fixing bugs. There is also a `vfs` backend that can be used as a fallback until bugs in fuse-overlays get fixed.

Would be nice if someone developed a testsuite that exercises all the usual FS operations that a container uses (permissions, setuid, setcap, symlinks, etc.) and compares vfs vs fuse-overlayfs vs in-kernel overlayfs vs docker?

[1]https://github.com/containers/libpod/issues/2015

As mentioned Podman 1.0 should not require sudo. But another advantage of Podman is that even when it does use sudo, there is traceability back to to user who invoked it (by checking the loginuid). This works because Podman forks a user process to execute instead of making a call to the Docker daemon which then executes (and uses the init loginuid).

See this article for more details https://opensource.com/article/18/10/podman-more-secure-way-...

Right there are many reasons to run podman as "real" root as well. Using containers within systemd unit files, is one use case. Setting up a docker daemon to run a single container at boot is way overkill. If you just use podman within a unit file to start/stop containers, it works really well, and does not sit around using up memory and allowing others to communicate with it.

Reply on news.ycombinator.com