Also, another benefit of podman is that it doesn't use the client-server model, it's just fork+exec no daemon needed. Dan has a bunch of talks that are great introductions to podman and container security in general:
- https://www.youtube.com/watch?v=ZE2nI1SwSVk
- https://www.youtube.com/watch?v=msdaf3lBOn0
- https://www.youtube.com/watch?v=YkBk52MGV0Y
- https://www.youtube.com/watch?v=40ynATurI7k
[EDIT] - I did not realize that non-root podman was a 1.0 feature -- as others have noted, podman <1.0 required sudo.