> You can also call docker commands by being part of the docker group IIRC.

Which effectively gives you root on the host.

Which is an horrible practice and has roughly the same attack surface as login as root all the time.

With podman there is no daemon, everything is running as you. The standard setup for docker has a daemon running as root, which means when you start a container it has root privileges.