5 ms·

The post links to "Podman - The next generation of Linux container tools" (https://developers.redhat.com/articles/podman-next-generation-linux-container-tools/

by andor 8y ago

The post links to "Podman - The next generation of Linux container tools" (https://developers.redhat.com/articles/podman-next-generation-linux-container-tools/ https://developers.redhat.com/articles/podman-next-generatio...), in which the author notes that Docker "requires anyone who wants to build a container image to have root access. That can create security risks". I'm extrapolating that an advantage of Podman is that it should not require root permissions. But almost every call to podman in the article involves sudo. Can anyone clarify?

9034725985 8y ago
(not a Red Hat employee) My understanding is that many, if not most, operations should not require sudo as of version 1.0. For example, try the commands at https://github.com/containers/libpod/blob/master/docs/tutorials/podman_tutorial.md https://github.com/containers/libpod/blob/master/docs/tutori...
- edwintorok 8y ago
  In some situations rootless works better, e.g. I was not able to use podman with sudo in a container that had `ping` in it [1]. OTOH rootless uses `fuse-overlayfs` instead of the in-kernel overlay2 driver, and initially I ran into a few bugs since it is not yet a fully POSIX filesystem (much like how the initial overlay kernel driver was buggy , and it wasn't only until overlay2 when it started working reliably with docker). Having said that I've been using only podman as an experiment at home, and upstream is very responsive in fixing bugs. There is also a `vfs` backend that can be used as a fallback until bugs in fuse-overlays get fixed. Would be nice if someone developed a testsuite that exercises all the usual FS operations that a container uses (permissions, setuid, setcap, symlinks, etc.) and compares vfs vs fuse-overlayfs vs in-kernel overlayfs vs docker? [1]https://github.com/containers/libpod/issues/2015 https://github.com/containers/libpod/issues/2015
atgreen 8y ago
The author explained that his version of podman (0.9.3) required root, but version 1.0 doesn't. And, indeed, version 1.0 does not. I use it regularly. It's an amazing improvement over the docker tooling. [disclaimer: I work for Red Hat]
hardwaresofton 8y ago
It's probably people using podman incorrectly. You can sudo with podman but you don't have to. Check out a recent talk on podman from the last Kubecon by Dan Walsh (https://www.youtube.com/watch?v=HIM0HwWLJ7g&t=1885 https://www.youtube.com/watch?v=HIM0HwWLJ7g&t=1885). Also, another benefit of podman is that it doesn't use the client-server model, it's just fork+exec no daemon needed. Dan has a bunch of talks that are great introductions to podman and container security in general: - https://www.youtube.com/watch?v=ZE2nI1SwSVk https://www.youtube.com/watch?v=ZE2nI1SwSVk - https://www.youtube.com/watch?v=msdaf3lBOn0 https://www.youtube.com/watch?v=msdaf3lBOn0 - https://www.youtube.com/watch?v=YkBk52MGV0Y https://www.youtube.com/watch?v=YkBk52MGV0Y - https://www.youtube.com/watch?v=40ynATurI7k https://www.youtube.com/watch?v=40ynATurI7k [EDIT] - I did not realize that non-root podman was a 1.0 feature -- as others have noted, podman <1.0 required sudo.
- rhatdan 8y ago
  Well rootless podman works before 1.0, but we have had many issues to work out. Overall it works very well.
  - fatherlinnux 8y ago
    Yeah, basically the "sudo" commands all over the Internet are just legacy. Historically, root was required (like docker - most people don't understand they are talking to a daemon which has root), but recently we added running as a user (aka rootless). Still the vast majority of docs you will see will refer to running with sudo or as root. That should change as rootless matures.
    - hardwaresofton 8y ago
      Since there are two redhat/podman powerhouses in this thread, first of all thanks for all the hard work! It's not like I'm anti-docker, but it has some hangups that I'll be happy to get away from when I have the chance. I feel like being tied to docker for so long made it harder to understand other tools like ctr/critool/containerd early on. Second thing -- I haven't looked into it much but do you know how the docker in docker support is in podman? Is this thread (https://github.com/containers/libpod/issues/746 https://github.com/containers/libpod/issues/746) the right one to watch?
fijiaarone 8y ago
As mentioned Podman 1.0 should not require sudo. But another advantage of Podman is that even when it does use sudo, there is traceability back to to user who invoked it (by checking the loginuid). This works because Podman forks a user process to execute instead of making a call to the Docker daemon which then executes (and uses the init loginuid). See this article for more details https://opensource.com/article/18/10/podman-more-secure-way-run-containers https://opensource.com/article/18/10/podman-more-secure-way-...
- rhatdan 8y ago
  Right there are many reasons to run podman as "real" root as well. Using containers within systemd unit files, is one use case. Setting up a docker daemon to run a single container at boot is way overkill. If you just use podman within a unit file to start/stop containers, it works really well, and does not sit around using up memory and allowing others to communicate with it.

by andor 8y ago

9034725985 8y ago

(not a Red Hat employee) My understanding is that many, if not most, operations should not require sudo as of version 1.0. For example, try the commands at https://github.com/containers/libpod/blob/master/docs/tutorials/podman_tutorial.md https://github.com/containers/libpod/blob/master/docs/tutori...

edwintorok 8y ago
In some situations rootless works better, e.g. I was not able to use podman with sudo in a container that had `ping` in it [1]. OTOH rootless uses `fuse-overlayfs` instead of the in-kernel overlay2 driver, and initially I ran into a few bugs since it is not yet a fully POSIX filesystem (much like how the initial overlay kernel driver was buggy , and it wasn't only until overlay2 when it started working reliably with docker). Having said that I've been using only podman as an experiment at home, and upstream is very responsive in fixing bugs. There is also a `vfs` backend that can be used as a fallback until bugs in fuse-overlays get fixed. Would be nice if someone developed a testsuite that exercises all the usual FS operations that a container uses (permissions, setuid, setcap, symlinks, etc.) and compares vfs vs fuse-overlayfs vs in-kernel overlayfs vs docker? [1]https://github.com/containers/libpod/issues/2015 https://github.com/containers/libpod/issues/2015

atgreen 8y ago

The author explained that his version of podman (0.9.3) required root, but version 1.0 doesn't. And, indeed, version 1.0 does not. I use it regularly. It's an amazing improvement over the docker tooling. [disclaimer: I work for Red Hat]

hardwaresofton 8y ago

It's probably people using podman incorrectly. You can sudo with podman but you don't have to. Check out a recent talk on podman from the last Kubecon by Dan Walsh (https://www.youtube.com/watch?v=HIM0HwWLJ7g&t=1885 https://www.youtube.com/watch?v=HIM0HwWLJ7g&t=1885). Also, another benefit of podman is that it doesn't use the client-server model, it's just fork+exec no daemon needed. Dan has a bunch of talks that are great introductions to podman and container security in general: - https://www.youtube.com/watch?v=ZE2nI1SwSVk https://www.youtube.com/watch?v=ZE2nI1SwSVk - https://www.youtube.com/watch?v=msdaf3lBOn0 https://www.youtube.com/watch?v=msdaf3lBOn0 - https://www.youtube.com/watch?v=YkBk52MGV0Y https://www.youtube.com/watch?v=YkBk52MGV0Y - https://www.youtube.com/watch?v=40ynATurI7k https://www.youtube.com/watch?v=40ynATurI7k [EDIT] - I did not realize that non-root podman was a 1.0 feature -- as others have noted, podman <1.0 required sudo.

rhatdan 8y ago
Well rootless podman works before 1.0, but we have had many issues to work out. Overall it works very well.
- fatherlinnux 8y ago
  Yeah, basically the "sudo" commands all over the Internet are just legacy. Historically, root was required (like docker - most people don't understand they are talking to a daemon which has root), but recently we added running as a user (aka rootless). Still the vast majority of docs you will see will refer to running with sudo or as root. That should change as rootless matures.
  - hardwaresofton 8y ago
    Since there are two redhat/podman powerhouses in this thread, first of all thanks for all the hard work! It's not like I'm anti-docker, but it has some hangups that I'll be happy to get away from when I have the chance. I feel like being tied to docker for so long made it harder to understand other tools like ctr/critool/containerd early on. Second thing -- I haven't looked into it much but do you know how the docker in docker support is in podman? Is this thread (https://github.com/containers/libpod/issues/746 https://github.com/containers/libpod/issues/746) the right one to watch?

fijiaarone 8y ago

As mentioned Podman 1.0 should not require sudo. But another advantage of Podman is that even when it does use sudo, there is traceability back to to user who invoked it (by checking the loginuid). This works because Podman forks a user process to execute instead of making a call to the Docker daemon which then executes (and uses the init loginuid). See this article for more details https://opensource.com/article/18/10/podman-more-secure-way-run-containers https://opensource.com/article/18/10/podman-more-secure-way-...

rhatdan 8y ago
Right there are many reasons to run podman as "real" root as well. Using containers within systemd unit files, is one use case. Setting up a docker daemon to run a single container at boot is way overkill. If you just use podman within a unit file to start/stop containers, it works really well, and does not sit around using up memory and allowing others to communicate with it.