IIRC, docker by default runs a daemon as root, which spawns all your containers. It is possible to run it rootless as well (https://docs.docker.com/engine/secur

IIRC, docker by default runs a daemon as root, which spawns all your containers. It is possible to run it rootless as well (https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/), though you’d need a separate daemon for each user you’d want to run containers as. Podman doesn’t have that. It spawns containers without the help of a controlling daemon, and can spawn containers both as root and rootless. Rootless is of course a fairly big deal considering if you run docker containers as root, and runc has a vulnerability, you could potentially escape the container and become root, where a rootless installation would just let you escape to whatever user is running the container.