5 ms·
podman is supposed to be more secure than docker. How do they reach improved security? By limiting access to the system that could be dangerous if misused. Obvi
by usr1106 3y ago
podman is supposed to be more secure than docker. How do they reach improved security? By limiting access to the system that could be dangerous if misused. Obviously with additional limitations comes incompatibility. If your image tries to do something that is no longer allowed the same way, it won't work the same way as before. Compatibility exists only for images that don't do anything potentially dangerous. Ironically enough for those you would not need podman. But it's of course still a good idea to use it. Few people know in every detail what their images are trying to do.
- hyperpape 3y agoI’m not averse to things that introduce complications for security, but it’s very poorly advertised. The overall impression a new user gets is that podman should just work as a Docker replacement, and this is frequently untrue. My own experience is that I started using podman when docker on Fedora wouldn’t work with cgroups v2. Iirc, I could (and should) have made configuration changes to make Docker work, but I wasted a lot of time tracking down issues because I thought podman would have better compatibility than it had. Upthread there’s a good suggestion that the authors should create an explicit compatibility document.