4 ms·
I find Podman frustrating at times because of how strict is with ACLs, UID maps and its integrations with SELINUX. I've had a chown/chmod -R of my own home fold
by irusensei 3y ago
I find Podman frustrating at times because of how strict is with ACLs, UID maps and its integrations with SELINUX. I've had a chown/chmod -R of my own home folder (for migration purposes) cripple all podman (AND toolbox) related stuff for my user.
All in all its a great program and IMO even better than docker but It would be great if people try to make it sound like its a 1:1 comparison to Docker because it has its trade offs.
- pjmlp 3y agoSecurity is a pain, however cleaning up after the fact is even worse.
- deleted 3y ago[deleted]
- amluto 3y agoI would argue that the selinux and uid issues with podman are selinux and posix DAC’s fault. Selinux is neat but is IMO conceptually wrong in a container world. UIDs and are barely better. At most, these mechanisms should confirm that the container as a whole has a given permission, and that’s it. (Seriously, the major clouds have deprecated per-object permissions on their object stores. IMO they are right to have done so.)
- nicce 3y agoIt might feel frustrating, but there is a great reason. It gives you a more secure environment. When Docker just "works", you are unaware of the fact that you have given more permissions than app might actually need, increasing the attack vector. Podman's use of SELinux prevents and mitigates many of these issues what you will have if somone targets your app.