I would argue that the selinux and uid issues with podman are selinux and posix DAC’s fault. Selinux is neat but is IMO conceptually wrong in a container world

I would argue that the selinux and uid issues with podman are selinux and posix DAC’s fault. Selinux is neat but is IMO conceptually wrong in a container world. UIDs and are barely better. At most, these mechanisms should confirm that the container as a whole has a given permission, and that’s it. (Seriously, the major clouds have deprecated per-object permissions on their object stores. IMO they are right to have done so.)