4 ms·

> There aren't really any advantages to using it for individual users. Cheers, but his is not true. Running a container without root privilege is a security a

> There aren't really any advantages to using it for individual users. Cheers, but his is not true. Running a container without root privilege is a security advantage for users who run containers that (inevitably) contain vulnerabilities.

znpy 3y ago
This is so true… also different users on the same machine can have their own podman daemon mimicking their own private docker daemon. In some cases it can be useful to run different containers as different users.
IshKebab 3y ago
You have sudo though presumably, so there's not much difference between giving it access to your account and directly giving it root.
bildiba 3y ago
Even more so if said containers contain Trojans. Bit more secure than running directly, but if the container is broken out of, attacker directly gets root.
- mmh0000 3y ago
  Adding to the parent's point. The docker hub is full of malware images and the docker devs could not care less.1.2.3. 1. https://www.bleepingcomputer.com/news/security/docker-hub-repositories-hide-over-1-650-malicious-containers/ https://www.bleepingcomputer.com/news/security/docker-hub-re... 2. https://sysdig.com/blog/analysis-of-supply-chain-attacks-through-public-docker-images/ https://sysdig.com/blog/analysis-of-supply-chain-attacks-thr... 3. https://www.bleepingcomputer.com/news/security/thousands-of-images-on-docker-hub-leak-auth-secrets-private-keys/ https://www.bleepingcomputer.com/news/security/thousands-of-...
  - heresie-dabord 3y ago
    It's often the case with software "repositories". Pypi, npm, Maven... Security is expensive. An organisation needs money, on-staff security professionals, and (of course) lawyers to explicitly commit to maintaining a package system. Even MAAMAN (was FAANG) app stores have been exploited. FYI your second link is broken or dead.

4 ms·

> There aren't really any advantages to using it for individual users. Cheers, but his is not true. Running a container without root privilege is a security a

by heresie-dabord 3y ago

znpy 3y ago
This is so true… also different users on the same machine can have their own podman daemon mimicking their own private docker daemon. In some cases it can be useful to run different containers as different users.
IshKebab 3y ago
You have sudo though presumably, so there's not much difference between giving it access to your account and directly giving it root.
bildiba 3y ago
Even more so if said containers contain Trojans. Bit more secure than running directly, but if the container is broken out of, attacker directly gets root.
- mmh0000 3y ago
  Adding to the parent's point. The docker hub is full of malware images and the docker devs could not care less.1.2.3. 1. https://www.bleepingcomputer.com/news/security/docker-hub-repositories-hide-over-1-650-malicious-containers/ https://www.bleepingcomputer.com/news/security/docker-hub-re... 2. https://sysdig.com/blog/analysis-of-supply-chain-attacks-through-public-docker-images/ https://sysdig.com/blog/analysis-of-supply-chain-attacks-thr... 3. https://www.bleepingcomputer.com/news/security/thousands-of-images-on-docker-hub-leak-auth-secrets-private-keys/ https://www.bleepingcomputer.com/news/security/thousands-of-...
  - heresie-dabord 3y ago
    It's often the case with software "repositories". Pypi, npm, Maven... Security is expensive. An organisation needs money, on-staff security professionals, and (of course) lawyers to explicitly commit to maintaining a package system. Even MAAMAN (was FAANG) app stores have been exploited. FYI your second link is broken or dead.