3 ms·
You mean for the container launcher to not require root? Root isn’t required — look at Podman. Docker spent so much on marketing, the world is too blind to pi
by BobbyTables2 2y ago
You mean for the container launcher to not require root?
Root isn’t required — look at Podman.
Docker spent so much on marketing, the world is too blind to pivot to a superior alternative!
- zokier 2y agoPeople were running containers for a decade before rootless podman came around. There has been lot of sharp corners around userns and related tech that needed to get resolved. Notably Debian& Ubuntu disabled unprivileged userns for some legitimate security concerns
- Aardwolf 2y agoI really don't get that: having to run something substantial as root seems a much bigger security concern, than what it is shielding from user space (example: hosting a web server at port 80)
- epr 2y agoFunny, the original commit message for that suggests it was simply a precaution. It's not out of the ordinary to avoid newer kernel features just in case. > This is a short-term patch. Unprivileged use of CLONE_NEWUSER is certainly an intended feature of user namespaces. However for at least saucy we want to make sure that, if any security issues are found, we have a fail-safe. from: https://web.archive.org/web/20211022013829/https://kernel.ubuntu.com/git/serge/ubuntu-saucy.git/commit/?id=5c847404dcb2e3195ad0057877e1422ae90892b8 https://web.archive.org/web/20211022013829/https://kernel.ub...