Learn about the future of Portainer - 3.0 - our new focus, and what it means for current and future users.
  • antheraeavx@slrpnk.netOP
    1·
    4 hours ago

    You can run rootless Podman with Portainer, I do too. Or used to, before ditching Portainer.

    Can you elaborate on the ways a home lab is less secure if it runs a container management GUI? I’m open to learning more about it. What additional permissions does a GUI inherently require?

    Most companies I worked at used OpenShift in production, and I do not think it was considered an attack vector more than any other components of the ecosystem were. I would be surprised if this was a major factor when it came to security incidents.

    I don’t think that container privilege escalation vulnerabilities are correlated to the use of a GUI. To me, it is not a significant (or otherwise unique) risk. Even less so when we’re talking about a home lab that is only accessible via a VPN.

    Now, is it unnecessary? Sure, but then so is running Jellyfin or lighting a scented candle.

    • pucker4676@lemmy.ml
      1·
      3 hours ago

      Well, I learned something new. I didn’t know Portainer supported Podman. I guess it shouldn’t be that surprising, Cockpit does as well.

      Any time you’re giving software access to your system you’re increasing attack surface. Even with podman, if you’re running containers properly, the containers have separate users, so your management system is most likely going to need root access. Or at the very least a common group which makes the segregation a moot point.

      This topic is always going to be highly personal. Some care, some do not. If you’re only running a media server, then who cares if it’s all lost, but if you’re also hosting all your photos, sensitive documents, etc… It becomes a huge risk for everything to mingle with root access. I can’t imagine anyone would want a third party hanging out behind their firewall regardless.