• azdle@news.idlestate.orgEnglish
    0·
    3 years ago

    If your distro offers it, rootless podman + podman system service is the best setup, IMO. That will give you a docker command that is 1-to-1 compatible with docker and lets you use tools like docker-compose that expect a docker service socket. Then you can just follow tutorials that only explain things for docker.

    • lemmyvore@feddit.nlEnglish
      0·
      3 years ago

      What is rootless bring brought up so much? It’s a container, it’s isolated from the host anyway, what does it matter what user runs inside? And if something breaks into the container they can trash the app in it and the shared volumes anyway, even if they’re not root.

      • MartianSands@sh.itjust.worksEnglish
        0·
        3 years ago

        Because a container is only as isolated from the host as you want it to be.

        Suppose you run a container and mount the entire filesystem into it. If that container is running as root, it can then read and write anything it likes (including password databases and /etc/sudo)

        • lemmyvore@feddit.nlEnglish
          1·
          3 years ago

          So what? If I mount / in the container and choose to run it as root that’s my business. Why would the containerization engine second-guess what I’m doing?

          How would you like it if sudo told you “I can’t let you be root, you could read and write anything you like, including password databases and /etc/sudo”?