podman

> Maybe I just missed an obvious route to disable swaths of SELinux for rootless containers - where it probably doesn't have as much of an application. podman run --security-opt label=disable https://github.com/containers/podman/blob/main/troubleshooti... Note: Labeling can be disabled for all containers by setting label=false in the containers.conf(5) file. https://docs.podman.io/en/latest/markdown/podman-run.1.html#... But more secure way would be to add ":z" or ":Z" to volume and podman will auto-relabel source dir. Finally you can use nuclear option: "--privileged". It's still more secure than docker's one because you are limited by your user's capabilities.

The current driver lives at http://github.com/crc-org/vfkit and is being tested in crc. It would be ideal if you put the request out via an issue https://github.com/containers/podman/issues/new/choose I will follow-up on this. Community feedback will lead to a demand/request as it speaks louder

You could detect the source IP address by using the command-line option: --net=slirp4netns:port_handler=slirp4netns See https://github.com/containers/podman/discussions/10472#discu... Shouldn't it also be possible to detect the source IP address if you use socket activation? (I haven't tried it out, though).

I like this Podman feature: Socket activation of containers Advantages: - Faster network. Rootless Podman will run with native network speed. Normally rootless Podman runs with reduced network speed due to the performance penalty that comes from using slirp4netns. - Improved security as you can disable the ability to establish outgoing connections with --network=none. The container can still communicate over the socket-activated socket with a client that has connected via the internet. I contributed a Podman socket activation tutorial: https://github.com/containers/podman/blob/main/docs/tutorial... and I wrote two blogs about the security adva

> I was looking at this just last night and the story with Ubuntu is horrible. That's essentially going to be stuck on v3.4 for ten years because it's "a lot of work" to get into that distribution. They used to provide relatively recent builds in their kubic repos. Unfortunately, for some reason, they decided to discontinue it[0]. They mentioned some CVEs or something in some issues raised around this, but to me that means pushing a new version/build and not discontinuing it. Anyway, one of the members of the Containers org provides unstable kubic repos[1][2] for non RH systems. Unfortunately, this includes RCs, and non-stable versions, which is fine to get bleeding edge, but I'd rather just have the stable versions. Due to the above, I've written some scripts to build deb packages for all the latest stable versions. So hopefully you can

Looks like Debian is doing that work, but only in experimental for now... https://packages.debian.org/source/experimental/libpod Some context/discussion and an experimental ppa for Ubuntu: https://github.com/containers/podman/issues/14302#issuecomme...

I've did a bit of reverse searching. They've used Go all the time[1] [1](https://github.com/containers/podman/tree/3d0100bb44834d079a...)

Nice that it supports networking and volume mounts out of the box. Volume mounts use virtio-fs which is experimentally supported in Docker for Mac[1]. Podman went with a volume mounting solution based on 9p[2], which appears to be far slower[3]. 1: https://www.jeffgeerling.com/blog/2022/new-docker-mac-virtio... 2: https://wiki.qemu.org/Documentation/9p 3: https://github.com/containers/podman/issues/8016#issuecommen...

Maybe you should include this into your "research": - https://opensource.com/article/19/2/how-does-rootless-podman... - https://github.com/containers/podman/blob/main/docs/tutorial... TL;DR cgroup V2 support Installing Podman Install slirp4netns Ensure fuse-overlayfs is installed

The --uidmap and --gidmap options can map your regular user on the host to any specific user inside the container. These options may look to be a bit complicated to use, but as soon as you understand how rootless Podman maps UIDs and GIDs it will be pretty straight forward. I wrote two troubleshooting tips about how to use them: https://github.com/containers/podman/blob/main/troubleshooti... https://github.com/containers/podman/blob/main/troubleshooti...

What got me at first are the limitations around rootless containers, which I wasn't accustomed to. Rootfull docker makes many things (networking, volumes etc.) Fairly easy. I've found this troubleshooting page quite helpful: https://github.com/containers/podman/blob/main/troubleshooti...

This release features - First binary for Windows, all due to amazing work of podman team - https://github.com/containers/podman/releases/tag/v4.0.3 - First test flatpak image - Binaries for ARM - On Linux, easily switching between native podman and podman machine based setups - Easily identify where settings are stored - Debug panel and log level control to know everything that is happening - Optimization of settings screen - Toggle for automatically starting the podman service

That's a valid question. I also did not look up until you asked. Check this out[1] > One of the guiding factors on networking for containers with Podman is going to be whether or not the container is run by a root user or not. This is because unprivileged users cannot create networking interfaces on the host. Therefore, with rootfull containers, the default networking mode is to use netavark. For rootless, the default network mode is slirp4netns. Because of the limited privileges, slirp4netns lacks some of the features of networking; for example, slirp4netns cannot give containers a routable IP address. [1]: https://github.com/containers/podman/blob/main/docs/tutorial...