User namespaces and capabilities are important kernel functionality to make containers secure. They allow to better isolate containers and limit the privileges a container might have. A while back a user reported a bug where some odd behavior was noticed when namespaces are shared between containers which could lead to security problems. Lets take closer…
One longstanding problem with Podman is that your rootful containers may loose network connectivity after a while. For many users it is not be obvious what is causing such problems. Netavark configures NAT and port forwarding firewall rules. When another process is deleting our firewall rules the containers will loose connectivity. One such process is…
I recently had a discussion in a container-selinux issue on why we allow certain capabilities by default for containers. The conversation is around DAC_OVERRIDE, a Linux capability which allows privileged processes, usually root, to ignore ownership and read/write permissions Discretionary Access Control (DAC). “As @wrabcak notes in Why do you see DAC_OVERRIDE SELinux denials?, In…
Introduction In the ever-evolving landscape of container technology, Podman’s latest version, v4.6.0, includes a feature that promises to be a game-changer for system administrators: Podmansh. A login shell that leverages Podman’s robust container management capabilities. Podmansh is set to redefine the way users interact with systems, while ensuring maximum security and control for administrators. Why…
One of the frequent complaints I hear from users moving to Podman is about performance. I’ve always found this confusing, as the Podman team has spent significant time and effort on improving our performance, and we are quite confident that our speed is broadly comparable to Docker. Indeed, an academic paper found that Podman was…
In my personal opinion, user-namespace are one of the most brain-twisting aspects of rootless containers to understand. Arguably right up there with Kubernetes, the learning curve can be quite steep. In this article, I will attempt to reduce that slope for new Podman users (and converts), with an easy to understand analogy. Hopefully this will…
Boilerplate walkthrough rootless systemd podman-service, inside a rootless podman container.
Developers are always asking us about how to customize Podman machine to add or subtract content. Up until recently, the answer has always been to use the cosa tooling to create the operating system and a qcow image. The process is not particularly difficult but it does help to have fast disk I/O […]
Sign up with your email address to receive updates by email from this website.