Securing Services with Rootless Containers for Better Protection
Many developers mistakenly believe Docker containers provide sufficient security, but rootful setups can still lead to full host compromise. I explain how running rootless containers with Podman limits an attacker's impact to an unprivileged user. By leveraging user namespaces and systemd service units, we can deploy services like PostgreSQL and Anubis with significantly reduced risk without needing complex daemon configurations.
There is a common belief among many backend developers stating that Docker containers are a good security layer for their deployed services and applications. However, this is not the case.
- raesene9
Rootless helps, but less now that it used to (pre-2026). There have been a lot of local privilege escalation vulnerabilities in the Linux kernel (dirtyfrag, fragnesia, CIFSwitch et al) and several of those can be repurposed as container breakouts.
As a result, if you're looking for good security isolation, I'd say a (Micro)VM is a better option. The other route is hardening down your container runtime with seccomp/AppArmor/SELinux but that can be a tricky game.
- seemaze
The '--userns=auto' argument is a useful isolation method in both rootless and rootful Podman containers. This allows rootful Podman to orchestrate privileged capabilities while running the container processes in an unprivileged namespace.
See the discussion here:
https://github.com/podman-container-tools/podman/discussions...
- Narushia
The .container units get the job done, but if you want to manage a stack of containers and are familiar with Kubernetes, or just like YAML, I recommend using the .kube units instead.[1]
[1]: https://docs.podman.io/en/stable/markdown/podman-kube.unit.5...
- kayson
I'd still rather use docker. I don't mind that the daemon runs as root because there are some things that you need root for anyways! Like binding to privileged ports or setting up networks (use `internal: true` and the daemon will automatically set up iptables rules that limit traffic).
I deploy docker compose files with ansible so everything comes with built in security defaults like rootless, dropped caps, no new privileges, etc. I wish more containers supported running read only (its usually pretty easy to add, just overlooked) and distroless (common for go apps, less so otherwise).
There was a pretty good comment on reddit a while back with a list of hardenings for compose files [1]
1. https://www.reddit.com/r/selfhosted/comments/1pr74r4/comment...
- Lucasoato
Is there any other reference regarding how safer we are by using rootless vs rootful containers?