I’m moving to a new machine soon and want to re-evaluate some security practices while I’m doing it. My current server is debian with all apps containerized in docker with root. I’d like to harden some stuff, especially vaultwarden but I’m concerned about transitioning to podman while using complex docker setups like nextcloud-aio. Do you have experience hardening your containers by switching? Is it worth it? How long is a piece of string?
Can’t help with much of this but I think I can resolve the last question for you, since I don’t see anyone else trying.
How long is a piece of string?
Exactly twice as long as half of its length.
I switched from Dockerd to K3s. First you get the benefits of the Kubernetes API but also Pod Security Context, Pod Security Admission and Network Policies which help to reduce attack surface while simplifying your setup. But if you do want to use Podman look into running your containers as read only, drop all capabilities and unprivileged.
Definitely Podman
Alternatively you could use docker in virtual machines
As long as you’re on Linux, podman is superior and will do all of the things you’re asking about. If you need to also support Windows or Mac, Docker is the only thing that will work (although people have told me Rancher isn’t bad now for a couple of years).
podman works on windows hosts, as long as you don’t need windows containers
And as long as you don’t need simple access to most features such as volumes. The podman implementation on not Linux leaves quite a bit to be desired for anyone trying to do more than just run a binary wrapped in a container. I’m not throwing shade because it’s FOSS and anything is better than Docker. Only Docker will work for a production-capable dev environment on not Linux unless podman’s development has exponentially increased in the last year since I tried to move a shop to podman on not Linux.
I’m actually in the process of switching over from docker to podman. Its definitely a learning curve, ie. Setting up systems integration etc.
I do love it but its been a bit of a pain, for instance I’m still trying to figure out the errors I’m getting when trying to deploy my matrix and vikunja containers, I’m getting permission errors and can’t find dB errors. I k ow little about podman right now but I would definitely recommend it since it is open source and runs rootless by deafult.
