PodMan, the future for rootless containers

[nick65go]

Docker is the past for containers. Even if client "docker" can run as rootless (without root privileges) on host (laptop), but its engine "dockerd" MUST be run as ROOT on the host (dangerous).

The future for managing containers (builds + runs + distributes etc) is "podman". BOTH its engine and container builder (run/build/delete/commit/ etc) runs rootLESS, so better protection.
The drill is similar like:
1. grab an image (already build for you by others, even signed) from dedicated servers (named repository).
 -- or you can build yourself from pieces, the same like Tinyocre core.gz is done.
 -- FYI: the image could be just a tarball, what matters is to have inside the root files (like root.gz) AND the package manager (like tce-load).

2. the container is then build from this image as a base + extra layers (you add using the package manager, for example). All is automatically, next to nothing to learn (joke of course).

Example-1: run a busybox (dynamically linked to libc) in a container.
so, one command to "download" a rootfs one time only (because will be cached on host) and auto-open a terminal with busybox 1.37

Code: [Select]

podman run -rm -it docker.io/busybox
Example-2: run dillo (dynamically linked to musl) in a container.
two command only, one to download an already build minimal Alpine-Linux with its apk (package manager), and a second command from inside the container, to run dillo, its GUI will be seen on host.

Code: [Select]

podman run --rm -it -e DISPLAY -v $XAUTHORITY:/root/.Xauthority:ro -v /tmp/.X11-unix:/tmp/.X11-unix:ro --net=host docker.io/alpine
(from container): apk add dillo & dillo
FYI:
 "-rm" means remove container (but keep it basic image) so you loose "dillo and its dependency" but start fresh next time;
 "-it" means open a terminal with a shell
 "apk add dillo", is like tce-load -iw dillo.tcz

The great thing is that you can SAVE what you already build as a NEW image, and next time you continue to build over this "layer". Example: in the container with dillo you can add "netsurf" without downloading initial Apline and without adding dillo, because all is cached locally, layered.

So basically you can run in parallel many containers: one with just dillo inside, other with just GCC (tools for compile anything), or even a full OS inside container. All container are isolated between them and between host by default. But of course you can mount some "volumes" (basicaly host folder) to output what you created inside the container.

Enjoy podman (= Pod Manager, with pod = groups of containers, and container = image + layers like Qemu QCOW).

[nick65go]

As this forum is for TC users, I did not touch Podman capabilities like system-d, SELinux, kubernets, podman GUI, etc

But podman has a very comprehensive documentation and tutorials, and man pages etc.
https://docs.podman.io/en/latest/
https://docs.podman.io/en/latest/markdown/podman-run.1.html
https://github.com/containers/podman

FYI: a lot of (bullshit) marketing, but very strong points about Podman versus Docker
https://www.redhat.com/en/topics/containers/what-is-podman

"you can also take advantage of Podman Desktop, a graphical user interface (GUI) for using Podman in local environments,
 - optionaly, Podman launches each container with a Security-Enhanced Linux (SELinux) label...
 - Users can easily switch between them by aliasing Docker to Podman (alias docker=podman) and vice versa. -easy learning curve
- using Docker during the development stage and transferring their program to Podman in runtime environments 
- Podman is best suited for developers running containers without Kubernetes..."

[gadget42]

i found this webpage interesting and it does reference gitlab but doesn't reference shithub:

https://bluelight.co/blog/how-to-choose-a-container-registry

https://hjgit.org/static/guide.html

https://shithub.us/

20250929-0050am-cdt-usa-modified: adding *no affiliation(s) with _any_ of the above*

[nick65go]

i found this webpage interesting and it does reference gitlab ...

So? did you find (or want to share) something constructive for TC users ?
Excepting the "classics" -- like "chroot" poor man method, or heavy RAM intensive VM (virtual machines) like Qemu --, have you anything better, smaller, smarter that podman?
I do not give a shit about "Container Registry" servers, which is dedicated for developers (which I am not) to shared their work, faster debugging, continuous distribution, etc.

My share was about a strong method, accessible to common users, because: runs  on relatively cheap hardware, low/ re-used resources, fast learning curve, no need for SELINUX or systemd (but nice if you have) etc. But most important (at lest for me) the security -- to run ISOLATED any single appliance (like dillo, or gnumeric),without "polluting" the host machine. Confidently to test / run any "insecure" free software you grab for free from internet "friends".

[nick65go]

Maybe my mistake was that I was not clear / explicit in the TITLE about my (selfish) interest in LOCAL (runs on laptop) containers, whatever they could be (chroot, Virtual Machines, kernel names-pace isolation, etc).
- chroot is not very secured; is fast and not so laboriously to do it (just mount few folders).
- docker is the standard industry; overwhelming options to build + run containers + distribute them; but its engine runs (in 99.9% cases) as root in the host.
- podman is the new kid in the sandbox yard. it has ALL of docker CLI (command line parameters) to run a container, and OPTIONS to build a container / image from a config file.

The main advantage of containers (which is basically an image, or a tarball group of files) versus VM (virtual machines, qemu) is that all containers share the same host kernel, not fake disk HDD (which use block-sectors + file system driver, so waste space), no USB/CDROM (just mount shared folders from host). And use protected uid+gid (=different on guest/container versus the host) so the malicious app from container has no user rights on host. ...

Anyway too much to explain the basics of Linux security protection, because we go over from DAC (Discretionary Access Rights, like r/w/x) into MAC (Mandatory Access Rights, like SElinux, AppArmour).

[hiro]

i agree chroot doesnt add much separation, and i agree docker's security model is mostly non-existent, but i do not agree that podman's "rootless" "innovation" gets you where you want to be either.

the complexity they are adding to the kernel for podman's "security" framework is hard to manage, the kernel has not been built with this in mind, and the result is mostly hacks that nobody understands, what seems like a useful abstraction to the user is in fact a huge leaky mess and nobody should rely on it being safe.

it might seem that since podman consists of many layers, and many people wasted much time to build these, that you have done enough research to pick this software and to sleep in peace at night. but that is not the case.

qemu/kvm style virtualization might also not have been ever intended for security, and yet it's much closer to what you are expecting here.

if you *really* cared about security though, you'd separate your security domains into multiple dedicated machines and ignore all promises by container and virtualization people.
process virtualization is great if you don't want an application to crash your whole system (all other applications, your kernel, ...).

containerization is a hack around the fact that dynamic linking has failed everyone: poor glibc man's static linking.

[gadget42]

@hiro, thanks for relating your thoughts! definitely along the same lines as a bit older post by you(mostly regarding bloat as opposed to security) https://forum.tinycorelinux.net/index.php/topic,27521.msg177417.html#msg177417

have you ever poked around EasyOS by Barry Kauler? i seem to recall he does something "container-wise" in it.

[hiro]

haha, i forgot about that weird old ramble.
never heard of easyos.

btw my chroot of alpine on top of an ANCIENT tinycorelinux is still going strong.

[gadget42]

haha, i forgot about that weird old ramble.
...

tbqh, i enjoyed rereading that entire thread

[nick65go]

Hi @hiro, thanks for your feed-back. I am still searching for an "ideal" separation, "Qubes OS" not tried yet
I may read docs for Linux short-comes versus Free BSD natural jail.

[nick65go]

Hi @gadget42, thanks for the tips about https://easyos.org/

I started to read it for fun, and it seams to use some solid concepts same as tiny-core, and some more "modern". For example:
- it use a small boot loader limine (same proposal as CachyOS used by me) which knows both BIOS/UEFI in very small size files. (not critical but limine knows only FAT12/32 I think, but is good enough for uefi ESP partition).
-  for distribution, it uses "modern" image (FAT + EXT4), just dd it, auto-expand to full USB size, instead of ISO format.
- for containers, it uses layered autofs /union=  base-SquashFS (read-only) + RW layer. Same idea of SquashFS + in RAM files, as TC, but over zramfs instead of tmpfs.
- protection from some Linux kernel Capabilities limiting, same as podman.
- small desktop (jwm, instead of fltk) and small file manager - same as TC.

I do not know (yet) how dependency hell is solved, or about package manager, speed of new package release etc.
About security: good for nomad USB, but not yet the degree of security I wish on a fixed disk.
Anyway, I do not intend to describe here this distro, But it seams interesting maybe also for some TC users.

[hiro]

the more "natural" jail still uses root and then the idea of dropping privileges one by one, in order to achieve separation.
so in the fight between podman (redhat) and docker, it will not support the argument against docker.

the most novel departure from traditional unix "root first + privilege drops (changeuser, chroot)" perms is on plan9, where every user who wants to log in has to first gain privileges against the system via a trusted auth server. without those privileges there is no access to non-world-readable data, and since there's no setuid flags there's no way to break out. chroot is not needed either bec. the namespace can be minimized before the user even logs in: i.e. the daemon service listening for incoming connections is running as user "none" which has the least possible privileges.
rootless is an *insult* to this.

[hiro]

and one more warning:
don't overdo it with the separation on a single machine, because of diminishing returns: spectre, meltdown, etc. are not gonna go away.

[nick65go]

Hi @hiro, I like your "rootless is an *insult* to this" referring to (RedHat) free podman (which does not use setuid, but merely sub-domain uid, kernel namespace and sockets). Not many use plan9 (inferno incarnation) yet.

For an OS, it matters its collection of apps, ever better if they are compiled by others (trusted big distributions like Debian, Archlinux, Fedora, Alpinelinux) to keep apps up-to-date against vulnerabilities.

My actual / temporary "solution" is an independent laptop, with nothing private/ secret on it. It is a spare machine (yes, I can afford less than $1,000 for 8 years on a laptop, cheaper than alcohol / tobacco / drugs, to indulge myself) to play / learn with it. The only concern about it, is to not get a firmware rootkit. All other can be easy erased and start again in minutes, form external spare USB.