Podman

Podman

Podman runs containers without a central daemon and defaults to rootless operation, which changes its attack surface. The optional API socket still grants container control, the rootless user-namespace model determines what an escape actually yields, and the companion tools skopeo and buildah handle images and builds with their own credential exposure.

1분 분량2026년 10월 7일 업데이트

기여자 1명

Podman is a container engine designed to run without a central privileged daemon and, by default, without root. That reshapes its offensive surface. There is no always-on root daemon to take over, but Podman can expose a Docker-compatible API socket that grants container control; its rootless model, built on user namespaces, decides whether a container escape lands as an unprivileged user or as root; and its companion tools, skopeo for image transport and buildah for builds, carry the same registry-credential and image-secret exposure as Docker.

bash

podman info 2>/dev/null | grep -iE 'rootless|graphRoot|runRoot'
ls -l /run/podman/podman.sock /run/user/*/podman/podman.sock 2>/dev/null
cat /proc/self/uid_map                               # rootless => mapped range, not 0 0

Subtopics#

Rootless model: how the user-namespace design constrains or enables escapes.
API service socket: the optional Docker-compatible control socket.
systemd socket activation: on-demand API activation and its exposure.
skopeo and buildah: image transport and build tooling credential exposure.

Subtopics#

References#