Comment on Managing podman quadlets, users subids and such
Svinhufvud@sopuli.xyz 1 week ago
Are you running rootless or rootfull containers?
At least with rootless containers (I have not used roortfull) I think its quite pointless to create separate users for the services, as you could use just the subuids (and/or SELinux) to get container separation, as you already seem to do .
I run my quadlets with uidmap and gidmaps, so I get explicit control of the mappings. It can be a tad tedious at times but I think it’s worth the hassle.
kanera@feddit.cl 1 week ago
I had no idea you could just use the subids from their respective etc files, I just followed what the podman documentation recommends, I like that the containermapping ids like this is def much simpler than creating users per process, and probably less resource intensive. thanks for sharing ur input :)
I’m also afraid of SELinux, def the way of having a more secure system, but I reaaaaaaally dont wanna get to more docs on linux hahaha.