On blahaj we lack downvote so the tankies aren’t downvoted to hell from our point of view. It only keeps their circlejerk upvotes.

But if you look at the comments from another instance, they are downvoted to hell.

Oh no I was just being pedantic

They gettin into the overseas military bases; talkin’ bout Djibouti and a lil’ Cambodia as a treat

I’d guzzle that even if Gnor wouldn’t

Sad to hear for my quadlet future, do you remember what things were specifically annoying?

Hey bigdickdonkey, I recently tried and wasn’t able to shit my way through podman, there just wasn’t enough chatter and guides about it. I plan to revisit it when Debian 13 comes out, which will include podman quadlets. I also tried to get podman quadlets to work on Ubuntu 24 and got closer, but still didn’t manage and Ubuntu is squicky.

I read about true user rootless Docker and decided that was too finicky to keep up to date. It needs some annoying stuff to update, from what I could tell. I was planning on many users having their own containers, and that would have gotten annoying to manage. Maybe a single user would be an OK burden.

The podman people make a good argument for running podman as root and using userns to divvy out UIDs to achieve rootless https://www.redhat.com/en/blog/rootless-podman-user-namespace-modes but since podman is on the back burner till there’s more community and Debian 13, I applied that idea to Docker.

So I went with root Docker with the goals of:

• read only
• set user to different UID:GID for each container
• silo containers in individual Docker networks
• nothing gets /var/run/docker.sock
• cap_drop: all
• security-opt=no-new-privileges
• volumes all get tagged with :rw,noexec,nosuid,nodev,Z

Basically it’s the security best practices from this list https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html

This still has risk of the Docker daemon being hacked from the container itself somehow, which podman eliminates, but it’s as close to the podman ideal I can get within my knowledge now.

Most things will run as rootless+read-only+cap_drop with minor messing. Automatic ripping machine would not, but that project is a wild ride of required permissions. Everything else has succumbed, but I’ve needed to sometimes have a “pre launch container” to do permission changes or make somewhere like /opt writable.

I would transition one app stack at a time to the best security practices, and it’s easier since you don’t need to change container managers. Hope this helps!

They’re also often used to connect a portable generator’s 120V outlet to a house’s 120V outlet, thus energizing the house circuit during a power outage. But they have no way to lock in so can fall out and become a naughty cattle prod or if the person forgot to disconnect their circuit breaker from the mains they’ll kill a person fixing the power because that lineperson won’t be expecting live wires.

Basically as you said, if you do everything right you escape with your life. But if you do it wrongk, house fire or murder!

FUCJ Id guzzle that

Beefy arm T. rex would destroy me