Rootless Containers: Least Privilege for the Paranoid

Wed, 05 Nov 2025 12:46:00 +0000

There is a sentence that ought to be printed on the box every container runtime ships in: root inside the container is root on the host. Not metaphorically. Not “sort of”. By default, UID 0 in the container is UID 0 on the machine, and the only thing standing between those two facts is a set of kernel namespaces that a good enough bug will walk straight through.

I run a small homelab — a mix of services on a couple of boxes behind a reverse proxy — and for years I treated containers as a security boundary. They are a boundary, but a leaky one, and the leak all points the same way: outwards, onto my host, as root. Once I internalised that, my whole approach changed. I stopped asking “is this container safe?” and started asking “when this container gets popped, how boring can I make the aftermath?” That question has a name. It is least privilege, and this post is how I apply it to containers I actually run.

Podman for People Who Distrust the Docker Daemon

Tue, 07 Oct 2025 10:32:00 +0000

I ran Docker happily for years, and then one afternoon I actually read what my docker group membership meant and felt slightly sick. I had added my everyday user to that group ages ago because typing sudo in front of every command is tedious, the way everyone does, the way every tutorial tells you to. What nobody mentions in the same breath is that this is functionally the same as handing that user a password-free root shell. Podman is the container engine I moved to when that stopped sitting right with me, and I have not wanted to go back.

Rootless - vo.rs

Rootless Containers: Least Privilege for the Paranoid

Podman for People Who Distrust the Docker Daemon