In general running containers rootless is better from a security standpoint and podman makes this much easier. So, yes.
replyThis is not my main point though. Both are based on cgroups and cgroups are the wrong tool for the job.
Wouldn't it need a super critical exploit, I mean zero-day vulnerability, to escape from that kind of sandbox ? And if you think further, then isn't that risk also applicable to pretty much any kind of sandboxing ?
replyContainer escapes are more common than you think. Common enough for AWS not to rely on containers for their serverless functions, common enough for Google to say: "Untrusted code shouldn't rely on the container security boundary [..]" [1]
replyThe same is not applicable for any kind of sandboxing for two reasons:
1. The boundary is in the kernal’s own code, enforced by the thing you are trying to be protected from. -> Use a VM
2. The kernal is a gigantic attack surface -> Use gVisor
[1] https://docs.cloud.google.com/kubernetes-engine/docs/resourc...
What if you use tools like bubblewrap or nono inside the container?
replySay I want to use pi inside a container. If I wrap pi within a bubblewrap or within nono, how is that less secure than using a vm?
Also, I think most people run containers inside VMs anyway and not directly on their hosts (on Mac and windows you have to use a vm anyway).