Rootless Docker and Its Hidden Security Trade-Offs
7 points by WilhelmVonWeiner
7 points by WilhelmVonWeiner
Do the same security trade-offs mentioned here also apply to Podman and friends?
Yes, basically, though you can still use --privileged with rootless Podman and it will loosen the restrictions that are applicable.
Also not sure that not using the Docker network bridge implementation is a performance issue. I've anecdotally had cases where pasta and Podman avoided network issues that I had with the Docker bridge networking.
In other words, running rootless builds inside a container can require you to disable some important security mechanisms.
In this case, wouldn't it be enough to allow just the syscalls required for BuildKit to function properly? (I can imagine it will require unshare, mount, and some others). You will still need to explicitly enable these, instead of enabling everything by using unconfined.