Maybe I’m using the wrong term, but when installing Docker, you need root access, and not for Podman. Maybe I’m wrong but I don’t think it’s possible to install Docker if you’re not root on the machine?
This link breaks down what permissions are used on MacOS.
> Maybe I’m using the wrong term
Typically, the meaningful piece with "rootless" Docker is that the daemon is not running as root.
When the Docker daemon is running as root on a Linux server, for example, anyone who can access the daemon (i.e. anyone in the "docker" group) has enough access to the system can do catastrophic damage with the access they have. For example, the docker daemon can mount any file on the host's filesystem (i.e. "-v /etc/shadow:/tmp/shadow"). With Docker running as root, anyone with access to the Docker daemon has the power to do almost anything to the system.
With rootless Docker, that issue is mitigated heavily because the Docker context is restricted to an unprivileged user context.
> but when installing Docker, you need root access, and not for Podman
According to Podman Desktop's docs, it asks for admin permission when installing on MacOS: https://podman-desktop.io/docs/Installation/macos-install
That being said, I don't personally see any security value added or removed by an installer process needing to elevate privileges. That's a one-time thing and likely should require admin privileges.
Where I worked before we didn’t have root access on our laptops, so we couldn’t install Docker.
I’ve switched company since, but my former coworkers were able to install Podman (not Podman Desktop) without root access.
Although, I would say we have definitely strayed far away from the typical definition/security benefits of "rootless" container runtimes. Usually the rootless container threat model accounts for containers or access to the runtime being weaponized -- it's not usually IT preventing you from installing apps. :)
Still, thanks for indulging this conversation.
(Also, I thought the only way to run Podman containers locally on MacOS was Podman Desktop -- has that changed recently?)
