Container Security Orthodoxy Is Under Pressure
A thread on rootless containers generated real debate. The core tension: rootless containers are better security practice, but they introduce friction for things that legitimately need privileges, like binding to low ports or setting up networks. Some commenters pushed for full microVM support in Docker and Podman as the real answer, arguing that rootless is a half-measure.
The counterargument from the 'I'd still rather use Docker' camp is pragmatic: the daemon running as root is fine if you understand the threat model and have compensating controls. The '--userns=auto' argument in Podman came up as a practical middle ground.
This debate is not new, but it keeps resurfacing because the right answer depends heavily on deployment context. Serverless, multi-tenant, and edge environments have different threat models than a single-tenant VM you control.
So what?
If you are setting container security policy for a multi-tenant or edge deployment, the rootless approach is worth the friction. For simpler single-tenant setups, the pragmatic Docker approach with proper network isolation is probably fine. The microVM path, using Firecracker or similar, is the right long-term answer for anything where you need true tenant isolation, and it is getting easier to deploy.