| I like this Podman feature: Socket activation of containers Advantages: - Faster network. Rootless Podman will run with native network speed. Normally rootless Podman runs with reduced network speed due to the performance penalty that comes from using slirp4netns. - Improved security as you can disable the ability to establish outgoing connections with --network=none. The container can still communicate over the socket-activated socket with a client that has connected via the internet. I contributed a Podman socket activation tutorial:
https://github.com/containers/podman/blob/main/docs/tutorial... and I wrote two blogs about the security advantages https://www.redhat.com/sysadmin/socket-activation-podman https://www.redhat.com/sysadmin/podman-systemd-limit-access Docker does not support socket activation of containers. (Docker only supports socket activation of the Docker daemon) Edit: A clarification about the network speed. The improved speed is about the communication
that passes over the socket-activated socket. This communication does not pass through slirp4netns so it has the same performance characteristics as the normal network on the host. |
Did they fix the IP propagation issue with Rootless networking ? It makes it largely useless when the Proxy is also a container.
on Docker you can force it to use Slirp, but its slow and doesn't support IPv6.