Hacker News new | ask | show | jobs
by movedx 379 days ago
That sounds like a great option to me. The more functionality you can get out of a container without giving up privileges, the better. Podman is just a tool like any other - I'd happily use it if it's right for the job.

All I would say is: can you run that same thing without a containerisation layer? Remember that with things like ChatGPT it's _really_ easy to get a systemd unit file going for just about any service these days. A single prompt and you have a running service that's locked down pretty heavily.
1 comments
feirlane 379 days ago
Yeah I could run them as regular systemd daemons themselves, but I would lose the easy isolation between different services and main OS. Feels easier to limit what the services have access to in the host OS by running them in containers.

I do run the containers as systemd user services however, so everything starts-up at boot, etc

link
movedx 378 days ago
You can isolate and lock down services in systemd too! Not too hard at all, and again AI can help here.

https://www.redhat.com/en/blog/mastering-systemd

link