Lion Cipher Lab
Run containers without root using Podman
- Cyber / Security Engineer
- Beginner
- ~35 min
- Free · no account required
Why it matters
Most people meet containers through Docker's default setup, which runs a single background service called the daemon as root — the all-powerful administrator user. That is convenient, but it means anyone who can talk to that daemon can act as root on the host, and a container that escapes its isolation lands as root too. Podman changes the default: it runs containers directly as your own unprivileged user with no privileged daemon in the middle, so a container breakout does not hand an attacker root on your machine. Learning the rootless model early means every container you run afterwards…
What you'll learn
- rootless containers
- Podman
- daemonless container engines
- least privilege
- user namespaces
- reducing container breakout impact
- Docker-compatible CLI
Steps in this lab
- The words first: container, image, daemon, root, rootless
- Why rootless is a safer default
- Install Podman for your operating system
- Run your first rootless container
- The Docker-compatible CLI: same commands you already know
- Prove it is running as your user, not root
- Rootless networking and its honest limits
- What you just did — and why the default now works for you