Talk:Podman
Latest comment: 14 October by Miike in topic The “rootless” example gives root access
Missing `virtualisation.podman.dockerSocket.enable`
Missing virtualisation.podman.dockerSocket.enable Malix (talk) 19:39, 30 November 2025 (UTC)
The “rootless” example gives root access
The nginx-rootless user gets extraGroups = [ "podman" ]. Rootless Podman doesn’t need that group at all. The NixOS module always enables the rootful podman.socket (wanted by sockets.target) with SocketGroup = "podman". So any member of the group can drive the root Podman API, whether or not dockerSocket.enable is set. That cancels out the whole point of the section, since a compromised container user can escalate to root. The line should be removed. Miike (talk) 07:17, 14 October 2026 (UTC)