cyber-security-resources/docker-and-k8s-security/podman_vs_docker.md

# Podman vs Docker

- Docker uses a daemon, an ongoing program running in the background, to create images and run containers.
- Podman has a daemon-less architecture which means it can run containers under the user starting the container. 
- Docker has a client-server logic mediated by a daemon; Podman does not need the mediator.
- Podman allows for non-root privileges for containers.
- Rootless containers are considered safer than containers with root privileges

## Podman Rootless?

- Containers in Podman do not have root access by default, adding a natural barrier between root and rootless levels, improving security. 
- Still, Podman can run both root and rootless containers.

## What about Systemd?
- Without a daemon, Podman needs another tool to manage services and support running containers in the background. 
- Systemd creates control units for existing containers or to generate new ones. 
- Systemd can also be integrated with Podman allowing it to run containers with systemd enabled by default, without any modification.
- By using systemd, vendors can install, run, and manage their applications as containers since most are now exclusively packaged and delivered this way.

## Building images
- As a self-sufficient tool, Docker can build container images on its own. 
- Podman requires the assistance of another tool called Buildah, which expresses its specialized nature: it is made for running but not building containers on its own.


Podman and Docker use similar container image formats, but there are some differences between them. Docker uses the Docker image format, typically with a `.tar` file extension, while Podman utilizes the Open Container Initiative (OCI) image format, which is typically in the form of a `.tar.gz` or `.tar` file.

Although Podman and Docker can both work with OCI-compliant images, there may be some subtle differences and specific features that are supported by one but not the other. However, in many cases, container images created for Docker can be used with Podman without any issues.

To convert a Docker image to a Podman image or vice versa, you can follow these general steps:

1. Save the Docker image:
   - For Docker: Use the `docker save` command to save the image as a `.tar` file.
   - For Podman: Podman can directly work with Docker images, so there is no need to convert if you are using Podman as it can directly pull and use Docker images.

2. Load the image:
   - For Docker: Use the `docker load` command to load the Docker image from the saved `.tar` file.
   - For Podman: Podman can use the Docker image directly without any conversion, so there is no need to load or convert the image.

It's worth noting that Podman provides a compatibility mode (`--cgroup-manager=cgroupfs`) that allows it to work with the traditional `cgroup` system used by Docker, which can be useful in certain scenarios.

While the image format itself is compatible, it's important to consider any specific features or dependencies that may be present in the original image, as there could be differences in behavior or functionality between Podman and Docker. Testing and validating the converted image in the target environment is recommended.

NOTE: When working with OCI-compliant images, such as those used by Docker and Podman, compatibility is generally high, but it's still recommended to test and validate the converted images to ensure expected behavior and functionality.

Here's a table comparing Podman and Docker:

| Feature                | Podman                                                         | Docker                                                          |
|------------------------|----------------------------------------------------------------|-----------------------------------------------------------------|
| Container Engine       | Uses a daemonless container engine                              | Uses a container engine with a client-server architecture        |
| Rootless Containers    | Supports running containers as non-root users                    | Requires root privileges for container operations               |
| Image Format           | Utilizes the OCI (Open Container Initiative) image format       | Uses its own Docker image format                                 |
| Image Compatibility    | Can directly use Docker images without conversion                | Requires Docker images to be converted for Podman compatibility |
| Container Orchestration| Supports Kubernetes-style orchestration through Podman Machine  | Provides built-in support for Docker Swarm and Kubernetes       |
| Networking             | Provides CNI (Container Networking Interface) compatibility     | Uses its own networking system based on libnetwork              |
| Daemon Management      | No separate daemon process needs to run in the background       | Requires a separate Docker daemon process to be running         |
| Integration with Tools | Works well with existing Docker tooling and commands             | Provides a rich ecosystem of tools and extensive community support |
| Security               | Emphasizes rootless and user namespace isolation for security    | Offers strong security features and isolation mechanisms        |
| Community Support      | Active community support and regular updates                     | Widely adopted with a large community and extensive resources   |
| Supported Platforms    | Runs on a variety of Linux distributions                         | Runs on a variety of Linux distributions, Windows, and macOS    |

Podman and Docker have their strengths and are suitable for different use cases. The choice between them depends on factors such as specific requirements, familiarity, and compatibility with existing infrastructure and workflows.