Securing Services with Rootless Containers

A Hacker News thread compared rootful Docker with rootless containers, focusing on whether rootless setups meaningfully improve security.

Commenters discussed practical hurdles like port binding, network setup, iptables, and Docker Compose compatibility.

The thread highlighted hardening options such as no-new-privileges, distroless images, and read-only containers.

Others argued that even with rootless containers, user namespaces still leave kernel-level risk, so microVMs or Podman/QEMU may offer stronger isolation.