Docker containers aren't very secure because the daemon runs as root by default. Rootless container runtimes are plenty secure, especially if the user that runs the container is unprivileged. Easiest thing in the world with Podman.

▲

ShinyLeftPad a day ago | parent [-]

Would you run Podman from your own user or another specially created user?

	▲	MrDrMcCoy a day ago \| parent [-]
		I would have them run as a user that does not have sudo. The easiest way to do this is by using system-level Podman Quadlets that run as an unprivileged user account. That user will need a real home directory for images and volumes.