https://stackoverflow.com/questions/36425230/privileged-containers-and-capabilities

With root permission you can do chroot.

Edit, I did some digging and found that its not the normal files that they can access but can modify kernel parameters and can mount devices and access their files etc. If you want to learn more check https://stackoverflow.com/questions/36425230/privileged-containers-and-capabilities

1. What is the benefit of creating users for every service? Wouldn’t one be sufficient?
2. Also just out of curiosity, why not in sodo’ers list?

One of the main advantage of podman is that, it respects the firewall rules. Docker don’t do that. Also having rootless podman means if somehow the container went rogue, it cannot have access to your root directory and perform malicious actions.

Also podman is a drop in replacement for docker. It does not need much configurations to setup. If you need compose, you might need to install podman-compose as well.

I envy you so much