Podman support

[hakong]

Does Motuz have support for Podman (the rootless version of docker, from Red Hat)?

[hakong]

Relates a bit to #405 as well. Podman uses the podman-compose command as a drop-in replacement for docker-compose or docker compose.

[dtenenba]

I have not heard of Podman before today but I imagine the answer is no. The celery container in Motuz needs to run as root and then "become" other users by using the su command, so users have appropriate permissions on the filesystems mounted into the container.

[hakong]

Alright, cool. Podman is supposedly more secure by design so I guess podman support would be cool. It's also the default container software in the Red Hat os-family. But no big deal if this isn't on the roadmap.

[hakong]

I'll give it a stab later this week, maybe it works fine. If Motuz doesn't need anything run as root then it should work without much hassle.

[dtenenba]

Motuz as it stands currently definitely needs to run as root - at least the celery container does. It may be possible to refactor it to use a setuid binary or other workarounds but I do not expect it to work out of the box with podman and without root.

[hakong]

What does the celery container do that requires root access?

[dtenenba]

It runs as root because it kicks off copy jobs which run as logged in users. So if I log in as jdoe, the celery container will run a command as me by using the su command. This can only be done with root permission.

[hakong]

Ok, makes sense. That's less fun to run as non-root :)