On 2020-01-18 08:26, Robert P. J. Day wrote: It looks like you're running Podman without root here; your colleague may be doing the same, but it's likely because he added his user to the Docker group, giving him access to the Docker API socket. This allows his user to connect to the Docker daemon, running as root, and run containers with full root privileges (it's effectively the same as giving a user passwordless sudo). Podman, however, does not have a daemon. If you take a look at the Podman binary, you're also notice that it's not setuid/setgid; when Podman is run without root, we run containers with no added privileges that the user who ran the container does not have. This is a major security benefit (though there are certain things you can't do in a rootless Podman container, such as making changes to the system that would require root; some VPNs need to do this, for example). Inside the container, you'll likely see that the command you're running believes that it is UID 0, even though your `ps` command shows that it is running as your user. This is thanks to user namespaces. We map your user into the container as UID 0, which allows you to act as root within the container. On the outside of the container, though, the container process is still your user (which is why you can't make system policy changes - normal security policy prevents unprivileged users from doing these things, so the container running as your user is no different). If you were to run a Podman container as root using sudo or su, you'll see that the container process is actually root on the system - no user namespace is used, as we already have full privileges, and don't need one. I hope this answers your question, but feel free to ask follow-ups if anything is unclear. Thanks, Matt Heon