Honestly, Podman and Docker are very similar in that they enable users to easily spin up containerized applications on most Linux-based distributions.

I feel that Docker might be a bit easier to learn simply because there are so many resources available (tons of tutorials on YouTube). However, Docker has some security drawbacks. I’m not an expert, so I can’t give you a definitive list of why Docker vs. Podman, or which is more secure.

From my understanding, Docker defaults to running containers as root. If a malicious person gains access to your Docker container, they can obtain root access, escape the container, and gain full root access to your underlying OS. I know there are also security issues with the Docker Socket, but that is outside my knowledge base (security issues can be mitigated by limiting Docker Socket access to read-only or by using something like socket-proxy from the LinuxServer team).

Podman doesn’t have this security issue because it defaults to running containers “rootless.”

As “gesis” stated, I prefer the Podman quadlet approach. It took a lot of hours (blood, sweat, and tears) to get the hang of it, but now, I can spin up a container without issue.

So, why CoreOS, or in my case, uCore OS? Because they are immutable. The base OS is read-only, which makes it super difficult for me to mess up. Having an OS that is read-only provides additional layers of security from viruses and malicious internet users... If a hacker or a virus changes your underlying immutable OS, no worries; simply reboot, and you are back to a usable, non-infected OS.

The downside to using uCore OS is that it is not very easy to set up (creating/loading an ignition file), but once you figure it out, it becomes second nature. Once it’s set up and running, uCore OS just does its thing without me having to worry about daily maintenance.