Implementing Rootless Podman with User Namespace Mapping
Learn how to configure rootless Podman using User Namespaces to eliminate root-privileged daemons and enhance host security through subuid and subgid mapping.
Loading…
ReadMeFeed / Community knowledge
#linux-security
Real questions. Useful conversations. Find the people who know your stack.
podmanSecuring Ubuntu Server Traffic with Uncomplicated Firewall (UFW)
Learn how to implement a default-deny network policy on Ubuntu Server using UFW to block unauthorized access while maintaining SSH and web service connectivity.
ubuntuSecuring the Edge: Implementing Rootless Containers with Podman
Stop relying on root-privileged daemons. Learn how Podman uses User Namespaces and slirp4netns to run secure, rootless containers that limit the blast radius of potential escapes.
Securing Remote Access with SSH Key-Based Authentication
Replace vulnerable password logins with SSH key-based authentication. Learn how to generate Ed25519 keys, securely transfer them, and harden your server by disabling password access.
sshSecuring the Edge: Transitioning to Rootless Podman
Stop relying on root-privileged daemons. Learn how Podman's rootless mode uses user namespaces and slirp4netns to isolate containers and reduce the host attack surface.
Podman Rootless Containers: Why 'Root' in a Container Doesn't Have to Mean Root on Your Host
Rootless Podman maps container 'root' to an unprivileged host UID via user namespaces and subuid ranges — shrinking the blast radius of escapes and removing the privileged daemon. Here's how it works, how to verify it, and where the trade-offs bite.
How YunoHost Isolates Applications: System Users, Subdomains, and Where the Boundaries Actually Sit
YunoHost isolates apps with one Unix user and one subdomain each. This note maps where that boundary is real, where it is weak, and how to verify it with ordinary Linux tools.
yunohostHow can I apply the principle of least privilege to Bash scripts on a Linux system?
When writing Bash scripts that perform administrative tasks, how can I restrict the script’s capabilities to only the operations it truly needs, following the principle of least privilege? For example, if a script only needs to read specific log files and write to a designated directory, what steps should I take to set up a dedicated non‑root user, adjust fi
bashWHM and Linux System User Password Expiration Synchronization
System User Authentication and cPanel Integration cPanel relies on the underlying Linux system user accounts for authentication. While WHM provides administrative tools to manage these accounts, there is a functional boundary between the cPanel interface and the system-level password aging policies defined in /etc/shadow . When a system administrator impleme