Podman
containercontainer-engineopen sourceA daemonless, rootless-friendly container engine, drop-in compatible with Docker's CLI.
Podman runs OCI containers without a central daemon and with strong rootless support, which narrows the classic container attack surface (no root daemon, user-namespace mapping). It is otherwise the same tier as Docker, namespaces + cgroups + seccomp on a shared kernel, and is Docker-CLI-compatible. On macOS it runs a Podman machine (a Linux VM). It is also the front end for isolation via the krun runtime.
Strengths
- Daemonless and rootless-friendly, narrows the container attack surface
- Docker-CLI compatible, free and open source
- Gateway to microVM isolation via podman run --runtime krun
Limitations
- Shared kernel by default, a container, not a hardware boundary
- On macOS runs inside a Linux VM (Podman machine)
- Same escape footguns as any container if run privileged/root
Files & editor
desktop-mountBind-mount your project; the same host-editor flow as Docker.
How you get your project into the environment and edit it. Shared-kernel routes bind-mount host files for your desktop editor; own-kernel routes keep files in the guest, so a desktop editor attaches over remote, or you edit inside. Mounts and remote editing.