Ditching Docker for Podman on Ubuntu 24.04: A Security-First Approach

When setting up my HomeLab on a recycled Dell Optiplex, the first question wasn’t “what to host,” but “how to host it safely.” While I’m a long-time Linux user, for this project, I settled on Ubuntu Server 24.04 LTS. Why? Because when you’re managing infrastructure, you want a predictable kernel and long-term support without sacrificing modern cloud-native features.

Why Ubuntu 24.04 over other distros?

  • LTS Stability: I need my blog to be up while I’m sleeping, not broken by a rolling release kernel update.
  • AppArmor Integration: Ubuntu’s default security profiles work out-of-the-box with container runtimes.
  • Modern Tooling: Noble Numbat ships with recent versions of Podman and the 6.8+ kernel, perfect for rootless operations.

The Elephant in the Room: Why Podman?

Most people default to Docker. As a Sysadmin, I want more. Here is why Podman is the superior choice for this stack:

  1. Daemonless Architecture: Docker relies on a single point of failure (the Docker daemon). Podman uses a fork-exec model where each container is its own process.
  2. Rootless by Design: My WordPress instance doesn’t need root privileges on my host. If the container is compromised, the attacker is stuck in a restricted user namespace.
  3. Pods Support: Podman introduces the concept of “Pods” (Kubernetes-style). I can group my WordPress and MariaDB containers into a single network space sharing localhost.

Installation & Setup

On Ubuntu 24.04, Podman is available in the official repositories. No need for third-party PPA.

# Install Podman
sudo apt update
sudo apt install -y podman

# Enable Rootless User lingering
# This ensures containers start on boot without an active session
sudo loginctl enable-linger $USER

To verify that you are running in rootless mode, check the ID mappings:

podman info | grep -i rootless

By choosing Ubuntu 24.04 and Podman, I’ve built a foundation that mimics a production environment while keeping the overhead minimal. Stay tuned for the next post where we’ll dive into the Pod architecture.

Exit Code 0. Success.

Leave a Reply

Your email address will not be published. Required fields are marked *