The Docker Dilemma
Docker changed how we deploy software. But the Docker daemon runs as root. A container escape means root on the host. In a multi-tenant environment, that's unacceptable.
We needed rootless containers. We needed Podman.
Why Podman?
Podman is daemonless. It runs containers as the invoking user. No root-owned daemon process. No socket to protect. Container escapes are contained to the user's privileges.
Additional wins:
- systemd integration (podman generate systemd)
- Kubernetes YAML compatibility (podman play kube)
- Docker CLI compatibility (alias docker=podman)
The Migration Strategy
200+ services across development, staging, and production. We couldn't migrate everything at once.
- Dev first: Developers switched voluntarily
- CI/CD migration: GitLab runners updated to use podman
- Staging validation: Full test suite against podman
- Production rollout: Service-by-service with rollback plans
The Surprises
Not everything was smooth:
- DNS resolution: Podman's default network differs from Docker's
- Volume permissions: Rootless means UID mapping headaches
- Health checks: Some Docker HEALTHCHECK patterns didn't translate
The Results
After 6 months, all 200+ services ran on Podman. Zero container escapes during the migration period. Developers adapted quickly—most didn't notice the difference after the first week.
The security team was happy. The infrastructure team was happy. The only unhappy people were the ones who had to write the migration documentation.