Securing services with Rootless Containers

A common belief among backend developers is that containers are themselves a security layer; this piece explains why they are not, and walks through the single measure with the best leverage: running services rootless. The threat model is laid out plainly (with a rootful daemon, a container escape lands on the host as root; rootless, it lands as an unprivileged user), then the machinery: subordinate UID mappings, daemonless Podman supervised by systemd quadlet units, a complete PostgreSQL example, and a hardened second unit that drops every Linux capability and mounts its filesystem read-only. It closes on the networking caveats rootless introduces around privileged ports, preserved source IPs, and firewall rules. A fitting detail: the hardened example service is Anubis, the same anti-bot proof-of-work gate that guards the blog itself.