Sharing data between containers without knowledge of the host

[Zzvok]

Hi,
I'm wondering if it's possible to share data directly between two containers in a pod, without any "traces" in the host.
When I create a volume, all data that a container will put inside exist also in the Mountpoint of the host. That a security problem in the case the content of a volume may be dangerous. If it's a virus, it could easily escape the containerization by this way.

Thanks for your time.

[mheon]

All data in the containers that make up the pod will also exist on the host (the mounted filesystems for a root container, for example, live under /var/lib/containers/storage by default), with the possible exception of tmpfs filesystems - and even then, it's trivial to join the mount namespace of the container, at which point you'll be able to see even these.

I would recommend a Podman-managed named volume given this, mounted into both containers. It still does exist on the host's filesystem, but it's entirely managed by Podman and can be set to autoremove when the last container using it is removed.

[rhatdan]

/dev/shm is shared between the containers, if you want to share data between two containers, you can use this, but this is limited to the size of memory.

If you need to write something big on disk, it will be on the host OS.

BTW there is no controls against the host from entering a container or stracing or debugging container processes.

[Zzvok]

Thanks for your help !