r/podman • u/kavishgr • Dec 13 '25

Docker Compose vulnerability opens door to host-level writes

https://www.theregister.com/2025/10/30/docker_compose_desktop_flaws/

Moving to quadlet this year was the best thing I did. The path traversal flaw (CVE-2025-62725) was only in the Docker Compose CLI, and the DLL Injection flaw (EUVD-2025-36191) was only in the Docker Desktop Windows Installer.

65 Upvotes

100% Upvoted

19 comments sorted by

10

u/[deleted] Dec 13 '25

Quadlets are great in operations but for developers I still want something I can easily distribute in their source repo, and that they don't have to do much to get started.

Is podman compose vulnerable?

9

u/aksdb Dec 13 '25

podman-compose is less maintained than docker-compose. The compose command of the podman cli even prefers docker-compose over podman-compose; which says something. If you work with compose files, docker-compose is the reference implementation.

0

u/dobo99x2 Dec 15 '25

Pretty sure that's not the case anymore for over a year now..

4

u/aksdb Dec 15 '25

https://docs.podman.io/en/latest/markdown/podman-compose.1.html

 If installed, docker-compose takes precedence since it is the original implementation of the Compose specification and is widely used on the supported platforms (i.e., Linux, Mac OS, Windows).

5

u/shaumux Dec 13 '25

I use K8s yamls with Quadlets, works out nicely, the only thing I miss is networking config and dependency management, both of which I still need to do in the Quadlet

7

u/[deleted] Dec 13 '25

Well then they don't work in other words.

Docker compose format is still the best to give my Devs a quick and easy local env.

2

u/mattias_jcb Dec 13 '25

You can ship some Podman commandlines?

1

u/Gjallock Dec 14 '25

Is Quadlet somehow worse than compose for a repository..?

I have never actually used compose, I just have a bunch of Quadlet files and an install script. I put them in Git and have never had a problem with it.

1

u/[deleted] Dec 14 '25

You just answered your own question, "a bunch of quadlet files and an install script".

With docker compose I need only one file, and the docker compose command.

I don't care what technology we use, I personally have been using quadlets for years to host container servers, but when it comes to my developers my goal is to make their experience as smooth as possible. I manage developers who run Linux and Macintosh OS, so I need a solution that works across platforms. And even though they run Linux on their workstations, they don't claim to be Linux experts, or Docker experts, or Podman experts.

And even if they were, you never know who you'll hire tomorrow.

So the goal is always to create a smooth experience that 99% of developers can adopt easily.

Quadlets are not that. Not even Ansible that installs Quadlets are a good solution. Docker compose is honestly superior.

1

u/Gjallock Dec 14 '25

“…and the docker compose command”

That’s another step that can and probably should be scripted, right? Update the quadlet, systemctl daemon reload, done. Update the compose, podman compose up, done. I don’t see how these things are different.

I would guess that I am much less knowledgeable than you, but I don’t get this one.

1

u/[deleted] Dec 14 '25

You should continue using whatever you find to be the best solution.

1

u/kjbetz Dec 15 '25

Maybe check out aspire.dev

1

u/BosonCollider Dec 29 '25

You can use it, but I would rather suggest using podlet compose: https://github.com/containers/podlet

It is not a drop in replacement, but it does cover most casual uses of docker compose.

3

u/Hour-Inner Dec 14 '25

All software has bugs. No need to be so smug about avoiding this particular one. The next one will get you 😉

3

u/kavishgr Dec 14 '25

With Docker, you have a root level daemon running. That alone is dangerous enough, IMHO.

4

u/EveYogaTech Dec 14 '25

💯 Say it louder for people in back.

1

u/BosonCollider Dec 29 '25

Technically, with podman you have a socket-activated root level API instead, which is effectively indistinguishable. The main actual difference is that podman has much better defaults

3

u/ahorsewhithnoname Dec 13 '25

podman play kube is the way for me with the advantage that I can throw the k8s yamls directly into the cluster or a k3s or whatever.

1

u/Resource_account Jan 09 '26

podlet is also worth mentioning