Docker is the most popular way to build and run containers, but since the container standard is open, there are also alternative runtimes that you may use. The main replacement for Docker that offers a similar user experience is Podman. Together with Buildah, described in the previous section, they are tools aimed to replace Docker altogether.
The added benefit is that they don't require an additional daemon running on a host machine, as Docker does. Both also have support (although it is not yet mature) for rootless operations, which makes them a better fit for security-critical operations. Podman accepts all the commands you would expect the Docker CLI to take, so you can simply use it as an alias this way.
Another approach to containers that aims to provide better security is the Kata Containers initiative. Kata Containers uses lightweight virtual machines to leverage the hardware virtualization required for an additional level of isolation between...
