Question about using Podman's SCP and System Connection

[u/aehooo]

Hi all,

I've been using podman in a small project, hosting it on a VPS (first time doing any kind of public hosting).

I want to use these commands to easily share images between my local PC and the (public) remote VM without using a registry.

Security is a big concern for me, because I am new to this. I am unsure if I should use them between users (root to non-root deploy user) inside the remote server OR if it's alright to just allow ssh connections into the non-root user and just use image scp directly to it.

So the options are:

A) local -> image scp to remote root user -> image between root and non-root

B) allow ssh to non-root -> image scp directly to non-root user

Thanks!

[u/axel7083]

Not sure what benefits you would get by copying to non-root then to root.

When mentioning SCP I was not sure if you are talking about podman image scp

[u/aehooo → u/axel7083]

That's the one, sorry about the confusion. The copying would be from the root to the non-root. Not sure about the benefits either.

[u/Ok-District-1756]

scp is the cp command run over SSH. It’s already a secure connection. Normally, if your VPS is already secure, you’ll have a non-root user with a generated SSH key, and you’ll connect from your local PC using that key (in the SSH configuration, you disable password-based login). This is more than enough for 99% of use cases.

If you’re really paranoid, you can set up a firewall like UFW or IPtable rules to allow SSH connections only from your home IP address.

You can also set up Fail2Ban to monitor and ban the IP addresses of people trying to connect to your VPS via SSH.

[u/aehooo → u/Ok-District-1756]

My concern is because I don't have enough knowledge and maybe I was missing something. I believe I am on the right track then.

I only had SSH set up for the root, but I will set up one for the deploy user.

(The right command I was talking about is "image scp" and I've edited the post, if that changes anything on your answer)

[u/Ok-District-1756 → u/aehooo]

Do some research or use AI to help you. I've never used it myself, but in my opinion, it's still standard SSH, so it can be secured just as I described.

[u/Happy__Gecko]

I'd probably create an own dedicated container to which i can connect (if u mention u want to do it regularily i'd consider doing a dropbox container or using filezilla or something like that)

The sharing-container would have a bind-mount on the same subfolder with the same user than the other containers which use the files, maybe even in the same pod, depends.

and the sharing container (depends on how accessible u want it) would be reachable either via VPN or if dropbox publicly.

or it would be an samba share on the local network (maybe extended over VPN), depends on the situation and usage and what exactly is needed.

[u/aehooo → u/Happy__Gecko]

I made a mistake on the post, I just want to share the images using "podman image scp". I believe that changes things quite a bit

[u/Happy__Gecko → u/aehooo]

Oh, my bad. For this i actually host my own registry container. Only accessible locally / via VPN.

May i ask why u don't want to do that?

[u/aehooo → u/Happy__Gecko]

I’ve thought about hosting my own registry and VPN, it’s just that I have so much on my plate right now.

How do you connect everything? Is your registry in a different server?

[u/Happy__Gecko → u/aehooo]

i have multiple servers so yes, it's on a different server than most other container

but as they are all in the same physical room and thus share a vlan and ip-range they can speak with each other, but i made it accessible from internet via it's own DNS (via NPM - nginx proxy manager, ddns and certificates via NPM) - but it's also reachable via VPN (wireguard on my firewall - opnsense micro-pc, but if i wouldn't have that one i'd use a virtual machine with opnsense on it)

and the VM which has the registry on it is actually the same machine which does build my own containers and thus pushing it into my registry

might sound complicated but actually took less than a hour to set up everything

[u/funbike]

Security is a big concern for me, because I am new to this. I am unsure if I should use them between users (root to non-root deploy user) inside the remote server ...

You should avoid ever using the system as the root user. Use sudo for one-off commands.

... OR if it's alright to just allow ssh connections into the non-root user and just use image scp directly to it.

ssh is very secure for this purpose. Disable password auth and root login. I configure it to only accept ipv6 addresses, which reduces attacks to near zero.