Podman bug bounty programs

Podman programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
PO Podman Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	3 days promised	Open

• PO

  Podman

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

  First response

  3 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://github.com/podman-container-tools/podman

  Web

• Checkpoint and restore through CRIU, including the checkpoint archive parser

  Products and areas

• Configuration handling for containers.conf, storage.conf, registries.conf and policy.json, including the drop-in directories

  Products and areas

• Container creation and the isolation it configures: namespaces, cgroups, capabilities, seccomp, SELinux labelling and the conmon boundary

  Products and areas

• Image pull and push, registry authentication, credential storage in auth.json, signature verification and policy.json trust evaluation

  Products and areas

• Networking through netavark and aardvark-dns, plus the legacy CNI path, port publishing and the firewall rules Podman writes

  Products and areas

• podman build, which runs Buildah as a library, and the whole Containerfile and build-context path it drives

  Products and areas

• podman kube play and podman kube generate, and the Kubernetes YAML they parse and act on

  Products and areas

• podman machine: the VM lifecycle across Hyper-V, WSL and applehv, the connection to the guest and the TLS and SSH setup between host and VM

  Products and areas

• Pods, the infra container and the shared namespaces inside a pod

  Products and areas

• Rootless operation end to end: user namespace setup, subuid and subgid mapping, the rootlesskit and pasta or slirp4netns paths, and the storage layout under the user's home

  Products and areas

• systemd integration: Quadlet unit generation and parsing, podman generate systemd and the auto-update path

  Products and areas

• The podman CLI in full, across every subcommand and every flag that changes the privilege or isolation setup

  Products and areas

• The REST API in both flavours, the libpod API and the Docker-compatible API, and the socket they are served on including the systemd-activated socket

  Products and areas

• The shared container-libs code (containers/image, containers/storage, containers/common) as Podman executes it, which the same address accepts

  Products and areas

• The shared Containers-projects policy asks for any vulnerability to be reported privately to the security list and rules out public disclosure. It draws no boundary narrower than the Podman tree itself

  Products and areas

• Volume and mount handling, including bind mounts, named volumes, --mount parsing, SELinux relabelling and the resolution of paths supplied by an image

  Products and areas

No target matches. Try part of a host name, such as the company name.