Choosing Between Podman Rootless and Rootful Container Execution

Decision: Rootless vs Rootful in Podman

When running containers with Podman you must decide whether to use rootless execution (the container process runs as an unprivileged user on the host) or rootful execution (the container process runs as UID 0 on the host). The decision hinges on security requirements, compatibility with privileged operations, and the availability of user namespaces on the host.

Constraints

• Host must support user namespaces (most modern Linux kernels enable them by default).
• Rootless containers cannot perform operations that require host‑level privileges, such as binding to ports below 1024, mounting block devices, or loading kernel modules.
• Rootful containers need the Podman daemon or binary to be executed with sufficient privileges (typically via sudo or a root shell).

Options Comparison

Trade‑offs

Choosing rootless improves isolation and reduces the impact of a container break‑out, but you may need to adjust application code or run extra Podman flags (e.g., --device, --publish with high ports) to achieve the same functionality as rootful. Rootful avoids those adjustments but requires trusting the container runtime with host‑level root privileges.

Concrete Validation

To confirm that your Podman installation can run rootless containers, execute the following command in a regular user shell (no sudo needed):

podman info | grep -i rootless

If the output contains a line such as "Rootless: true", the host user namespace is configured correctly and Podman will attempt rootless mode by default.

Next, run a simple container that does not require privileged access and verify its effective UID inside the container:

podman run --rm -u 1000:1000 alpine sh -c 'id -u'

Expect the command to print 1000, showing that the container’s process is mapped to the host UID 1000 (or the UID you specified).

If you need to force rootful mode for a specific image, you can override the default with the --userns=host flag (or set CONTAINERS_ROOTLESS=0 in the environment):

CONTAINERS_ROOTLESS=0 podman run --rm alpine whoami

This command should run as root inside the container (output root).

Limitations and How to Check

• Rootless may fail when a container tries to bind to a port < 1024. To test, attempt podman run --rm -p 80:80 nginx as a regular user; if it fails with "permission denied", the limitation is confirmed.
• User namespace limits (max UID/GID IDs) can cause mapping errors. Check the available range with cat /proc/self/uid_map inside a rootless container; a missing mapping indicates the host’s /etc/subuid or /etc/subgid needs adjustment.
• On some SELinux or AppArmor profiles, rootless containers may be denied access to certain files. Review audit logs (ausearch -m avc -ts recent) if you observe unexpected denials.