Running Containers Without Root: Practical Guide to Podman's Rootless Mode

Why you might need rootless containers

Many developers and sysadmins want to experiment with containers on a shared workstation or a laptop where they do not have sudo rights. Traditional Docker requires a privileged daemon, which blocks that workflow. Podman offers a rootless mode that lets you run containers as your regular user, using user namespaces to isolate the container’s view of UID 0.

How rootless mode works

When you start Podman in rootless mode, the kernel creates a user namespace that maps the container’s internal UID 0 to an unprivileged UID on the host (usually a range allocated in /etc/subuid and /etc/subgid). Because there is no long‑running daemon, each podman command talks directly to the OCI runtime (crun or runc) through the containers/storage library. This reduces the attack surface and eliminates a privileged background process.

Common gotchas

• Ports below 1024 are privileged; rootless containers can only bind to ports >1024 unless the host administrator adjusts net.ipv4.ip_unprivileged_port_start.
• Access to certain kernel modules (e.g., FUSE) or devices that require CAP_SYS_ADMIN may be unavailable.
• Each invocation spawns a new runtime process, which can add overhead for very high‑frequency workloads.

Worked example: running an NGINX container on port 8080

1. Ensure your user is configured for subuid/subgid ranges (most modern distributions do this automatically).
2. Pull and run the container:

podman run --rm -d -p 8080:80 docker.io/nginx

Verify that the NGINX process runs under your user ID:

ps -u $USER -o pid,comm | grep nginx

Check that no Podman daemon is active for your user:

systemctl --user status podman.socket

The service should report “inactive” or “dead”.

Limitations and how to check them

If you need to bind to a privileged port (e.g., 80), you have two options:

• Ask the system administrator to lower net.ipv4.ip_unprivileged_port_start to 80.
• Use a tool like slirp4netns with port forwarding, or run a reverse proxy (e.g., Caddy, Traefik) in another container that listens on the privileged port and forwards to your rootless service.

You can confirm the current limit with:

sysctl net.ipv4.ip_unprivileged_port_start

Actionable next steps

Start by running podman info and confirming that host.rootless is true. Then try the NGINX example above, check the process ownership, and verify that no daemon is running. If you encounter a port‑binding error, adjust the unprivileged port range as described or place a proxy in front of your service. Rootless mode gives you a safer, daemon‑free way to run containers on any Linux workstation where you have a regular user account.