Podman rootless containers binding to privileged ports when sysctl changes are restricted

Goal: Allow rootless Podman containers to bind to privileged ports such as 80 without modifying the host’s net.ipv4.ip_unprivileged_port_start sysctl, so that the same configuration that works locally can be used in production.

Constraint: In many production hosts the sysctl is locked down by security policies (SELinux, AppArmor, or privileged‑container restrictions), preventing the administrator from lowering ip_unprivileged_port_start and causing bind‑permission failures.

Uncertainty: It is not documented whether Podman can automatically request or use alternative privileges (e.g., CAP_NET_BIND_SERVICE) or a per‑user‑namespace sysctl override to achieve the same result, leaving administrators to decide between relaxing host‑level settings or seeking another approach.

Can rootless Podman containers be granted CAP_NET_BIND_SERVICE to bind to ports <1024 without changing ip_unprivileged_port_start? Is there a safe per‑user‑namespace method to lower the unprivileged port start? What is the recommended practice for production environments that prohibit host‑level sysctl changes?