Rootless Podman port binding: host port start boundary

Goal

Expose a container service on a host port 80 while running Podman in rootless mode on RHEL.

Current Constraints

• Rootless containers run in a user namespace; kernel capability checks still apply.
• The boundary is defined by net.ipv4.ip_unprivileged_port_start (1024 by default). The value cannot be overridden per container.
• Podman’s --privileged flag in rootless mode does not grant full root privileges; it only adds a limited set of capabilities.

Unresolved Decision

Is there a supported, container‑specific method to allow binding to privileged ports without changing the host sysctl or running rootful?

Specific Questions

• Can Podman’s configuration (containers.conf or storage.conf) provide a per‑container override for ip_unprivileged_port_start?
• Does the newer pasta network backend offer any alternative port‑forwarding mechanism that bypasses the kernel check?
• What are the security implications of lowering net.ipv4.ip_unprivileged_port_start on a production host, and is there a compliance‑safe way to do so?