Rootful networking with rootless podman containers
summary
Shows how to run rootless containers but give them real host networking by combining user namespaces, explicit uid mappings and manual network setup. Uses podman 4.5 --uidmap when possible, otherwise creates a veth pair and names the container netns, or pipes a hand-crafted netavac JSON into netavac to attach a rootful bridge and publish ports. Delivers scripts and a systemd unit that work end-to-end (container serves HTTP), but podman inspect misses the network, systemd notifications break, and the undocumented JSON format is fragile.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 3:37Rootless containers security
- 5:21Rootful networking motivation
- 6:03User namespaces UID mapping
- 7:27Networking in namespaces
- 8:31UID mapping attempts
- 10:14Manual network setup
- 13:05Netavark for networks
- 15:11Live demo rootless networking
- 23:39Automating with systemd
- 24:43Limitations and future
- 25:23Summary
- 25:57Q&A
related talks
26mContainer Networking: The Play of BPF and Network NS with different...
26mFrom veth Pairs to Services: The Secret Life of Container Packets
43mPanel Discussion: Containers and Networking: A Symbiotic Relationship
26mHack Your Own Network Connectivity
33mContainer Networking for Micro-Services: An Apache Mesos Networking Deep Dive
32mUser Defined Networks: Gateway to Secure Multi-Tenancy
29mContainer Networking in Cloud Foundry
40mModular Overlay Networking Solutions with the Container Network Interface