Rootless containers with Podman

on YouTube ↗19m

" summary

Deploys Home Assistant and Mosquitto containers rootless with Podman 2.x + slirp4netns, using subuid/subgid mappings and mapped host volumes with SELinux labels, and exposes them via systemd service units. Initial tests hit Podman/RHEL 8.1 memory and cleanup bugs but RHEL 8.2 fixes make the setup stable. Containers can run with the host process owned by an unprivileged user while services inside run as non-root where possible. Notes include Buildah for non-root image builds and CRI-O context for Kubernetes.

AI-written summary · about

" chapters (11)

1. 0:00Intro
2. 1:52Container Standards: Runtime interfaces
3. 4:01Why rootless containers?
4. 6:15Why Should I Care?
5. 8:26Be the customer
6. 9:59Rootless Options
7. 11:33Rootless Requirements
8. 13:15Hass container
9. 14:13MQTT
10. 15:14Good/Bad/Frustrating
11. 17:37References

" related talks

• 19mRootless containers with PodmanSteven Ellis · Linux.conf.au 2021 Systems Administration Miniconf
• 40mRootless Containers with PodmanSteven Ellis · Open Source Summit + Embedded Linux Conference + OSPOCon 2021
• 39mPodman - create, run and secure Linux containersValentin Rothberg · Code Mesh LDN 2020
• 35mThe Reality of Rootless ContainersAjitem Sahasrabuddhe · ContainerDays Hamburg 2026
• 44mRootless containersAkihiro Suda, Giuseppe Scrivano · DevConf.CZ 2019
• 39mReplacing Docker with PodmanDaniel Walsh · DevConf.CZ 2019
• 38mUnderstanding root inside and outside a containerScott McCarty · DevConf.CZ 2021
• 53mContainers without Daemons - Podman InternalsMatthew Heon · DevConf.CZ 2019