News for hackers. Stuff that matters.
Re:Podman: A tool for managing OCI containers and pods by zz865 on Thursday September 02, 2021 @07:25AM (#28390714)
Podman is great because we dont get root access on our boxes at work.

One problem is someone still needs root access to install - or does anyone know if its possible to install as regular user?

Re:Podman: A tool for managing OCI containers and pods by ask2sk on Thursday September 02, 2021 @07:35AM (#28390804)
The following reply in GitHub addresses your question:

>>that is more difficult to get as you'd need to install all dependencies in your home directory and prepare all the configuration files to use/point the right executables. We have nothing at the moment for bootstrapping podman and its dependencies from scratch for an unprivileged user.

The easiest would be to install it on the system, but still use the unprivileged users for running the containers.

https://github.com/containers/podman/issues/3100

Re:Podman: A tool for managing OCI containers and pods by Klasiaster on Thursday September 02, 2021 @07:44AM (#28390865)
I don't think this will work unless you have a range of user and group IDs allocated for your user. Those will be used for non-root in-container users.

    $ echo USERNAME:10000:65536 >> /etc/subuid
    $ echo USERNAME:10000:65536 >> /etc/subgid
Re:Podman: A tool for managing OCI containers and pods by akvadrako on Thursday September 02, 2021 @12:36PM (#28394171)
Technically you don't need those if you always run your contains as a single user mapped to your real UID.
Re:Podman: A tool for managing OCI containers and pods by prpl on Thursday September 02, 2021 @02:27PM (#28395573)
I know uid 0 in container will always map to uid outside the container (e.g. 1005), but I haven't tried e.g. uid 999 in the container to ensure it maps to uid outside of the container (again, 1005), does that work?
Re:Podman: A tool for managing OCI containers and pods by foresto on Thursday September 02, 2021 @04:32PM (#28396986)
> I know uid 0 in container will always map to uid outside the container

I don't think that's true. Have a look at Podman's --userns=keep-id and related options.

Re:Podman: A tool for managing OCI containers and pods by prpl on Thursday September 02, 2021 @04:47PM (#28397150)
ah yeah, I had forgot about that one specifically