Podman Desktop: A Free OSS Alternative to Docker Desktop

Re:Podman Desktop: A Free OSS Alternative to Docker Desktop by BeefWellington on Wednesday November 09, 2022 @10:55PM (#33542006)

If you want something as non-root to bind below 1024, there's a sysctl for it.[1]

Docker bypasses this essentially because it uses root privs to set up the port forwarding rules.

[1]: https://www.kernel.org/doc/html/latest/networking/ip-sysctl.... -> ip_unprivileged_port_start

[ Parent | on HN ]

Re:Podman Desktop: A Free OSS Alternative to Docker Desktop by sph on Thursday November 10, 2022 @03:54AM (#33543903)

It's not enough in some cases, in a multi container pod (with `podman play kube`) I still got permission issues binding to privileged ports (which were permitted by the sysctl). There was some github issue about it.

In my experience, if you need to bind to < 1024 ports, just run the container as root. Also if you want finer-grained control of host-side permissions of your mounts (i.e. map host uid 1000 to container uid 99). Otherwise rootless is fine.

[ Parent | on HN ]

Re:Podman Desktop: A Free OSS Alternative to Docker Desktop by BeefWellington on Thursday November 10, 2022 @11:36AM (#33549047)

Note that that sysctl indicates it's namespace-specific, so it's possible it needs to be set for the application's namespace (maybe as well) via `--sysctl` on the podman command line.

I did a quick test and it works ok for me to bind to low numbered ports just passing that param to podman run.

[ Parent | on HN ]