Rootless containers using Podman

I have published a couple of videos that cover an overview of rootless containers through practical demonstration. If you are curious about terms like "rootless containers" or "running a container rootless as non-root," these videos will explain what they are and the benefits that these features provide.

The first video, Overview of Rootless Podman: Part 1—Understanding Root Inside and Outside a Container, I cover the four different options when running containers with podman:

• Running podman as root, with processes in the container running as root
• Running podman as root, with processes in the container running as non-root
• Running podman as an unprivileged user (rootless), with processes in the container running as root
• Running podman as an unprivileged user (rootless), with processes in the container running as non-root (also known as rootless as a non-root user)

Each of these options is explained, and a demonstration of each of them is also shown in the first video.

In the second video, Overview of Rootless Podman: Part 2—How User Namespaces Work in Rootless Containers, I dive deep into how user namespaces work in rootless podman, and demo the following topics:

• Running a container with rootless podman
• View user namespaces with the lsns command
• Review the /etc/subuid file, which defines subordinate UID ranges
• Review the /proc/<pid>/uid_map file, which shows the UID map for a process
• Calculate the UID number that a process will use on the host
• Use the podman top command to view the mapping of users between the container and the host
• Use the podman unshare command to run a command within a container's user namespace

These videos should provide you a better understanding of how user namespaces work and the various options that are available when running containers with podman.

[ Getting started with containers? Check out this free course. Deploying containerized applications: A technical overview. ]