I have published a couple of videos that cover an overview of rootless containers through practical demonstration. If you are curious about terms like "rootless containers" or "running a container rootless as non-root," these videos will explain what they are and the benefits that these features provide.
The first video, Overview of Rootless Podman: Part 1—Understanding Root Inside and Outside a Container, I cover the four different options when running containers with podman:
- Running podman as root, with processes in the container running as root
- Running podman as root, with processes in the container running as non-root
- Running podman as an unprivileged user (rootless), with processes in the container running as root
- Running podman as an unprivileged user (rootless), with processes in the container running as non-root (also known as rootless as a non-root user)
Each of these options is explained, and a demonstration of each of them is also shown in the first video.
In the second video, Overview of Rootless Podman: Part 2—How User Namespaces Work in Rootless Containers, I dive deep into how user namespaces work in rootless podman, and demo the following topics:
- Running a container with rootless podman
- View user namespaces with the lsns command
- Review the /etc/subuid file, which defines subordinate UID ranges
- Review the /proc/<pid>/uid_map file, which shows the UID map for a process
- Calculate the UID number that a process will use on the host
- Use the podman top command to view the mapping of users between the container and the host
- Use the podman unshare command to run a command within a container's user namespace
These videos should provide you a better understanding of how user namespaces work and the various options that are available when running containers with podman.
[ Getting started with containers? Check out this free course. Deploying containerized applications: A technical overview. ]
