The /etc/subgid file assigns subordinate group-ID ranges to user accounts. Each entry has three colon-separated fields: a login name or UID, the starting subordinate group ID, and the number of IDs available. Rootless Podman reads this file together with /etc/subuid when creating user namespaces. section 5.4 section 5.5
Configure and operate subordinate group ranges with these safeguards:
- Keep each user's subordinate range unique and prevent overlap with system IDs; Podman does not verify these conflicts automatically. section 5.4
- After changing /etc/subgid or /etc/subuid, run podman system migrate so the rootless pause process adopts the updated namespace settings. section 6.2
- Use a separate containers range with --userns=auto when containers need unique user namespaces and nonoverlapping ID allocations. section 10.3.1
A subordinate group-ID allocation
A typical paired configuration is dwalsh:100000:65536 in both /etc/subuid and /etc/subgid. For automatic per-container allocation, a containers entry can provide a larger range, such as containers:2147483647:2147483648. Podman partitions that range for --userns=auto and reclaims allocations when containers are removed. section 10.3.1
