Rootful mode

As explained in Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more

A rootful container is a container whose engine or processes run with host-level root privileges.

Rootful mode runs Podman or container processes with host-level root privileges. Unlike rootless operation, it can configure host networking devices and firewall rules, but a breakout threatens the host and other workloads. section 6.0 section 6.2.3

Rootful Podman uses native Linux overlay mounts by default and CNI plugins for container networking. These privileges support advanced networking, but they enlarge the security boundary. section 6.2.2 section 6.2.3

Running Podman inside another container exposes the capability requirements:

• Use CAP_SYS_ADMIN for rootful Podman inside a container; --privileged supplies the capability needed to mount filesystems. section 8.4.1
• Use a privileged Kubernetes container for equivalent rootful execution. section 8.4.2
• Prefer rootless containers, dropped capabilities, read-only mode, or separated user namespaces when root privileges are unnecessary. section 11.5.1

Run rootful Podman inside a container

podman run --privileged quay.io/podman/stable podman version section 8.4.1

Figure 6.1 Multiple users’ workloads sharing the same daemon running as root is inherently insecure.

Compare the insecure shared root-running daemon model with independent user spaces. section 6.0

Table 8.1 Requirements for running Podman within a container (view table figure)

Host mode	Container mode	Capabilities	Explanation
Rootful	Rootful	CAP_SYS_ADMIN	Has full access to the host user’s namespace
Rootful	Rootless	CAP_SETUIDCAP_SETGID	Runs in a separate user’s namespace based on /etc/subuid and /etc/subgid inside the container
Rootless	Rootful	Namespaced CAP_SYS_ADMIN	Has full access to the user’s user namespace
Rootless	Rootless	Namespaced CAP_SETUID, CAP_SETGID	Runs in a separate user namespace based on /etc/subuid and /etc/subgid inside the container. The user namespace must be a subset of the user namespace in which you are running the Podman command.

Inspect host and container mode combinations with their required Linux capabilities. section 8.4

How Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more covers it

How deep it goes

Explains rootful storage, networking, nested-container capabilities, and security tradeoffs, but defers complete daemon and namespace internals.

Examples

Demonstrates nested rootful Podman with --privileged and privileged Kubernetes YAML configuration.

What it assumes

Assumes basic Podman commands and Linux permissions, then develops capabilities, namespaces, storage mounts, and container networking.

What you can do after

Operate/configure rootful Podman in nested containers or Kubernetes while selecting required capabilities and recognizing security costs.

How it connects

Connects rootful mode to rootless containers, Linux namespaces, capabilities, overlay storage, CNI plugins, and Kubernetes.

liveBookmanning.com

Read Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more on liveBook Get the book at manning.com

Related concepts

• rootless modecontrasts with · Rootless mode is a container-execution mode in which the container engine and processes run without host-level root privileges.
• CAP_SYS_ADMINuses · CAP_SYS_ADMIN is a Linux capability that includes permission to perform filesystem mounts and many other system-administration operations.
• user ID namespacehas part · A user ID namespace is a Linux isolation mechanism that separates user and group identifiers and maps them between namespace and host contexts.

This explainer was generated by Manning's knowledge graph from the text of Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more. The section links point to the parts of the book it draws on.