Rootless mode runs the container engine and its processes without host-level root privileges. Podman lets ordinary users run containers and build images using a standard Linux account, while processes remain owned by that user. section 1.3.2 section 1.1
User namespaces provide the foundation. Podman maps multiple subordinate UIDs and GIDs to a user, isolating container processes from host users and from containers belonging to other users. Each rootless user normally shares one user namespace across their containers. section 1.3.12 section 6.2
A rootless container startup involves several unprivileged components:
- Podman reads the user's ranges from /etc/subuid and /etc/subgid and uses newuidmap and newgidmap to verify the allocation. section 5.4
- A podman pause process keeps the user and mount namespaces alive so later Podman commands can join them. section 6.2
- Podman creates container storage with overlay mounts or fuse-overlayfs on older kernels. section 6.2.2
- slirp4netns supplies user-mode networking because unprivileged processes cannot create network devices or modify firewall rules. section 6.2.3
- Podman starts the container process under the user's identity and monitors it with conmon. section 1.3.2 section 6.3
Run a rootless application
podman run -d -p 8080:8080 --name myapp quay.io/rhatdan/myimage The command pulls the image if necessary, creates rootless namespaces and storage, configures user-mode networking, and starts the application without host root privileges. If subordinate-ID files change, run podman system migrate so the pause process uses the new mappings. section 6.1 section 6.2
Rootless mode reduces the impact of container escape: a compromised process retains the invoking user's UID and ordinary-user capabilities rather than gaining host root. It is suited to shared, security-sensitive systems, although advanced networking and workloads requiring additional capabilities may require rootful execution or explicit configuration. section 6.0 section 6.2.3 section 8.4.2
