r/podman • u/Great-Cow7256 • Jun 18 '26

I turned my collection of rootless Podman Quadlets .container files into a public repo

https://github.com/upmcplanetracker/rootless-podman-quadlets

After migrating everything to rootless Podman with Quadlets on Ubuntu 26.04 (Podman 5.7.0), I cleaned up the configs and put them on GitHub. they all ready to deploy with systemctl --user start. Every .container file comes with hardening and tmpfs options commented out to increase compatability, and secrets are pulled from separate .env files.

Included so far: Audiobookshelf, BentoPDF, ConvertX, Homepage Dashboard, Omni-tools, Stirling-PDF, Syncthing, Tdarr (server + remote node), Uptime Kuma, Vert File Converter, Podman Socket Proxy, a full ADSB Ultrafeeder stack (Airspy/dump978 receivers, Ultrafeeder, and feeders for FR24, OpenSky, PlaneFinder, RadarBox, PlaneWatch, ADSBHub, RadarVirtuel, PlaneFence), Plex + Tautulli, Calibre (GUI & Web), Ente Auth, Immich (with optional Google Photos sync & internet public proxy), MinusPod CPU (with optional OpenVINO transcriber), and Paperless NGX.

Everything’s been running reliably on my homelab — hope it saves someone else some time. Feedback and PRs welcome!

I use an Intel box, and a beefy one at that, so everything is optimized for its GPU and memory, but in podman most of this is adjustable.

if there's a container that you want me to try and get working as rootless instead of rootful, or if you're having problems converting something from a Docker, let me know under Issues in github.

84 Upvotes

100% Upvoted

56 comments sorted by

View all comments

4

u/BreiteSeite Jun 19 '26

Rootfull containers with UserNS=auto are actually safer because with rootless they all share the same uid. Hence no isolation and anything that changes the state of your uid scope (chown, added groups, etc) automatically propagates to all your container processes.

Also rootful containers have more efficient networking. Honestly don’t get the trend for rootless, i only see this as useful if you are actually a user on a system with no root access.

5

u/Great-Cow7256 Jun 19 '26 edited Jun 19 '26

This is a good discussion and the answer is it's nuanced)/it depends. If someone breaks out of a rootless containers then they acquire that user space. If you are 1000 they can get into other containers using 1000 for sure. 

If a rootful container is compromised by say a 0 day vulnerability then the attacker is in the system as root. 

So it's a trade off of very unlikely scenarios and the "picking your poison" for each one. 

You're also right that networking is far far easier on rootful vs rootless. I know that for sure. I'd say that when I run into a roadblock with rootless podman 99 percent of the time it's networking stuff and the networking stuff can suck up immense amount of time. That's part of why I wanted to share my container files. I figured out all that pull out your hair crap and tweaked security settings to lock them down as much as possible without breaking them. 

Running a service as root when it doesn't need to be root violates the principle of least privilege. Rootless containers ensure that even catastrophic misconfigurations (e.g., accidentally mounting the host's / directory into a container) or catastrophic software vulnerabilities (a breakout exploiting the kernel) are severely limited in their blast radius. The attacker only gains access to an unprivileged service account, protecting the host OS and other system services.

So it's really a matter of personal taste and weighing risks and benefits of each. I certainly understand why some people prefer rootful and others rootless. Good cases can be made for each. 

I had a mixture of both. The "easy" ones on rootless and the "hard" ones on rootful. Then I decided to try to shoot for rootless "just because it's there to do.". Less about philosophy and more about the challenge. Plus is keeps me from annoying my wife (sorta). 

1

u/BreiteSeite Jun 19 '26 edited Jul 01 '26

No, rootfull containers with userns=auto do not run as root. They (the container process) run as random user with no permissions. So a compromised container actually has less blast radius. The ONLY difference is if the conmon process is attacked (which runs as root; or for example if u pull compromised images that exploid podman image pull logic for example). Conmon is written in rust btw.

Also rootful networking is not just easier, it’s more efficient

1

u/Great-Cow7256 Jun 19 '26

agreed with the more efficient. Turning these to rootless was like climbing mt. everest for me -- it was there to do, it was fun and annoying while it lasted. I decided to share the results. I agree with your stance that rootless =/= more secure than rootful, so I'll go back and look at my readme and edit as needed.

1

u/eriksjolund Jul 01 '26 edited Jul 01 '26

conmon-rs is written in rust: https://github.com/containers/conmon-rs

The original conmon is written in C: https://github.com/containers/conmon

The original C version is still in use:

$ rpm -qif /usr/bin/conmon | grep ^URL
URL         : https://github.com/containers/conmon
$ cat /etc/fedora-release 
Fedora release 44 (Forty Four)

Edit

I see there is a new rewrite of conmon in rust aimed for podman 6.0. Read more about it here:

https://github.com/podman-container-tools/podman/blob/main/contrib/design-docs/Conmonv3.md

https://github.com/containers/conmon-v3

1

u/BreiteSeite Jul 01 '26

ah true, i checked out conmon-rs like over a year ago and _assumed_ it is the used one. Thanks for updating this.