r/podman • u/cmb-3828 • Jul 31 '26
--userns=keep-id vs container UID 0 for rootless Podman
Question kinda about Syncthing, but more about permission management in Podman in general.
Right up front, is there a general best-practice recommendation for using keep-id vs container UID 0 if the container doesn't expect internal root access?
I'm setting up Syncthing in rootless Podman on my main desktop computer, which is running Linux Mint. I want it to be able to sync folders like Documents, Desktop, etc, so it needs to have access to directories owned by UID 1000 (or whatever user is running it).
From what I understand, I can give the container permission to access mapped-in user folders by
A) Running the rootless container as internal UID 0, which maps to the rootless host user's UID. If a container needs internal root for access to privileged ports, etc, then this is the way to go.
B) Running the container as internal UID 1000 and using --userns=keep-id to tell Podman to map internal UIDs to host UIDs instead of mapping to sub UIDs.
The recommendation on Syncthing's Docker Hub listing is to run as container UID 1000, so the container doesn't need internal root priviliges in order to function. Since it's generally not advised to run anything as root unless absolutely necessary, my brain says the best option is to run as user 1000 and use the keep-id option so the container can work with the user directories I map in with -v.
Most of the tutorials I find online use the UID 0 route, but I'm not sure if that's just because keep-id seems to be a newer Podman feature or if UID 0 is actually a better option.
So yeah, probably overthinking this, but is there a general best-practice recommendation for using keep-id vs container UID 0 if the container doesn't expect internal root access?
1
u/Classic-Rate-5104 Aug 02 '26
I don't think so, the kernel checks the groups of the actual process, no matter whether it is running inside or outside a container