Does podman need sudo?

Project Discussion
1

Hello. Maybe this is OT, I don’t know.
Does podman necessarily need to be invoked with sudo?
There are hopes in the future to use it also as unprivileged user?

2

I’m on silverblue and just earlier ran podman without sudo with no changes to group membership. :slight_smile: If you need to escalate privs or anything i’m sure that would be a different story

You do have to add --net=host which is a bit odd to need to do out of the box… But I read somewhere that is only an atomic issue.

3

:face_with_raised_eyebrow:
On Silverblue (F29), without sudo, I get
could not get runtime: chown /home/user/.containers/storage/vfs: operation not permitted

4

On Silverblue F28, I get a different error

$ rpm -q podman
podman-0.7.3-1.git0791210.fc28.x86_64
$ podman run --rm -it docker.io/alpine echo 'hello'
ERRO[0000] No subuid ranges found for user ""

I’ve always used sudo podman but the eventual goal of the project is to be able to run containers unprivileged.

5

On regular Fedora, podman utilizes user namespaces when invoked by a non-root user, so in the end it’s possible to use podman w/o root:

$ podman images
REPOSITORY                  TAG      IMAGE ID       CREATED        SIZE
docker.io/library/busybox   latest   8c811b4aec35   2 months ago   1.36MB
$ podman run -ti docker.io/library/busybox sh
/ # id
uid=0(root) gid=0(root) groups=65534(nogroup),65534(nogroup),65534(nogroup),65534(nogroup),65534(nogroup),65534(nogroup),65534(nogroup),0(root),65534(nogroup),65534(nogroup)
/ # exit
$ id
uid=1000(tt) gid=1000(tt)
1 Like
6

Ah… yup definitely spoke too soon.

If you try to run containers like mongo for instance you’ll get issues with things like:

error: failed switching to "mongodb": operation not permitted

So looks like only switching users inside the container is one thing that for sure is not supported. Running via root/sudo of course does the trick.

Any good places with tips and tricks for podman or is it still too new?

7

On Silverblue:

$ rpm -q podman
podman-0.8.2.1-1.gitf38eb4f.fc28.x86_64
$ podman run --rm -it fedora:28 echo hello
hello
$ podman run --rm -it -p 8080:8080 fedora:28 echo hello
port bindings are not yet supported by rootless containers
$ echo hello > hello/hello.txt
$ podman run --rm -it -v $(pwd)/hello:/hello:z fedora:28 cat /hello/hello.txt
hello