6 Podman overview #

Podman remaps user IDs with rootless containers. In the following example, Podman remaps the current user to the default user in the container:

❯ podman run --rm -it registry.suse.com/bci/bci-base id
uid=0(root) gid=0(root) groups=0(root)

Note that even if you are root in the container, you cannot gain superuser privileges outside of it.

This user remapping can have undesired side effects when sharing data with the host, where the shared files belong to different user IDs in the container and on the host. The issue can be solved using the the command line flag --userns=keep-id that makes it possible to keep the current user id in the container:

❯ podman run --userns=keep-id --rm -it registry.suse.com/bci/bci-base id
uid=1000(user) gid=1000(users) groups=1000(users)

The flag --userns=keep-id has a similar effect when used with bind mounts:

 ❯ podman run --rm -it -v $(pwd):/share/ registry.suse.com/bci/bci-base stat /share/
  File: /share/
  Size: 318             Blocks: 0          IO Block: 4096   directory
Device: 2ch/44d Inode: 3506170     Links: 1
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2023-05-03 12:52:18.636392618 +0000
Modify: 2023-05-03 12:52:17.178380923 +0000
Change: 2023-05-03 12:52:17.178380923 +0000
 Birth: 2023-05-03 12:52:15.852370288 +0000

 ❯ podman run --userns=keep-id --rm -it -v $(pwd):/share/ registry.suse.com/bci/bci-base stat /share/
  File: /share/
  Size: 318             Blocks: 0          IO Block: 4096   directory
Device: 2ch/44d Inode: 3506170     Links: 1
Access: (0755/drwxr-xr-x)  Uid: ( 1000/     user)   Gid: ( 1000/     users)
Access: 2023-05-03 12:52:18.636392618 +0000
Modify: 2023-05-03 12:52:17.178380923 +0000
Change: 2023-05-03 12:52:17.178380923 +0000
 Birth: 2023-05-03 12:52:15.852370288 +0000

Podman stores the containers' data in the storage graph root (default is ~/.local/share/containers/storage). Because of the way Podman remaps user IDs in rootless containers, the graph root may contain files that are not owned by your current user but by a user ID in the sub-UID region assigned to your user. As these files do not belong to your current user, they can be inaccessible to you.

To read or modify any file in the graph root, enter a shell as follows:

 ❯ podman unshare bash

 ❯ id
uid=0(root) gid=0(root) groups=0(root),65534(nobody)

Note that podman unshare performs the same user remapping as podman run does when launching a rootless container. You cannot gain elevated privileges via podman unshare.

Refrain from modifying files in the graph root as this can corrupt Podman’s internal state and render your containers, images and volumes inoperable.

Because unprivileged users cannot configure network namespaces on Linux, Podman relies on a userspace network implementation called slirp4netns. It emulates the full TCP-IP stack and can cause a heavy performance degradation for workloads relying on high network transfer rates. This means that rootless containers suffer from slow network transfers.

On Linux, unprivileged users cannot open ports below port number 1024. This limitation also applies to Podman, so by default, rootless containers cannot expose ports below port number 1024. You can remove this limitation using the following command:

sysctl net.ipv4.ip_unprivileged_port_start=0

or make it persistent via:

sysctl -w net.ipv4.ip_unprivileged_port_start=0

Note that this allows all unprivileged applications to bind to ports below 1024.

Since Podman is compatible with Docker Open Source Engine, it features the same command-line interface. You can also install the package podman-docker that allows you to use an emulated docker CLI with podman. For example, the docker pull command, that fetches a container image from a registry, executes podman pull instead. The docker build command executes podman build, etc.

Podman also features a Docker Open Source Engine compatible socket that can be launched via:

 ❯ sudo systemctl start podman.socket

The Podman socket can be used by applications designed to communicate with Docker Open Source Engine to launch containers transparently via Podman. The Podman socket can be used to launch containers via docker compose, without running Docker Open Source Engine.

One of the advantages of Podman over Docker Open Source Engine is that Podman can be configured to search multiple container registries. To make Podman search the SUSE Registry first and use Docker Hub as a fallback, add the following configuration to the /etc/containers/registries.conf file:

unqualified-search-registries = ["registry.suse.com", "docker.io"]

Note that this step can be skipped on SLE or openSUSE. On both distributions, SUSE Registry and registry.opensuse.org have priority over Docker Hub.

Using the podman search command allow you to list available containers in the registries defined in /etc/containers/registries.conf.

To search in all registries:

podman search go

To search in a specific registry:

podman search registry.suse.com/go

The podman pull command pulls an image from an image registry:

# podman pull <registry>[:<port>]/[<namespace>/]<name>:<tag>

For instance

# podman pull registry.suse.com/bci/bci-base

Note that if you do not specify a tag, the tag latest will be used.