With podman we can setup containers for being used for non root users by performing some simple steps:

Install required packages

dnf -y install slirp4netns fuse-overlayfs crun podman shadow-utils

Force the number of user namespaces (might be required on some environments):

echo "user.max_user_namespaces=28633" > /etc/sysctl.d/userns.conf
sysctl -p /etc/sysctl.d/userns.conf


Allows to define which resources are available1:

mkdir -p /etc/systemd/system/[email protected]

cat << EOF > /etc/systemd/system/[email protected]/delegate.conf
Delegate=cpu cpuset io memory pids

To verify it has been done correctly, logout and login with the user and execute:

cat "/sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.controllers"

The output will be: cpuset cpu memory pids

Set uids/gids

For user to do proper mapping on the containers2, we need to define non-overlapping ranges for our user, let’s say kni and store it in the files: /etc/subuid and /etc/subgid:

cat /etc/subuid
cat /etc/subgid

Ranges should not overlap with real users in the system, or the container

Wrap up

After following above steps, it should be possible to run containers with rootless users, we can verify we can get the ranges with:

podman run  --rm --cpus=0.42 --memory=42m --pids-limit 42 -w /sys/fs/cgroup docker.io/library/alpine cat cpu.max memory.max pids.max

The output should be something like:

42000 100000

Enjoy! (and if you do, you can Buy Me a Coffee )