#rootless — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #rootless, aggregated by home.social.
-
I wrote some notes on my recent work deploying rootless containers https://blog.coderspirit.xyz/blog/2026/07/06/securing-services-with-rootless-containers/
Disclaimer: In case you find this post and don't know about me, I'm not an expert on the topic.
-
I wrote some notes on my recent work deploying rootless containers https://blog.coderspirit.xyz/blog/2026/07/06/securing-services-with-rootless-containers/
Disclaimer: In case you find this post and don't know about me, I'm not an expert on the topic.
-
Yesterday an automatic #DNF upgrade process prevented my #Podman 6 on #CentOS Stream from starting rootless containers properly.
Many new features came in with v6 and impacted my #rootless customizations - socket based activation, aardvark per-user DNS processes, etc.
Those are powerful features that put #Podman ahead of #Docker in many ways.
AI agents actually did not fully understand the problem, as the v6 just landed (together with #netavark v2 and aardvark-dns v2).
-
Yesterday an automatic #DNF upgrade process prevented my #Podman 6 on #CentOS Stream from starting rootless containers properly.
Many new features came in with v6 and impacted my #rootless customizations - socket based activation, aardvark per-user DNS processes, etc.
Those are powerful features that put #Podman ahead of #Docker in many ways.
AI agents actually did not fully understand the problem, as the v6 just landed (together with #netavark v2 and aardvark-dns v2).
-
Checking out bookmark service by @linkwarden
Local self-hosted with rootless Podman Quadlets.
-
Neuer Blog-Artikel
podman kennt keine Upgrade-Funktion wie docker? Brauchen wir auch nicht.
Im neuen howto machen wir aus einem pod einen sauberen systemd-service: startet beim booten, hält sich per auto-update selbst aktuell und rollt bei einem kaputten Image automatisch zurück.
Und alles rootless.
https://just-stuff.blog/podman-pod-automatisieren/
#Podman #Linux #SelfHosting #systemd #Container #FOSS #rootless
-
Neuer Blog-Artikel
podman kennt keine Upgrade-Funktion wie docker? Brauchen wir auch nicht.
Im neuen howto machen wir aus einem pod einen sauberen systemd-service: startet beim booten, hält sich per auto-update selbst aktuell und rollt bei einem kaputten Image automatisch zurück.
Und alles rootless.
https://just-stuff.blog/podman-pod-automatisieren/
#Podman #Linux #SelfHosting #systemd #Container #FOSS #rootless
-
Woo woo. I am now confident with the new wiki document rewrite and some quadlet file changes. Tested deployment on my local machine and VM, both official upstream and Glitch-Soc.
Mastodon Rootless Podman Quadlets
NEW: Simplified Version
#rootless #quadlets #quadlet #podman #mastodon #sysadmin #mastoadmin #mastodev #deployment
-
Woo woo. I am now confident with the new wiki document rewrite and some quadlet file changes. Tested deployment on my local machine and VM, both official upstream and Glitch-Soc.
Mastodon Rootless Podman Quadlets
NEW: Simplified Version
#rootless #quadlets #quadlet #podman #mastodon #sysadmin #mastoadmin #mastodev #deployment
-
RE: https://mastodon.social/@Mastodon/116765910384325070
To coincide with Mastodon's 4.6.0 release, I've updated the files and quick-start guide for deploying Mastodon version of rootless Podman Quadlets for anyone interested in self-hosting.
-
RE: https://mastodon.social/@Mastodon/116765910384325070
To coincide with Mastodon's 4.6.0 release, I've updated the files and quick-start guide for deploying Mastodon version of rootless Podman Quadlets for anyone interested in self-hosting.
-
Ad Astra - Engineering documentation & knowledge base for humanity's second chance
I make MediaWiki run on them... Quadlet.
#rootless #quadlets #podman #MediaWiki #local #development #sysadmin #homelab
-
Root в контейнере — это root на хосте? Разбираю особенности прав доступов в контейнерах Docker/Podman
Если назначить файлу владельца root на хосте — будет ли это тот же самый root внутри контейнера? Если на хосте существует пользователь gtosss — можно ли переключиться на него внутри контейнера и получить доступ к файлу? Если создать пользователя gtosss внутри контейнера и выдать ему права на файл — сможет ли хост обратиться к этому файлу под таким же пользователем? Большинство разработчиков знают, что контейнеры изолируют процессы. Но мало кто задумывается о том, что происходит с правами, когда например директория с хоста монтируется внутрь контейнера через volume (bind mount). Разобрал три конкретных сценария на Ubuntu с Docker и Fedora с Podman: как UID/GID влияют на доступ к файлам, почему root в контейнере может быть root на хосте и что с этим делает user namespace. Эксперименты, cli и доступные объяснения.
https://habr.com/ru/articles/1040300/
#Docker #Podman #Linux #UID #GID #user_namespace #bind_mount #SELinux #rootless #контейнеры
-
In part 2 of my macOS security internals series, I demystify System Integrity Protection (SIP), breaking down how the kernel enforces Apple-signed entitlements over POSIX root privileges, the mechanics of rootless.conf, and why the hardware always has the final veto.
Includes a small C program to audit your own CSR bitfield configuration.
Read the full deep dive here:
https://bytearchitect.io/macos-security/Apple-defences-SIP-and-APFS-(cont'd)/#macOS #infosec #cybersecurity #ReverseEngineering #XNU #AppleSecurity #Kernel #OSInternals #Rootless
-
In part 2 of my macOS security internals series, I demystify System Integrity Protection (SIP), breaking down how the kernel enforces Apple-signed entitlements over POSIX root privileges, the mechanics of rootless.conf, and why the hardware always has the final veto.
Includes a small C program to audit your own CSR bitfield configuration.
Read the full deep dive here:
https://bytearchitect.io/macos-security/Apple-defences-SIP-and-APFS-(cont'd)/#macOS #infosec #cybersecurity #ReverseEngineering #XNU #AppleSecurity #Kernel #OSInternals #Rootless
-
" #CopyFail has proven to be a great example to refer to when writing about #Podman implementation of #rootless #containers In this note I reproduce the exploit across distinct container configurations to try to understand the exposure of a compromised rootless container."
https://garrido.io/notes/podman-rootless-containers-copy-fail/
-
" #CopyFail has proven to be a great example to refer to when writing about #Podman implementation of #rootless #containers In this note I reproduce the exploit across distinct container configurations to try to understand the exposure of a compromised rootless container."
https://garrido.io/notes/podman-rootless-containers-copy-fail/
-
Podman rootless containers and the Copy Fail exploit
https://garrido.io/notes/podman-rootless-containers-copy-fail/
#HackerNews #Podman #rootless #containers #Copy #Fail #exploit #cybersecurity #containerization #tech #news
-
Podman rootless containers and the Copy Fail exploit
https://garrido.io/notes/podman-rootless-containers-copy-fail/
#HackerNews #Podman #rootless #containers #Copy #Fail #exploit #cybersecurity #containerization #tech #news
-
I wondered about #rootless containers (#Podman / #Docker and found explanations how this uses user namespaces, but I was missing explanation of interactions with other namespaces (you need root to create namespaces, to do that rootless?).
I then found https://rootless.vagmi.ca implementing rootless containers from scratch and explains it very well. The user_namespaces manpage is also good to read and fills in some missing bits: https://man.archlinux.org/man/user_namespaces.7.en
TL;DR of what I learned in followup. 1/3
-
I wondered about #rootless containers (#Podman / #Docker and found explanations how this uses user namespaces, but I was missing explanation of interactions with other namespaces (you need root to create namespaces, to do that rootless?).
I then found https://rootless.vagmi.ca implementing rootless containers from scratch and explains it very well. The user_namespaces manpage is also good to read and fills in some missing bits: https://man.archlinux.org/man/user_namespaces.7.en
TL;DR of what I learned in followup. 1/3
-
@jriou Indeed I migrated on a rainy weekend !
The main issued I got was: User Namespaces, Network and obviously DNS.
This blog help me understand the the difference with #docker behaviour by setting up some demo apps:
https://giacomo.coletto.io/blog/podman-quadlets/To experiment the #rootless mode: I followed: https://www.redhat.com/en/blog/rootless-podman-user-namespace-modes
-
@jriou Indeed I migrated on a rainy weekend !
The main issued I got was: User Namespaces, Network and obviously DNS.
This blog help me understand the the difference with #docker behaviour by setting up some demo apps:
https://giacomo.coletto.io/blog/podman-quadlets/To experiment the #rootless mode: I followed: https://www.redhat.com/en/blog/rootless-podman-user-namespace-modes
-
I'm still configuring my #alpinelinux + #cosmic desktop, and I realize I didn't want to install git in the main user-land on that computer, I'm being extra paranoid - and kind of petty. So I did whatever sane person would do:
- install #podman
- configure podman to be #rootless
- install #crun because rootless is not exactly what I really want
- install #toolbx
- install #git inside that isolated container
- profit -
I'm still configuring my #alpinelinux + #cosmic desktop, and I realize I didn't want to install git in the main user-land on that computer, I'm being extra paranoid - and kind of petty. So I did whatever sane person would do:
- install #podman
- configure podman to be #rootless
- install #crun because rootless is not exactly what I really want
- install #toolbx
- install #git inside that isolated container
- profit -
You might have noticed that I have spend some time in my Quadlets Repo, taking care of some Grafana stuff.
Took me a bit to understand it but I’m quite happy with the result.
Check it out if you’d like to deploy your Grafana instance with a few extras in your homelab!
#git #codeberg #monitoring #grafana #prometheus #NodeExporter #podmanexporter #tailscale #tailscaleexporter #podman #quadlet #quadlets #rootless
-
You might have noticed that I have spend some time in my Quadlets Repo, taking care of some Grafana stuff.
Took me a bit to understand it but I’m quite happy with the result.
Check it out if you’d like to deploy your Grafana instance with a few extras in your homelab!
#git #codeberg #monitoring #grafana #prometheus #NodeExporter #podmanexporter #tailscale #tailscaleexporter #podman #quadlet #quadlets #rootless
-
Talk almost ready – Chemnitz Linux Days, here we go! 💻🐧
Putting the final touches on my talk – tomorrow it’s time. ⏰
Chemnitz Linux Days 2026, I’m all set and excited to be there. 🙉
30+ slides on Podman in rootless mode in combination with Quadlets are ready – even though this topic really only scratches the surface. 📚
#chemnitzerlinuxtage #podman #rootless #linux #containers #quadlets
-
Tried to decide if I should look into #pasta instead of #slirp4netns. Looked at their webpage and found a long list of features. Nice.
Looked for a man page for the pasta command, but it was nowhere to be found on the webpage. Instead I could watch a 10 minutes long video showing 3 terminal windows and a window with a scrolling text explaining what happens in the terminal windows.
That is a thanks, but no thanks from me.
-
@Larvitz
I have almost the same set-up:
- without Selinux has I'm running on #arch but with #rootless containers.
For #traefik I activated #socket https://github.com/eriksjolund/podman-traefik-socket-activation/blob/main/examples/example1/traefik.containerThe next step for me will be to use #podman's secrets. Thanks to your article I discovered their existence!
-
@Larvitz
I have almost the same set-up:
- without Selinux has I'm running on #arch but with #rootless containers.
For #traefik I activated #socket https://github.com/eriksjolund/podman-traefik-socket-activation/blob/main/examples/example1/traefik.containerThe next step for me will be to use #podman's secrets. Thanks to your article I discovered their existence!
-
🚀Oh, the audacity! A #Rustacean attempts to reinvent the #ping wheel, only to discover that maybe, just maybe, hitting Google with "rootless ping" was too complex.🤔 But fret not, our hero has bravely deposited their groundbreaking discovery on #GitHub, saving us all from the dastardly clutches of... well, nothing. 🙄
https://bou.ke/blog/rust-ping/ #rootless #innovation #tech #humor #HackerNews #ngated -
🚀Oh, the audacity! A #Rustacean attempts to reinvent the #ping wheel, only to discover that maybe, just maybe, hitting Google with "rootless ping" was too complex.🤔 But fret not, our hero has bravely deposited their groundbreaking discovery on #GitHub, saving us all from the dastardly clutches of... well, nothing. 🙄
https://bou.ke/blog/rust-ping/ #rootless #innovation #tech #humor #HackerNews #ngated -
This error on one of my VMs with docker in rootless led me down a rabbit hole [1]:
```
Error response from daemon: failed to create task for container: Unimplemented: failed to start shim: start failed: unsupported shim version (3): not implemented
```I realized that updating a host with nested docker in rootless services can break them. The fix: Update your Ansible scripts!
[1]: https://du.nkel.dev/blog/2025-11-15_docker-rootless-ansible/
-
Архитектура Rootless Podman: Полное руководство по контейнерам
Контейнеры без root , где каждый процесс запускается от имени обычного пользователя . Как это работает? Как обычный пользователь может изолировать процессы, создавать сетевые пространства и управлять хранилищем без единой привилегии? Давайте разберемся, что скрывается за rootless Podman :)
https://habr.com/ru/articles/966384/
#podman #docker #security #linux #rootless #devsecops #devops #линукс #контейнеризация #containers
-
One does not simply use rootless … me with a rootless Podman walks into Mordor of CI and docker build anyway.
Just kidding! Rootless Podman containers, quadlets and systemd are truly amazing in 2025.
-
One does not simply use rootless … me with a rootless Podman walks into Mordor of CI and docker build anyway.
Just kidding! Rootless Podman containers, quadlets and systemd are truly amazing in 2025.
-
Developers self hosting their Forgejo instances, or using another instance and need to setup an actions runner may find this new blog post useful :blobcatderpy:
We setup a forgejo runner with rootless podman in fedora!
https://blog.hachem.dev/setting-up-forgejo-runner-in-a-fedora-server-with-rootless-podman/
-
Developers self hosting their Forgejo instances, or using another instance and need to setup an actions runner may find this new blog post useful :blobcatderpy:
We setup a forgejo runner with rootless podman in fedora!
https://blog.hachem.dev/setting-up-forgejo-runner-in-a-fedora-server-with-rootless-podman/
-
I really wish every #selfhost service would be made available as container without external dependencies by the projects themselves. Bonus points if the containers are #rootless for obvious security reasons. Many are. I can run my forgejo instance [1] that way, I run my Uptime Kuma instance [2] that way. I am looking at GotoSocial and Sharkey this weekend and will try to get them up and running the same way. @homelab
-
I really wish every #selfhost service would be made available as container without external dependencies by the projects themselves. Bonus points if the containers are #rootless for obvious security reasons. Many are. I can run my forgejo instance [1] that way, I run my Uptime Kuma instance [2] that way. I am looking at GotoSocial and Sharkey this weekend and will try to get them up and running the same way. @homelab
-
@techviator
Those 2 articles help me a lot to move from #docker to #rootless #podman
- Controlling access to rootless Podman for users:
https://www.redhat.com/en/blog/controlling-access-rootless-podman-users
- Understanding rootless podman's user namespace modes: https://www.redhat.com/en/blog/rootless-podman-user-namespace-modes/cc @Podman_io @rhatdan
-
@techviator
Those 2 articles help me a lot to move from #docker to #rootless #podman
- Controlling access to rootless Podman for users:
https://www.redhat.com/en/blog/controlling-access-rootless-podman-users
- Understanding rootless podman's user namespace modes: https://www.redhat.com/en/blog/rootless-podman-user-namespace-modes/cc @Podman_io @rhatdan
-
Running AI/ML/LLM workloads in immutable Linux OpenSuSE Kalpa Desktop with AMD GPUs using AMD ROCm in rootless distrobox:
https://jornfranke.codeberg.page/technology-tutorials/immutable-linux-neural-pc/#ai #ml #llm #immutablelinux #kalpadesktop #opensuse #rootless #distrobox #amd #rocm #ollama
-
Make your containers more secure! Learn how to migrate Rootful Docker setup to Rootless Docker in Debian and Ubuntu Linux step-by-step.
Read full guide here: https://ostechnix.com/rootless-docker-debian-ubuntu-linux/
#Docker #Rootless #Devops #Debian #Ubuntu #Virtualization #Security
-
So apparently you can run #proxmox in a #rootless #podman container. Seems worth fiddling with. Dont know if storage clusters etc will work. Network config requires a bit more work.
used #dockermox and just ran it the same in podman instead
https://github.com/rtedpro-cpu/dockermox
#linux #sysadmin #tech #fedora #virtualization #vm #containers #isthereanythingtheycantdo
-
I have just released a small #RustLang library for running commands as root as an unprivileged user - aka #rootless. 🦀
https://crates.io/crates/rootless-run/0.1.0
It has been created in the context of the #ALPM project to allow running commands using #fakeroot or #rootlesskit and paves the way for a simple Rust-based implementation.
In the future we plan to use it in the ALPM project to run commands that require root as unprivileged user.
