The Reality of Rootless Containers

on YouTube ↗35m

" summary

Rootless containers use user namespaces with a 100000+ UID range (typically 65,536 slots) so UID0 inside maps to an unprivileged host UID, and root is a set of capabilities not just UID0. Podman forks into a userns and uses IDMAP mounts in 5.12 to avoid FUSE copies; networking often goes through userspace (slirp4netns) but Podman’s pasta is much faster. Resource limits require cgroup v2 delegation required or limits become a silent noop; privileged ports blocked (<1024) and host data/secrets remain exposed despite reduced blast radius.

AI-written summary · about

" chapters (12)

1. 0:00Introduction to rootless containers
2. 2:12Root is not UID zero
3. 5:27Five parts of rootless setup
4. 10:34UID mapping in rootless
5. 12:00File system performance
6. 13:44Cgroups v2 limitations
7. 14:46Networking throughput issues
8. 19:10Namespace creation demo
9. 24:25Root vs rootless comparison
10. 28:21Cgroups v1 silent failures
11. 31:30What rootless fixes and misses
12. 33:58Key takeaways and summary

" related talks

• 38mUnderstanding root inside and outside a containerScott McCarty · DevConf.CZ 2021
• 44mRootless containersAkihiro Suda, Giuseppe Scrivano · DevConf.CZ 2019
• 22mRun As “Root”, Not Root: User Namespaces In K8sMarga Manterola, Rodrigo Campos Catelin · KubeCon + CloudNativeCon North America 2022
• 30mThe Route To Rootless ContainersClaudia Beresford · Container Camp UK 2018
• 40mRootless Containers with PodmanSteven Ellis · Open Source Summit + Embedded Linux Conference + OSPOCon 2021
• 54mContainers unplugged: understanding user namespacesMichael Kerrisk · NDC TechTown 2019
• 19mRootless containers with PodmanSteven Ellis · Linux.conf.au 2021 Systems Administration Miniconf
• 32mThe Route To Rootless ContainersEd King, Julz Friedman · KubeCon + CloudNativeCon Europe 2018