Configuring Podman in Rootless Mode on Rocky Linux 9.8

Overview

Rootless Podman allows users to run containers without requiring root privileges. This improves system security by ensuring containers run under the user's own account rather than as the root user.

This guide explains how to configure Podman in rootless mode on Rocky Linux 9.8.

Prerequisites

• Rocky Linux 9.8
• A non-root user account
• Internet access (to install packages)
• Root or sudo access for initial configuration

Step 1: Install Podman

Update the system.

sudo dnf update -y

Install Podman and required packages.

sudo dnf install -y podman uidmap slirp4netns fuse-overlayfs

Verify the installation.

podman --version

Example:

podman version 5.x.x

Step 2: Configure Subordinate UID and GID

Rootless containers require subordinate user IDs and group IDs.

Check the current configuration.

cat /etc/subuid
cat /etc/subgid

If your user does not exist, add entries.

Example for user john:

john:100000:65536

If necessary, add them manually.

sudo usermod --add-subuids 100000-165535 john
sudo usermod --add-subgids 100000-165535 john

Verify.

grep john /etc/subuid
grep john /etc/subgid

Example output:

john:100000:65536

Step 3: Verify User Namespace Support

Run:

podman unshare cat /proc/self/uid_map

Expected output similar to:

         0       1000          1
         1     100000      65536

If this command succeeds, user namespaces are working correctly.

Step 4: Enable User Lingering (Optional but Recommended)

This allows user services and containers to continue running even after logout.

sudo loginctl enable-linger john

Verify.

loginctl show-user john

Look for:

Linger=yes

Step 5: Verify Rootless Podman

Run:

podman info

Verify the following:

rootless: true

You can also run:

podman info --format "{{.Host.Security.Rootless}}"

Expected output:

true

Step 6: Test Rootless Container

Run a simple container.

podman run --rm hello-world

Or:

podman run --rm quay.io/podman/hello

The container should execute successfully without sudo.

Step 7: Verify Storage Location

Rootless containers are stored under the user's home directory.

podman info --format "{{.Store.GraphRoot}}"

Example:

/home/john/.local/share/containers/storage

Step 8: Verify Runtime Directory

echo $XDG_RUNTIME_DIR

Example:

/run/user/1000

This directory is automatically created when the user logs in.

Step 9: Verify Networking

Rootless Podman uses slirp4netns or pasta.

Check networking backend.

podman info | grep networkBackend

Example:

networkBackend: netavark

Run a test container.

podman run --rm alpine ping -c 3 google.com

If ping succeeds, networking is working correctly.

Step 10: Test Port Forwarding

Start an Nginx container.

podman run -d \
  --name nginx \
  -p 8080:80 \
  docker.io/library/nginx

Verify.

curl http://localhost:8080

You should receive the Nginx welcome page.

Step 11: Configure Systemd User Services

Generate a systemd unit.

podman generate systemd \
    --new \
    --name nginx \
    --files

Move it to the user systemd directory.

mkdir -p ~/.config/systemd/user
mv container-nginx.service ~/.config/systemd/user/

Reload systemd.

systemctl --user daemon-reload

Enable the service.

systemctl --user enable container-nginx.service

Start the service.

systemctl --user start container-nginx.service

Check status.

systemctl --user status container-nginx.service

Step 12: Configure Registry Search

Edit:

~/.config/containers/registries.conf

Example:

unqualified-search-registries = [
    "docker.io",
    "quay.io"
]

Step 13: Configure Container Storage (Optional)

Create the configuration directory.

mkdir -p ~/.config/containers

Create:

~/.config/containers/storage.conf

Example:

[storage]
driver = "overlay"

[storage.options]
mount_program="/usr/bin/fuse-overlayfs"

Step 14: Verify Everything

Run:

podman info

Verify:

• Rootless = true
• Storage driver = overlay
• Network backend = netavark
• GraphRoot points to ~/.local/share/containers
• Runtime directory points to /run/user/

Useful Commands

List containers

podman ps

All containers

podman ps -a

List images

podman images

Pull an image

podman pull nginx

Remove a container

podman rm <container>

Remove an image

podman rmi <image>

View logs

podman logs <container>

Enter a running container

podman exec -it <container> /bin/bash

Common Troubleshooting

Error

cannot find mappings for user

Solution

Verify /etc/subuid and /etc/subgid contain entries for the user.

Error

cannot setup namespace

Solution

Verify uidmap is installed.

rpm -q uidmap

Error

fuse-overlayfs not found

Solution

Install the package.

sudo dnf install -y fuse-overlayfs

Error

slirp4netns not found

Solution

sudo dnf install -y slirp4netns

Error

permission denied

Solution

Verify:

echo $XDG_RUNTIME_DIR

and

podman info

The user should not be running Podman with sudo.

Best Practices

• Always run Podman as a non-root user.
• Enable user lingering if containers should continue running after logout.
• Keep Podman updated with the latest Rocky Linux packages.
• Use systemd user services for long-running containers.
• Store custom configuration under ~/.config/containers.
• Use named volumes instead of bind mounts whenever possible.
• Regularly prune unused images and containers.

Example:

podman system prune

Verify Rootless Installation Checklist

Conclusion

Podman rootless mode provides a secure container runtime by eliminating the need to run containers with root privileges. After completing the steps in this guide, users can safely build, run, and manage containers entirely from their own account while benefiting from improved isolation and reduced security risks.