Tutoriel Linux

Podman on Linux: run a container without giving root rights to the entire machine

Débutant4 min de lecture

You want to launch a testing service, a web tool, or a Linux image without adding your account to the docker group. Podman can run containers from a user session, with storage and processes tied to your UID. It’s convenient for starting cleanly, but it doesn’t obviate the need to control the image, volumes, or published ports.

Tux admin launches an isolated container near a Linux server with a padlock and container cubes
Podman can run containers from a Linux user session.

Install Podman and check rootless mode

On Debian or Ubuntu, install the package from your distribution’s repositories. Fedora also includes it in its standard repositories.

sudo apt update
sudo apt install podman
podman --version
podman info --debug

Then run podman info --debug with your usual account, without sudo. The output should indicate a rootless context. Podman then uses your user space and the ranges defined in /etc/subuid and /etc/subgid to map container IDs.

A message about newuidmap, subuid, or subgid indicates an incomplete setup. Do not bypass the error by switching directly to root. First, check your entry with the following command, then apply the method documented by your distribution if it is missing.

grep "^$USER:" /etc/subuid /etc/subgid

Run your first container without privileges

Start with a tiny image and a command that exits by itself. This way, you verify the image download, local storage, and execution without leaving an open service on the network.

podman run --rm docker.io/library/alpine:latest echo "Podman works"

The --rm option removes the container upon exit. The image remains cached. To view images and containers, including those that are stopped, use:

podman images
podman ps -a

For a service that needs to remain available, give it an explicit name. This example starts nginx in the background and publishes port 8080 only on the local machine.

podman run -d --name web-test 
  -p 127.0.0.1:8080:80 
  docker.io/library/nginx:alpine

podman ps
curl -I http://127.0.0.1:8080

The prefix 127.0.0.1: prevents exposing this test on all network interfaces. If you only write -p 8080:80, check the result with podman port web-test and with ss -ltnp. On a server, open a public port only after choosing the firewall and listening address.

Check the status, logs, and properly stop the service

A running container does not prove that the application is responsive. Check its status, the latest logs, and its network mapping before modifying the image or the configuration.

podman inspect web-test --format '{{.State.Status}}'
podman logs --tail 50 web-test
podman port web-test
podman stop web-test
podman rm web-test

podman inspect displays the parameters actually applied. It’s more reliable than re-reading a command copied from your history. Also, keep the image name and its tag in your documentation. A latest tag may point to a different version upon the next download. For long-lasting use, choose a specific version and plan its update.

The limits of rootless and traps to avoid

  • A rootless container limits impact on the host, but an unreliable image, a secret injected as a variable, or a writable volume remain risks.
  • Avoid --privileged, --network host, and mounts of sensitive directories. These options significantly reduce isolation.
  • Mount data as read-only when the application does not need to modify them, for example -v "$HOME/site:/usr/share/nginx/html:ro".
  • Ports below 1024, certain devices, and some network constraints require additional configuration. Do not add privileges by reflex.
  • Podman accepts much of the Docker syntax, but services, networks, and storage do not always behave the same way. Test a project in an isolated folder before migration.

The docker group often provides very broad access to the Docker daemon. Rootless Podman avoids this habit for containers launched from your account. To compare the installation of a Docker engine with this choice of rights, you can also re-read our guide on Docker on Debian.

The official documentation of Podman details how rootless operation works, and the podman run manual lists network, volume, and ID options. Start with a simple image, a local port, and a read-only volume. You will quickly know if Podman suits your needs before moving a useful service.

sudo apt update && sudo apt upgrade