Chapter 4. Rootless and privileged workloads
Red Hat Edge Manager supports both rootless and privileged application execution for the container and quadlet application types. Run workloads as rootless (non-root) where possible to reduce the attack surface and follow the principle of least privilege.
- Rootless workloads: Run with a non-root user and group. The agent validates that the specified user exists on the device before starting the workload. Use rootless for applications that do not require elevated privileges.
-
Privileged workloads: Run with elevated capabilities when explicitly required. Set
runAs: rootin the application specification only when the workload needs root or elevated access (for example, certain device drivers or system operations).
For container and quadlet application types, you have two options for user configuration:
-
Option 1 (Recommended): Run as a dedicated non-root user - Specify
runAs: flightctl(or another non-root user) in the application YAML so the workload runs under that user’s rootless Podman and systemd instance. You must create this user in the operating system image during the bootc build process. See Build a bootc operating system image for how to add user creation to your Containerfile. -
Option 2: Run as root - If
runAsis not specified for container or quadlet applications, they run under the root Podman and systemd instance. Use this only when the application requires elevated privileges.
For compose application types, runAs is not supported in the device specification. The Compose runtime on the device does not support runAs, and there is no downstream path that applies it from the specification, so any runAs value is ignored. The agent invokes Podman Compose under the root user.
Existing deployments that do not specify runAs remain compatible with earlier versions and continue to run with their current privileged behavior.
Migration from root-based deployments: To move to rootless where possible, set runAs: flightctl for applications that do not need elevated access. Ensure the user and group specified for the workload exist on the device. Existing privileged workloads continue to work without changes.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}