17.8. Running Podman with less privileges

Prerequisites

• The container-tools meta-package is installed.

Procedure

• Run two nested containers:

  $ podman run --name=unprivileged_podman --security-opt label=disable \
    --user podman --device /dev/fuse \
    registry.access.redhat.com/ubi10/podman \
    podman run ubi10 echo hello

• Run the outer container named unprivileged_podman based on the registry.access.redhat.com/ubi10/podman image.
• The --security-opt label=disable option disables SELinux separation on the host Podman. SELinux does not allow containerized processes to mount all of the file systems required to run inside a container.
• The --user podman option automatically causes the Podman inside the outer container to run within the user namespace.
• The --device /dev/fuse option uses the fuse-overlayfs package inside the container. This option adds /dev/fuse to the outer container, so that Podman inside the container can use it.
• Run podman run ubi10 echo hello command to create the inner container based on the ubi10 image.
• Notice that the ubi10 short image name was resolved as an alias. As a result, the registry.access.redhat.com/ubi10:latest image is pulled.

Verification

• List all containers:

  $ podman ps -a
  CONTAINER ID  IMAGE                            COMMAND               CREATED            STATUS                          PORTS   NAMES
  a47b26290f43               podman run ubi10 e...  30 seconds ago     Exited (0) 13 seconds ago               unprivileged_podman