1.6. Special considerations for rootless containers

There are some system features you cannot change without root privileges. For example, you cannot change the system clock by setting a SYS_TIME capability inside a container and running the network time service (ntpd). You have to run that container as root, bypassing your rootless container environment and using the root user’s environment. For example:

# podman run -d --cap-add SYS_TIME ntpd

Note that this example allows ntpd to adjust time for the entire system, and not just within the container.

A rootless container cannot access a port numbered less than 1024. Inside the rootless container namespace it can, for example, start a service that exposes port 80 from an httpd service from the container, but it is not accessible outside of the namespace:

$ podman run -d httpd

However, a container would need root privileges, using the root user’s container environment, to expose that port to the host system:

# podman run -d -p 80:80 httpd

The administrator of a workstation can allow users to expose services on ports numbered lower than 1024, but they should understand the security implications. A regular user could, for example, run a web server on the official port 80 and make external users believe that it was configured by the administrator. This is acceptable on a workstation for testing, but might not be a good idea on a network-accessible development server, and definitely should not be done on production servers. To allow users to bind to ports down to port 80 run the following command:

# echo 80 > /proc/sys/net/ipv4/ip_unprivileged_port_start