diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2019-04-30 21:08:27 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-04-30 21:08:27 +0200 |
| commit | 39c937ee450a4de7ab97c013d65157a3b39718b1 (patch) | |
| tree | 690df528509d1a93ea76383213529e1a3a242fbf | |
| parent | c0d3c513097761d47775f008f4951d210382219b (diff) | |
| parent | 6e3f300fd35679f9d3a416de31173212c0b99b4e (diff) | |
| download | podman-39c937ee450a4de7ab97c013d65157a3b39718b1.tar.gz podman-39c937ee450a4de7ab97c013d65157a3b39718b1.tar.bz2 podman-39c937ee450a4de7ab97c013d65157a3b39718b1.zip | |
Merge pull request #3038 from mheon/update_readme_rootless
Add details on rootless Podman to the readme
| -rw-r--r-- | README.md | 10 |
1 files changed, 9 insertions, 1 deletions
@@ -29,7 +29,15 @@ This project tests all builds against each supported version of Fedora, the late 1. Further work on the podman pod command 1. Further improvements on rootless containers -## [Shortcomings of Rootless Podman](https://github.com/containers/libpod/blob/master/rootless.md) +## Rootless +Podman can be easily run as a normal user, without requiring a setuid binary. +When run without root, Podman containers use user namespaces to set root in the container to the user running Podman. +Rootless Podman runs locked-down containers with no privileges that the user running the container does not have. +Some of these restrictions can be lifted (via `--privileged`, for example), but rootless containers will never have more privileges than the user that launched them. +If you run Podman as your user and mount in `/etc/passwd` from the host, you still won't be able to change it, since your user doesn't have permission to do so. + +Almost all normal Podman functionality is available, though there are some [shortcomings](https://github.com/containers/libpod/blob/master/rootless.md). +Any recent Podman release should be able to run rootless without any additional configuration, though your operating system may require some additional configuration detailed in the [install guide](https://github.com/containers/libpod/blob/master/install.md). ## Out of scope |