summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2019-04-30 21:08:27 +0200
committerGitHub <noreply@github.com>2019-04-30 21:08:27 +0200
commit39c937ee450a4de7ab97c013d65157a3b39718b1 (patch)
tree690df528509d1a93ea76383213529e1a3a242fbf
parentc0d3c513097761d47775f008f4951d210382219b (diff)
parent6e3f300fd35679f9d3a416de31173212c0b99b4e (diff)
downloadpodman-39c937ee450a4de7ab97c013d65157a3b39718b1.tar.gz
podman-39c937ee450a4de7ab97c013d65157a3b39718b1.tar.bz2
podman-39c937ee450a4de7ab97c013d65157a3b39718b1.zip
Merge pull request #3038 from mheon/update_readme_rootless
Add details on rootless Podman to the readme
-rw-r--r--README.md10
1 files changed, 9 insertions, 1 deletions
diff --git a/README.md b/README.md
index da516fa0d..a5545bb36 100644
--- a/README.md
+++ b/README.md
@@ -29,7 +29,15 @@ This project tests all builds against each supported version of Fedora, the late
1. Further work on the podman pod command
1. Further improvements on rootless containers
-## [Shortcomings of Rootless Podman](https://github.com/containers/libpod/blob/master/rootless.md)
+## Rootless
+Podman can be easily run as a normal user, without requiring a setuid binary.
+When run without root, Podman containers use user namespaces to set root in the container to the user running Podman.
+Rootless Podman runs locked-down containers with no privileges that the user running the container does not have.
+Some of these restrictions can be lifted (via `--privileged`, for example), but rootless containers will never have more privileges than the user that launched them.
+If you run Podman as your user and mount in `/etc/passwd` from the host, you still won't be able to change it, since your user doesn't have permission to do so.
+
+Almost all normal Podman functionality is available, though there are some [shortcomings](https://github.com/containers/libpod/blob/master/rootless.md).
+Any recent Podman release should be able to run rootless without any additional configuration, though your operating system may require some additional configuration detailed in the [install guide](https://github.com/containers/libpod/blob/master/install.md).
## Out of scope