Merge pull request #4415 from rhatdan/rootless

Update rootless shortcomings with cgroup V2 information

1 files changed, 8 insertions, 7 deletions

diff --git a/rootless.md b/rootless.md
index 8cccb86eb..4fb3c7deb 100644
--- a/rootless.md
+++ b/rootless.md
@@ -6,6 +6,7 @@ Contributors are more than welcomed to help with this work.  If you decide to ca
 
 * Podman can not create containers that bind to ports < 1024.
   * The kernel does not allow processes without CAP_NET_BIND_SERVICE to bind to low ports.
+  * You can modify the `net.ipv4.ip_unprivileged_port_start` sysctl to change the lowest port.  For example `sysctl net.ipv4.ip_unprivileged_port_start=443` allows rootless Podman containers to bind to ports >= 443.
 * “How To” documentation is patchy at best.
 * If /etc/subuid and /etc/subgid are not setup for a user, then podman commands
 can easily fail
@@ -13,11 +14,11 @@ can easily fail
   * We are working to get support for NSSWITCH on the /etc/subuid and /etc/subgid files.
 * No cgroup V1 Support
   * cgroup V1 does not safely support cgroup delegation.
-  * However, cgroup V2 provides cgroup delegation and is available on Fedora starting with version 29 and other Linux distributions.
-* Some systemd's unit configuration options do not work in the rootless container
-  * systemd fails to apply several options and failures are silently ignored (e.g. CPUShares, MemoryLimit).
+  * As of Fedora 31 defaults to cgroup V2, which has full support of rootless cgroup management.  Note this requires the --cgroup-manager within rootless containers to use systemd, which new containers will get by default.
+* Some system unit configuration options do not work in the rootless container
+  * systemd fails to apply several options and failures are silently ignored (e.g. CPUShares, MemoryLimit). Should work on cgroup V2.
   * Use of certain options will cause service startup failures (e.g. PrivateNetwork).
-* Can not share container images with CRI-O or other users
+* Can not share container images with CRI-O or other rootfull users
 * Difficult to use additional stores for sharing content
 * Does not work on NFS or parallel filesystem homedirs (e.g. [GPFS](https://www.ibm.com/support/knowledgecenter/en/SSFKCN/gpfs_welcome.html))
   * NFS and parallel filesystems enforce file creation on different UIDs on the server side and does not understand User Namespace.
@@ -35,9 +36,9 @@ can easily fail
 * Requires new shadow-utils (not found in older (RHEL7/Centos7 distros) Should be fixed in RHEL7.7 release)
 * A few commands do not work.
   * mount/unmount (on fuse-overlay)
-     * Only works if you enter the mount namespace with a tool like buildah unshare
-  * podman stats (Without cgroup V2 support)
+     * Only works if you enter the mount namespace with podman unshare
+  * podman stats (Works with cgroup V2 support)
   * Checkpoint and Restore (CRIU requires root)
-  * Pause and Unpause (no freezer cgroup)
+  * Pause and Unpause (Works with cgroup V2 support)
 * Issues with higher UIDs can cause builds to fail
   * If a build is attempting to use a UID that is not mapped into the user namespace mapping for a container, then builds will not be able to put the UID in an image.