Are you running rootless or rootfull containers?

At least with rootless containers (I have not used roortfull) I think its quite pointless to create separate users for the services, as you could use just the subuids (and/or SELinux) to get container separation, as you already seem to do .

I run my quadlets with uidmap and gidmaps, so I get explicit control of the mappings. It can be a tad tedious at times but I think it’s worth the hassle.

Are you using one (system) user per quadlet? (Why?) Each of my quadlets is owned by the same (non-root) user and the containers are rootless. In that case, podman deals with (sub)id-allocation. selinux-labels take care of volume scopes and podman networks are as isolated as possible. Seems enough for me; never even considered using different users in that case.

You can use configuration management software like Ansible or Puppet. I wouldn’t write my own scripts when there are good Ansible modules.

I approach it the same as I did with Docker, one user per container.

I started with rootless but networking within Podman is moot with multiple users per container. And one user for all containers to get networking has to lead to subUID clashes (and thus escape vectors) - unless someone can explain how not…

But root Podman is just as secure anyway, and easier, so I just roll with UserNS=auto and use idmap= on the volumes to enable writing as the specified user for the container. And networking in Podman works because it’s one user space. By default UserNS=auto gives 1024 subUIDs to a container. I had to up that to the expected max of 65535 for Frigate to work (example bit I use with idmap, UserNS with the size and group mapping, and GroupAdd):

Volume=/mnt/camraz:/media/frigate:rw,noexec,nosuid,nodev,Z,idmap=uids=@1111-0-1;gids=@1111-0-1#1020-1020-1
UserNS=auto:size=65535,uidmapping=105:@105:1,gidmapping=105:@105:1
GroupAdd=105

So what’s going on here is on the Volume= I have the camera folder mounted to where Frigate wants it, and I specify that it accesses that volume with idmap= and frigate’s UID/GID 1111 and the camera group I made at GID 1020.

The order for the idmap is @${hostUID}-${containerUID}-${num2map}. The @ symbol means that 1111 is an absolute host UID; drop that and 1111 is pulled from the containers subUID/subGID list. Most containers run as root (0) so you just map to that user.

Side quest: For containers that have one of those mini-hypervisors like LinuxServers images and their “S6” thing, I worked around them starting with a root user but then requiring moving to a non-root user by specifying PUID=1 and PGID=1 then setting idmap=uids=@1999-0-2;gids=@1999-0-2 and reserving 1999 as username containerNameStartup and 2000 as containerName. This idmap= maps host 1999 to container 0 but maps two UID/GIDs consecutively, so it also maps host 2000 to container 1 keeping everything lined up perfectly - while LinuxServer images still don’t get host root like they so desperately want.

GroupAdd=105 adds in the group 105 to the container, which is notably not the host group 105. UserNS is needed to complete that. This just makes that group exist in the container.

UserNS=auto:size=65535,gidmapping=105:@105:1 accomplishes the subUID/subGID size allocation to the expected default max of 65535 (because Frigate needs it) and the group connection from host 105 to container 105. Note that this syntax helpfully uses the opposite order as idmap=. It goes ${containerUID}:@${hostUID}:${num2map} and uses colons instead of dashes.

Every other container is cool with the default 1024 (just UserNS=auto). The subUIDs are pulled from a non-existent user named containers that you need to enable for Podman root to work with UserNS, and it has like 2 million billion or something with their recommended setup, so it’s good on subUIDs/subGIDs.

Command to set up root Podman with UserNS=auto:

sudo echo "containers:2147483647:2147483648" >> /etc/subuid
sudo echo "containers:2147483647:2147483648" >> /etc/subgid

You can also have UserNS=auto and run the container as a specific host user directly instead of “nobody” with:

UserNS=auto:uidmapping=0:@1111:1,gidmapping=0:@1111:1

Same idea as how I mapped in the host group 105 above. Where the root user 0 is mapped to the host (via @) user 1111 so the container runs as the user. I don’t use that because the idmap= works perfectly and then the container doesn’t even run as the user that controls the files directly. But maybe there will be a use for that sometime(?).

And I do have a fuckton of users; Debian once complained it ran out of numbers or something after like 20 users, so I just ran the first thing I found to make the UID limit some really big number, and I never thought about it again! No idea what it was..

*Edit: * I cleaned it up and added examples

Also I mostly work with UIDs not users per-say, so I specify UID 1111 has access to Frigate files. I just make a user named frigate to make it a bit easier for me.

I don’t understand why you people over complicate your lives by over engineering shit at home.

I setup custom bash scripts eons ago to handle all my subuid/gid and networking stuff, and I’m on the road now, so getting into the code is harder. If I have time tonight, I’ll reply back with how I did it for rootless.

I run everything in rootless podman with quadlets. Be prepared for the docker die-hard crowd to tell you podman is inferior, but it really isn’t. At least not in my 10ish years using it. Is it harder to get going? Sure, but the extra abstraction layer for security is worth it imo.

I have to get ready to update my scripts for the podman 6.0 changes upcoming, but otherwise they pretty much run themselves. Systemd gets a lot of hate sometimes, but when you get it working, it’s pretty much automated.

Want to have program x run after condition y. Use targets, sockets or a small monitor service. I have encrypted volumes that require me to enter the unlock password before they will unlock, the services will just wait until that is done.

Networking and permission issues? Run a pod. Podman unshare is also your friend.

The biggest thing I found getting everything figured out is the lack of step-by-step instructions on how it all works. The docs help, but can be a bit confusing/ambiguous at times.

Feel free to dm me if you have a specific question and I’d be glad to try and help. Just might be a bit delayed on responses for the next bit while I’m travelling.