- Docker/OCI containers are not inherently secure; rootless containers are a key hardening measure.
- Rootless containers limit attack impact by ensuring any container escape lands as an unprivileged host user, not root.
- Rootless operation relies on user namespaces and subordinate UID/GID mappings (e.g., /etc/subuid).
- Podman is daemon-less by default, using systemd service units for rootless container management.
- Enable lingering for service users so rootless services run without an active login session.
- Example PostgreSQL container config includes UserNS=keep-id, Volume with :U, and PublishPort on a private IP.
- Example Anubis container config adds ReadOnly=true, NoNewPrivileges=true, and DropCapability=ALL.
- Commands like systemctl --user require XDG_RUNTIME_DIR and DBUS_SESSION_BUS_ADDRESS environment variables.
- Networking differences for rootless containers (privileged ports, source IP preservation, firewall) are deferred to a follow-up article.