Rootless podman

[alealexpro100]

Are there any plans to make it working under podman rootless?
Found errors:

• Samba provision does not work (this fix didn't work).
• PolKit does not work causing firewalld not configuring.

[pbrezina]

Hi, it would be nice to have, but I don't think it is currently possible. We are creating our own network so we have static addresses that we can use in DNS and as far as I know, this is not possible in rootless mode.

[alealexpro100]

Podman creates network without issues, but host cannot access to containers by IP addresses (it can be bypassed by using port forward).
Also, SSSD works incorrectly in rootless ipa container (su admin@IPA.TEST returns su: cannot set groups: Invalid argument), but it seems to be related here.

[pbrezina]

May I ask what is your intended use case for this project?

[alealexpro100]

Sorry for the late answer. I was trying to run it in rootless mode for CI on one machine using several pipelines. Rootless mode prevents possible causes of failed operations (like broken systemd), so that was the reason of using it.
VMs, unfortunately, are not effective (performance loss in 20%).

[rjeffman]

The main issue I found using rootless containers is that you only have a few subuid/subgid to map to each system. We're trying to do this in FreeIPA, and it's been a lot of fine tuning (still WIP) to get everyone happy with their ranges.

[alexey-tikhonov]

Also, SSSD works incorrectly in rootless ipa container (su admin@IPA.TEST returns su: cannot set groups: Invalid argument)

I'm not sure this has (had) anything to do with SSSD itself.

But this could be fixed by 211908d