World map

 

BM

World D6: Under the Hood

Rootless mode and Podman

You will learn: why root in a container can be root on your laptop, and how rootless Docker and Podman shrink that risk.

Checked with Docker Engine 29 on 31 Oct 2026

The problem

By default, root inside a container is root on the laptop too. A bug lets an app break out of its box. What can it do?

Watch

Flip the User switch. Watch the uid on the laptop.

What it can see (namespaces)

  • User

    Inside: uid=0(root)

    On the laptop: uid=0 (root on the laptop too!)

    Docker uses this switch only in rootless mode, or with userns-remap.

Root inside now maps to uid 100000 outside. That is a user namespace: Root inside the container, an ordinary user on the laptop. Off in Docker unless you ask.. Docker leaves it off unless you ask.

Watch

bash
dockerd-rootless-setuptool.sh install
[INFO] Creating CLI context "rootless"
Successfully created context "rootless"
[INFO] Using CLI context "rootless"
Current context is now "rootless"

rootless mode: The Docker daemon and its containers run as you, not as root. A break-out gets only your rights. goes further. The Docker daemon itself runs as you, inside a user namespace. A break-out gets only your rights.

Predict

In rootless mode, you type docker run -d -p 80:80 nginx:1.30-alpine. What happens?

Try it

Podman runs the same images with no daemon at all. Run it as yourself, and it is rootless. Sort each one.

Drag a card into a box. Or tap the card, then tap the box.

        Check

        Safe habit, or needs work?

        Swipe right for good, left for needs work. Or use the buttons.

        1 / 4

        Run your app as a non-root USER inside the image.

        You did it!

        You can now explain how rootless Docker and Podman keep root out of reach.

        Go deeper (optional)

        Rootless needs newuidmap and newgidmap (the uidmap package) and 65,536 spare ids in /etc/subuid and /etc/subgid. Limits like --memory need cgroup v2 with systemd. Low ports need the tips page. For Podman, alias docker=podman covers most commands.

        Real mission

        2. grep ^$(whoami): /etc/subuid
        3. dockerd-rootless-setuptool.sh install
        4. docker info
        5. docker run --rm hello-world

        0 of 5 steps done · Your ticks are saved.