Podman rootless versus rootful on RHEL-family hosts: storage, subuid, and lingering

Goal

Understand the practical difference between rootless and rootful Podman on a RHEL-family host, inspect running containers, and keep a rootless service running after logout.

Prerequisites

Podman installed; root only for the rootful steps and for granting subordinate ID ranges.

Steps

1. Check basic host info, including whether the current invocation is rootless: podman info --format '{{.Host.Security.Rootless}}', or read the fuller podman info output for the store.graphRoot path.
2. Rootless storage lives under the invoking user's home, typically ~/.local/share/containers/storage (graph root) and ~/.config/containers/storage.conf for configuration; rootful storage defaults to /var/lib/containers/storage. Confirm the active path with podman info rather than assuming it.
3. List and inspect containers: podman ps (running only) / podman ps -a (all), and podman inspect <container> for full JSON detail including mounts, network namespace path and environment.
4. View logs: podman logs <container> (-f to follow).
5. Rootless containers map container UIDs to a range of unprivileged host UIDs owned by the invoking user, configured in /etc/subuid and /etc/subgid. Check first with grep <user> /etc/subuid /etc/subgid: useradd normally allocates a range for new users automatically. If none exists, grant one with sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 <user> (65,536 IDs; the useradd manual documents these files and options), then run podman system migrate as that user so running Podman state picks up the new mapping. A range is required before rootless Podman can map more than one ID into a container.
6. Rootless containers normally stop when the user's last session ends: the user's systemd instance is stopped then, and processes started from the session may be killed too (depending on logind's KillUserProcesses). To keep them running unattended, enable lingering: sudo loginctl enable-linger <user>. The loginctl manual documents enable-linger as enabling a user's systemd instance to start at boot and stay running without an active login.
7. Verify lingering: loginctl show-user <user> --property=Linger should report Linger=yes, and the flag file /var/lib/systemd/linger/<user> exists. Undo with sudo loginctl disable-linger <user>.

Expected result

podman info shows the expected rootless/rootful mode and storage path; a rootless container survives ssh logout once lingering is enabled and the container was started as a systemd-managed service (see the companion Quadlet article) rather than from an interactive shell job.

Limits and test basis

Subordinate ID ranges must not overlap between users sharing a host; do not rely on usermod to reject an overlapping range — compare /etc/subuid and /etc/subgid yourself before adding one. Enabling lingering starts the user's systemd instance at boot but does not by itself make a manually started foreground podman run survive logout — only unit-managed rootless services benefit.