Add use rootless page

[zeehio]

Tagging @cboettig since he suggested me to write something here

I have a solution for running the container rootless:

• Better support for rootless containers rocker-versioned2#636

There are many advantages on rootless containers, the main one being security.

The main caveat with rootless containers is when we want to map additional groups to the container (for instance when we have an additional group that owns a "shared_data" directory we want to access). In that case, we still need to learn quite a bit about id mapping. I've done my best to explain how things work and to provide a step by step guide in this pull request.

Hopefully this will eventually be simplified. It may be that I have overlooked something

• Rootless managing of additional host groups containers/podman#18333

I guess we can wait some days to see how the issue evolves. It may be that I've missed something and my solution is overly complicated or that some feature needs to land in podman to simplify additional group management.

English is not my primary language. I would appreciate feedback or change in wordings.

Besides I've been writing this for too long. I may need to take some time to get some perspective and re-read it again, but I believe it is worth a first read.

[eitsupi]

Thanks for contributing!

Linter seems blaming on some white spaces.

[cboettig]

Thanks for doing this @zeehio, we appreciate the contribution.

I'll leave this open while we resolve the discussion over at rocker-org/rocker-versioned2#636. Thanks for the link to containers/podman#18333, I don't follow the details there but seems to have momentum so we can see what comes out of that as well. @agila5 @hute37 or others using rootless docker -- your thoughts are welcome on these docs as well!

[hute37]

Just a note ...

Now I'm busy configuring a working rootless podman setup with full CUDA support.

I'm interested in CRAN keras setup in pyenv/poetry tensorflow environment.

Some references here:

• Supportin multiple CUDA versions? (CUDA bumps to 11.8 on the 4.2.2 images)
• environment PATH inconsistency among s6/rstudio, R, bash execution contexts

[hute37]

In the original issue:

• How to share files between rstudio/rocker and external folders with podman

There is some comment useful for documentation about process/filesystem uid/gid mapping

[eitsupi]

@hute37 Thanks for comments!

It seems that the issues you linked to still exist, but I have merged rocker-org/rocker-versioned2#636 and would like to merge this PR and see what happens.
Please let me know if there are any problems.

[zeehio]

Just to give you an update on this issue.

It may be that podman reviewers do not like my implementation, or that it does not get enough attention to make it to the end. But I'll do my best.

This is my ideal roadmap, with checks where "it's done":

• Define and agree on how additional group mapping usability could be improved in rootless podman (Rootless managing of additional host groups containers/podman#18333)
• Provide a pull request with a functional implementation (Mapping improvements to add additional groups containers/podman#18713)
• With Documentation (help pages, rootless tutorial improvements)
• With Unit testing (work in progress)
• Get the pull request reviewed and merged
• Get a new podman version released
• Update this webpage with simpler instructions for newer podman versions

The simpler instructions will be:

# Get the group id you want to use inside the container:
$ getent group mygroup
mygroup:x:2000:youruser1,user2,user3
# The group id for mygroup is 2000

# Subordinate that group to your user: (just once)
$ sudo usermod --add-subgids "2000-2000" $USER

# Run podman:
$ podman run  \
  --rm  \
  -v /shared_dir:/shared_dir \
  --group-add keep-groups \
  --gidmap "+g102000:@2000" \
  rocker/rstudio

[hute37]

I read the page, It looks good.

---

About group data sharing

I'm not and expert here, but maybe Podman Volumes could provide a more natural support.

In labs, where I can freely manage user accounts, I tried a different approach, setting data group as "primary" group and swapping default group (same name as userid) as an alternate user group.
Homes are kept with user:user ownership and 750 mode

---

About documentation,
please consider adding a "References" section with links to external resources:

• Docker security issues

For default podman group membership mapping:

• Using files and devices in Podman rootless containers
• Sharing supplemental groups with Podman containers

Dan Walsh's Blog:

• Enable Sysadmin - Dan Walsh
• Enable Sysadmin/_Containers

For CUDA support:

• NVIDIA Container Toolkit - Installation Guide
• Using Nvidia GPUs in Podman containers in Fedora 37