# Rootless Podman in unpriviliged LXC
add to LXC config
```
lxc.idmap: u 0 100000 200000
lxc.idmap: g 0 100000 200000
lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
```
Up the Sub User/Group ID's for root
/etc/subuid
```
root:100000:200000
```
/etc/subgid
```
root:100000:200000
```

# in the LXC
## Podman install
```
newuser=<UserName>
adduser <USERAME>
apt install podman podman-docker podman-compose ca-certificates passt libpam-systemd dbus-user-session catatonit nftables aardvark-dns uidmap
cp /usr/lib/tmpfiles.d/podman.conf /etc/tmpfiles.d/podman.conf
echo 'R! /tmp/storage-run-*/containers/' >> /etc/tmpfiles.d/podman.conf
echo 'R! /tmp/storage-run-*/libpod/tmp/' >> /etc/tmpfiles.d/podman.conf
loginctl enable-linger bram
```
Reboot the LXC
## Admin interface
### Use Cockpit
```
. /etc/os-release
echo "deb http://deb.debian.org/debian ${VERSION_CODENAME}-backports main" > /etc/apt/sources.list.d/backports.list
apt update
apt install -t ${VERSION_CODENAME}-backports cockpit cockpit-podman
```


### Use Dockhand
As the created user
```
systemctl --user --now enable podman.socket 
poedman run -d \
  --name dockhand \
  --restart unless-stopped \
  -p 3000:3000 \
  -v /run/user/1000/podman/podman.sock:/var/run/docker.sock \
  -v dockhand_data:/app/data \
  docker.io/fnsys/dockhand:latest
```

### Use as remote for Dockhand (podman socket over IP)
As the created user
```
systemctl --user --now enable podman.socket 
```

Edit `/usr/lib/systemd/user/podman.socket` as root
Replace
```
[Socket]
ListenStream=%t/podman/podman.sock
SocketMode=0660
```
with
```
[Socket]
ListenStream=0.0.0.0:2375
```
You can now add the enviroment as direct connection in dockhand