Why must I enable kernel.unprivileged_userns_clone=1 to build?

[dougg0k]

Why must I enable kernel.unprivileged_userns_clone=1 to build from source? https://podman.io/docs/installation#building-from-source

I read that it is unsafe to do so. Is it only to build or podman requires it to be permanently enabled?

https://security.stackexchange.com/questions/209529/what-does-enabling-kernel-unprivileged-userns-clone-do

[rhatdan]

It should only be needed to use rootless mode, if you don't want to use userns then run in rootful mode.

[dougg0k]

So, to make one thing safer you have to make another unsafe? What is the reasoning on that?

[rhatdan]

Podman/Buildah rely on User Namespace, the entire linux world now enables it by default. if you choose to disable it then you can not use tools that need user namespaces. This is not a choice this is reality.

[dougg0k]

I suppose something like this could make it more controllable, per app, rather than enabling in the whole system.

https://discourse.ubuntu.com/t/spec-unprivileged-user-namespace-restrictions-via-apparmor-in-ubuntu-23-10/37626/1

https://apparmor.net/