this is incredible thank you very much, I will read through this once I have more energy lmao, this looks like okay dense content, very interesting

So far I’ve circumvented networking with different users by mapping everything through localhost, without stuff going outside the network, how would you connect say; a service running on user A, on network A, to a service running on user B, on network B?

So far I can’t imagine how to connect both, unless im doing some disgusting nftables hackery, which is an option I COULD take, just one I dont want to take.

Had no idea either of these existed, I usually let myself go at the applications themselves searching for a way to setup a minimal environment, so I often miss these kind of convenience tools, either cuz I dont look for them, or cuz im a stubborn bitch lol, will check these out, so thanks for ur input :)

Never delved into SELinux, honestly afraid (lazy) of navigating getting into yet another rabbit hole, but from the rest of the answers here, letting podman deal with isolation sounds like a better solution. tysm for ur input :)

its my larp an I get to decide how hellish I want my server to be!!! 😡

I had no idea you could just use the subids from their respective etc files, I just followed what the podman documentation recommends, I like that the containermapping ids like this is def much simpler than creating users per process, and probably less resource intensive. thanks for sharing ur input :)

I’m also afraid of SELinux, def the way of having a more secure system, but I reaaaaaaally dont wanna get to more docs on linux hahaha.

excellent solution, just have root container to --user and use the auto userns, had no idea about that, sounds super convenient. Much more self contained, just let the program do its thing, I had no idea about userns=auto with root, tysm for ur input!! :)