The container that ran fine until the machine rebooted — cheat sheet

# the account
grep USER /etc/subuid /etc/subgid                      # a subordinate range must exist
usermod --add-subuids 100000-165535 --add-subgids 100000-165535 USER ; podman system migrate
podman unshare cat /proc/self/uid_map                  # what the namespace actually maps
loginctl enable-linger USER                            # user manager at boot, no login needed
loginctl show-user USER -p Linger -p State
sudo -iu USER env XDG_RUNTIME_DIR=/run/user/$(id -u USER) systemctl --user …

# running
podman run -d --name NAME -p 8080:8080 -v /srv/site:/www:Z IMAGE CMD
podman ps -a ; podman logs NAME ; podman exec NAME CMD ; podman rm -f NAME
podman run --init …                                    # a real PID 1 that forwards signals (Quadlet: RunInit=true)
# :Z private label (container_file_t + this container's MCS pair)   :z shared label

# SELinux and ports
ls -Zd /srv/site ; ausearch -m avc -ts recent          # the denial names container_t and the file type
sysctl net.ipv4.ip_unprivileged_port_start             # 1024: rootless cannot publish below it

# Quadlet
# ~/.config/containers/systemd/NAME.container     (user)   /etc/containers/systemd/  (system)
# [Container] Image= Exec= PublishPort= Volume=   [Service] Restart=   [Install] WantedBy=default.target
systemctl --user daemon-reload ; systemctl --user start NAME ; systemctl --user status NAME
systemctl --user cat NAME                              # the generated unit
# do NOT systemctl --user enable it: "transient or generated"

# storage
podman volume create NAME ; podman volume inspect NAME --format '{{.Mountpoint}}'
podman info --format '{{.Store.GraphRoot}}'            # per user: ~/.local/share/containers/storage