I need to run rootless Podman, and possibly Sarus, on standalone RHEL 9 systems and on RHEL 9 HPC nodes. Our CI jobs run through GitLab with the Jacamar custom executor, which impersonates the user who initiated each job by running it under that user's UID.
The problem is that these users are not interactively logged in when the jobs run, so they do not have a systemd user session or an XDG_RUNTIME_DIR. Rootless Podman therefore cannot operate normally. Enabling lingering with systemctl enable-linger for each account works around the issue, but managing that for more than 250 HPC users, plus users on several standalone systems, is not very practical.
Are there other recommended ways to provide the required systemd user environment for these CI jobs without enabling lingering individually for every user?
2 Answers
The commonly used workaround is still to enable systemd lingering separately for each user. There does not appear to be a simple global setting that automatically creates the required user manager and runtime environment for every account, so handling this at account-provisioning time may be the most practical approach.
Running the jobs under one shared service account could avoid managing hundreds of user sessions, but it would weaken isolation and make access to users’ data and privileges less secure. Per-user execution is safer when jobs must remain separated.
That separation is the reason the executor impersonates the initiating user. A single shared account would not provide an acceptable security boundary for these jobs.