Hi,
I am looking for some guidance on how to securely containerize an application that depends on the `CAP_SYS_NICE` capability to work.
Outside of the container world, one would probably just set the capability on the binary so that a non-privileged user could run it :
```
$ my_app
Error!
$ sudo setcap 'cap_sys_nice+ep' my_app
$ my_app
Success!
```
When working with containers, the easiest solution would be to execute Podman as root with the `--cap-add` parameter :
```
$ sudo podman run --rm --cap-add "sys_nice" -v "$PWD/my_app:/my_app" fedora:34 /my_app
Success!
```
A somewhat more secure option would consist in switching to a non-privileged user with the `--user` parameter :
```
$ sudo podman run --rm --cap-add "sys_nice" -v "$PWD/my_app:/my_app" --user nobody fedora:34 /my_app
Success!
```
Now, in order to mitigate potential container-breakout vulnerabilities, I would like to go a bit further and set up a rootless container.
I have recently learned about ambient capabilities and I have started experimenting with the `capsh` command. This seems to work :
```
$ sudo capsh --caps="cap_sys_nice+eip cap_setpcap,cap_setuid,cap_setgid+ep" --keep=1 --user="${USER}" --addamb=cap_sys_nice -- -c ./my_app
Success!
```
But this does not (the ambient capability is not set in the container and `strace` indicates that the `setpriority` system call fails with a `Permission denied`) :
```
$ sudo capsh --caps="cap_sys_nice+eip cap_setpcap,cap_setuid,cap_setgid+ep" --keep=1 --user="${USER}" --addamb=cap_sys_nice -- -c "HOME=${HOME} podman run --rm --cap-add sys_nice -v $PWD/my_app:/my_app fedora:34 /my_app"
Error!
```
Is this a podman limitation (Could it be improved?)? Is there a better approach?
Thank you,
Vincent Quéméner.