[jared-q15]

Summary

• add explicit and for bot/system users
• keeps as a system user (with linger), while enabling rootless Podman image unpack/chown
• uses a non-overlapping range () to avoid clashing with the owner user range

Why

Rootless Podman needs subordinate ID mappings. Without them, container image extraction fails with errors like:

Impact

• no change to human-user behavior
• fixes rootless container workflows for bot users (e.g. demo compose under )

[jared-q15]

Correct PR description (shell ate markdown backticks in initial body):

Summary

• add explicit subUidRanges and subGidRanges for bot/system users
• keep morbo as a system user (with linger), while enabling rootless Podman image unpack/chown
• use a non-overlapping range (200000:65536) to avoid clashing with the owner user range

Why
Rootless Podman needs subordinate ID mappings. Without them, container image extraction fails with errors like:

• potentially insufficient UIDs or GIDs available in user namespace
• requested 0:42 for /etc/shadow

Impact

• no change to human-user behavior
• fixes rootless container workflows for bot users (for example demo compose under morbo)