By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description
This PR introduces support for running the Pangolin stack in rootless Podman mode and allows users to configure custom HTTP/HTTPS ports during installation.
Key Changes:
Rootless Support: Added detection for rootless environments and adjusted container capabilities (conditionally disabling SYS_MODULE when rootless).
Configurable Ports: Users can now specify HTTP and HTTPS ports during the installation process, which are then correctly applied to the `docker-compose.yml
Host Prerequisite Checks: The installer now proactively checks for:
IP Forwarding (required for VPN routing).
wireguard kernel module (required on the host for rootless Gerbil).
/dev/net/tun access permissions.
Unprivileged port configuration (ip_unprivileged_port_start) for Podman.
UX Improvements: Added sudo-integration for host configuration tasks if the installer is run as a non-root user.
These changes make Pangolin more flexible for deployment on systems where root access is restricted or where standard ports (80/443) are already in use.
How to test?
Run as non-root: Execute the installer without sudo: go run install/main.go
Select Podman: Choose Podman when prompted.
Test Ports (Two Scenarios):
Scenario A (Standard Ports): Enter 80 / 443. Verify that the installer detects this and asks to configure net.ipv4.ip_unprivileged_port_start so
Podman can bind these low ports.
Scenario B (Custom Ports): Enter 8080 / 8443. Verify that the generated docker-compose.yml uses these ports instead of the defaults.
Verify Compose: Check the generated docker-compose.yml to ensure SYS_MODULE is omitted in rootless mode.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/2397
**Author:** [@arousalspoon204](https://github.com/arousalspoon204)
**Created:** 2/2/2026
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `feature/rootless-support`
---
### 📝 Commits (1)
- [`3bde5d6`](https://github.com/fosrl/pangolin/commit/3bde5d61bb0b952fce85eaf223fe06f83e5c4881) feat: Add support for rootless Podman execution
### 📊 Changes
**2 files changed** (+203 additions, -39 deletions)
<details>
<summary>View changed files</summary>
📝 `install/config/docker-compose.yml` (+9 -5)
📝 `install/main.go` (+194 -34)
</details>
### 📄 Description
## Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
## Description
This PR introduces support for running the Pangolin stack in rootless Podman mode and allows users to configure custom HTTP/HTTPS ports during installation.
### Key Changes:
* **Rootless Support:** Added detection for rootless environments and adjusted container capabilities (conditionally disabling `SYS_MODULE` when rootless).
* **Configurable Ports:** Users can now specify HTTP and HTTPS ports during the installation process, which are then correctly applied to the `docker-compose.yml
* **Host Prerequisite Checks:** The installer now proactively checks for:
* IP Forwarding (required for VPN routing).
* `wireguard` kernel module (required on the host for rootless Gerbil).
* `/dev/net/tun` access permissions.
* Unprivileged port configuration (`ip_unprivileged_port_start`) for Podman.
* **UX Improvements:** Added sudo-integration for host configuration tasks if the installer is run as a non-root user.
These changes make Pangolin more flexible for deployment on systems where root access is restricted or where standard ports (80/443) are already in use.
## How to test?
1. **Run as non-root:** Execute the installer without sudo: `go run install/main.go`
2. **Select Podman:** Choose Podman when prompted.
3. **Test Ports (Two Scenarios):**
* **Scenario A (Standard Ports):** Enter `80` / `443`. Verify that the installer detects this and asks to configure `net.ipv4.ip_unprivileged_port_start` so
Podman can bind these low ports.
* **Scenario B (Custom Ports):** Enter `8080` / `8443`. Verify that the generated `docker-compose.yml` uses these ports instead of the defaults.
4. **Verify Compose:** Check the generated `docker-compose.yml` to ensure `SYS_MODULE` is omitted in rootless mode.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/2397
Author: @arousalspoon204
Created: 2/2/2026
Status: ❌ Closed
Base:
main← Head:feature/rootless-support📝 Commits (1)
3bde5d6feat: Add support for rootless Podman execution📊 Changes
2 files changed (+203 additions, -39 deletions)
View changed files
📝
install/config/docker-compose.yml(+9 -5)📝
install/main.go(+194 -34)📄 Description
Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description
This PR introduces support for running the Pangolin stack in rootless Podman mode and allows users to configure custom HTTP/HTTPS ports during installation.
Key Changes:
SYS_MODULEwhen rootless).wireguardkernel module (required on the host for rootless Gerbil)./dev/net/tunaccess permissions.ip_unprivileged_port_start) for Podman.These changes make Pangolin more flexible for deployment on systems where root access is restricted or where standard ports (80/443) are already in use.
How to test?
go run install/main.go80/443. Verify that the installer detects this and asks to configurenet.ipv4.ip_unprivileged_port_startsoPodman can bind these low ports.
8080/8443. Verify that the generateddocker-compose.ymluses these ports instead of the defaults.docker-compose.ymlto ensureSYS_MODULEis omitted in rootless mode.🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.