[jeremyfowers]

Supersedes #3764, which GitHub marked as merged while the container stack was being reordered. Same branch, same change, now sitting right on top of #3709. Sweet.

Spec Driven Development

This PR:

• fixes something and does not need a WG/RFC.
• is within the scope of WG:
• has approved RFC RFC: Support for OCI backends, especially the HaloGen, ROCmFPX, and NathanW containers from kyuz0 (Donato) #3585

Spec	Rollout step
Container backends spec, section lemond as a System Service	8 of 8: lemond.service with rootless Podman

Summary

File	Change
data/lemond.service.in	Drops NoNewPrivileges and RestrictNamespaces; sets XDG_RUNTIME_DIR=%t/lemonade; keeps LockPersonality, RestrictRealtime, ProtectSystem, ProtectHome, PrivateTmp
data/lemond-user.service.in	Drops all sandboxing options
contrib/debian/lemonade-server.postinst, src/cpp/postinst-rpm	Add lemonade to video and render; allocate its sub-UID/GID range past every existing range; skip allocation when nsswitch.conf has a subid: line
contrib/debian/control, src/cpp/CPackRPM.cmake	Recommends: podman
ContainerManager::check_setup()	Running as lemonade: fixes name lemonade and end with sudo systemctl restart lemond; adds the "Subordinate IDs allocated" check (getsubids)
docs/guide/configuration/container-backends.md	System-service setup

Finding	Evidence
In a user manager, LockPersonality/RestrictRealtime set NoNewPrivs	systemd-run --user -p LockPersonality=yes -p RestrictRealtime=yes: NoNewPrivs: 1
In a user manager, PrivateTmp/ProtectSystem map only the user's UID	systemd-run --user -p PrivateTmp=yes cat /proc/self/uid_map: 1000 1000 1
In a system service, seccomp options leave NoNewPrivs unset	systemd v259 context_has_no_new_privileges(): no NNP when the executor has CAP_SYS_ADMIN

Scope

• This PR addresses one clear issue or change.
• I reviewed the full diff myself before submitting.
• I removed unrelated local changes.
• I kept refactoring separate unless it is required for this change.

Testing

• The code change has been locally tested.

Testing details:

Check	Result
test_container_manager	system-service checks pass
ctest -L cpp-ci	74/74
Sub-UID allocation, run twice against sample /etc/subuid (alice 100000, bob 165536)	lemonade:231072:65536 in both files; second run changes nothing
.deb/.rpm install on a clean host, rootless Podman load under lemond.service	not run

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}