Rootful Podman Context

[rrajpuro]

The following VS Code setting only works for rootless Podman contexts:

"containers.containerClient": "com.microsoft.visualstudio.containers.podman"

Is there a way to modify this setting—or adjust the extension itself—so that it can work with rootful Podman as well?

Currently, attempting to use this with a rootful Podman setup (for example, when using macvlan networks or other root-only features) does not work, because the extension expects a rootless context and does not invoke sudo or connect to the rootful Podman socket (which I think has been deprecated since 1.23.0 in favour of CLI exclusively).

[bwateratmsft]

I haven't tried it, but you might be able to make it work using the containers.containerCommand setting. This will override the default used by the Podman client (which is just podman).

[rrajpuro]

I get the following error in the extension output

2025-09-11 01:24:24.008 [error] Failed to set up event listener: spawn sudo podman ENOENT

[bwateratmsft]

Ok, that makes sense--it's trying to start "sudo podman", as one executable--which does not exist. We almost exclusively use non-shell execution, so that rules out a shell script.

Honestly, I'm not really sure how to help this scenario. We cannot realistically start using sudo in the extension; it opens up some really big cans of worms.

[rrajpuro]

✅ Solution that worked for me with the Container Tools extension

The extension doesn’t run in a shell, so aliases and shell functions won’t work. I was able to make it work by introducing a wrapper script and configuring passwordless sudo.

1. Wrapper script
   Replace /usr/local/bin/podman with a script that invokes sudo podman-real:

   sudo mv /usr/local/bin/podman /usr/local/bin/podman-real
   sudo tee /usr/local/bin/podman >/dev/null <<'EOF'
   #!/bin/bash
   exec sudo /usr/local/bin/podman-real "$@"
   EOF
   sudo chmod +x /usr/local/bin/podman

2. Passwordless sudo
   Ensure both podman and podman-real can run without prompting for a password by updating sudoers:

   username ALL=(ALL) NOPASSWD: /usr/local/bin/podman, /usr/local/bin/podman-real
   

3. Extension settings
   Select Podman as the container runtime (either via the spanner 🔧 icon in the GUI or in settings.json):

   {
       "containers.containerClient": "com.microsoft.visualstudio.containers.podman",
       "containers.orchestratorClient": "com.microsoft.visualstudio.orchestrators.podmancompose"
   }

---

⚠️ Caveats

• This approach grants passwordless root access for Podman, which may be a security concern on multi-user systems.
• The wrapper script may need to be recreated after Podman updates.
• Rootless Podman is the preferred long-term approach if your workflow supports it, as it avoids sudo entirely.