Even when running rootless, it’s always good practice to understand exactly what your container needs, and only give it those minimum permissions.