0 Bootstrap a Rocky root - no root required uses unshare dnf.md

Bootstrap a Rocky root — no root required (uses unshare + dnf)

The snippet below bootstraps a minimal Rocky Linux root filesystem at "$HOME/path/to/rocky/root" while making it explicit that you do not need real root privileges on the host. It relies on Linux user namespaces so the process is mapped to root inside the namespace but runs as your unprivileged user on the host.

TARGET="$HOME/path/to/rocky/root"

# Create new userns / mount ns / pid ns and run the command inside (no real root required)
unshare --user --map-root-user --mount --pid --fork \
  dnf -y --installroot="$TARGET" \
    --setopt=install_weak_deps=False \
    --setopt=keepcache=True \
    --setopt=cachedir="$TARGET/var/cache/dnf" \
    --setopt=persistdir="$TARGET/var/lib/dnf" \
    --disablerepo='*' --enablerepo=baseos,appstream \
    install rocky-release rocky-gpg-keys basesystem bash coreutils shadow-utils procps-ng iproute

Why this is non-root-friendly

• unshare --user --map-root-user creates a user namespace that maps your unprivileged account to UID 0 inside that namespace. That lets the process perform operations that look like root inside the installroot without requiring the host's root.
• The mount and PID namespaces (--mount --pid) keep mounts and processes created during bootstrapping isolated from the host.
• Because the command runs as your regular user on the host, you avoid needing sudo or a root shell — provided your kernel allows unprivileged user namespaces.

What the dnf options do (short)

• --installroot="$TARGET" installs packages into the directory tree at $TARGET.
• --setopt=... keeps the install self-contained and avoids weak/optional dependencies.
• --disablerepo='*' --enablerepo=baseos,appstream restricts package sources to the Rocky repos you want.
• The package list (rocky-release, basesystem, bash, etc.) creates a minimal usable base.

Practical notes & caveats

• The host kernel must allow user namespaces. Some distributions disable unprivileged user namespaces for security; in that case a privileged approach (root or sudo) would be necessary.
• dnf and network access to Rocky repositories are required on the host.
• The created $TARGET is a minimal rootfs. To run a full system inside it (systemd, services), you’ll need extra setup: bind-mount /proc, /sys, /dev, configure cgroups, etc.
• If your host disables unprivileged mounts, some mount operations inside the namespace may fail — you may need additional capabilities or to run on a host that allows them.

Quick next steps

• Ensure the target exists: mkdir -p "$TARGET"

• Inspect/chroot (when appropriate):

  # If you need to chroot as real root or debug:
  sudo chroot "$TARGET" /bin/bash

• Use the rootfs as a container image base or further customize by installing additional packages.

Takeaway

This approach makes it clear from the title and the content: you can bootstrap a Rocky Linux root filesystem without real root privileges by leveraging user, mount, and PID namespaces — a safe, contained way to build minimal roots for containers, testing, or image-building.