podman run \
    --uidmap="0:$(id -u user):1" \
    --uidmap="1:$(grep -Po '(?<=^user:).*$' /etc/subuid | head -1)"

# Create a secret that will be used to make the IP addresses (which are
# calculated from the container name) unpredictable
touch /etc/rootful_network_secret \
    && chmod 600 /etc/rootful_network_secret \
    && dd if=/dev/urandom of=/etc/rootful_network_secret bs=1 count=32

# lingering is required for the unprivileged user
loginctl enable-linger test

# clone and install required scripts
git clone https://github.com/neverpanic/podman-rootful-network
install -m0755 \
    podman-rootful-network/rootful_network.py \
    /usr/local/sbin/rootful_network

# enable the podman socket for root
systemctl enable --now podman.socket

# create the podman network you want to use; rootless_network.py expects to
# have exclusive control over this network, so do not use it for any other
# containers
podman network create [--ipv6] "$networkname"

# enable the podman socket for the user
systemctl --user enable --now podman.socket

# create the runtime directory that will contain state information
runtimedir="/run/user/$(id -u)/container/$containername"
mkdir -p "$runtimedir"
# create the container, but do not start it
# the --cidfile will be used by rootful_network.py
podman create \
    --cidfile="$runtimedir/ctr-id" \
    --network=none \
    --name "$containername" \
    "$image:$tag"

# initialize the container namespaces, but do not start it
podman container init rootless

runtimedir="/run/user/1000/container/$containername"

rootful_network \
    "$runtimedir" \
    setup \
    "$name_used_to_generate_ip" \
    /etc/rootful_network_secret \
    "$unprivileged_user" \
    --network "$networkname" \
    [--publish [[ip:][hostPort]:]containerPort[/protocol]] \
    [--network-alias "$alias"]

podman start "$containername"

podman stop "$containername"

runtimedir="/run/user/1000/container/$containername"

rootful_network \
    "$runtimedir" \
    teardown

podman rm "$containername"