# Rootless containers and managed TLS

> On main since rc2: Rootless containers and managed TLS.

Source: https://kern-lang.eu/releases/rootless-containers-and-managed-tls

On main since rc2

## Release notes

The container engine's full mode (host bridge, veth pairs, NAT, inter-container networking) now runs for a **non-root** launcher: `install-caps.sh` grants `cap_net_admin,cap_sys_admin` to the binary once, the Docker-daemon privilege model but daemonless, and every later run by any user gets full networking. True-rootless mode adds inbound port publishing, AppArmor userns profiles and cgroup delegation (box-validated on cgroups v2), and compose service DNS resolves container names in capability and rootless mode.

On the TLS side, kern ships an ACME v2 client (`net.acme`) that generates the PKCS#10 CSR and drives the Let's Encrypt exchange, and `serve_tls_managed(server, cert_path, key_path)` serves HTTPS from the resulting files, with `reload_tls_cert` to pick up a renewal without dropping the listener. HTTPS without a reverse proxy in front of it; the renewal loop is yours to schedule.