**Update**: The guide on github has been updated and has addopted a different method. Notably, it:
A) still accomplishing my goal of avoiding running the process inside as root.
B) uses the linuxserver.io image rather than the syncthing/syncthing one (my method does not allow for the linuxserver.io image to run), the linuxserver one is based on alpine, I truly forget what the other one is based on.
An archived version of the guide I followed to create my setup has been placed bellow, the updated (and all subsequent version) can be found [here](https://mmarco94.github.io/linux-guides/immutable-os/syncthing)
I saw [this guide](https://web.archive.org/web/20220613082829/https://mmarco94.github.io/linux-guides/immutable-os/syncthing) discussing how to run Syncthing in a podman container on immutable OSes and decided to try and create a better solution that avoids running the process inside as root. I am new to podman and it's been a few years since I used docker so I am a novice in this side of system administration and I guess I am writing this as a "sanity check" for what I have done.
Below is the podman run arguments I used in place of the ones found in the article, I also manage it with systemd as shown in the article.
```
podman run -d \
--name=syncthing \
--hostname=syncpod \
--label io.containers.autoupdate=registry \
--userns keep-id \
-p 127.0.0.1:8384:8384 \
-p 22000:22000/tcp \
-p 22000:22000/udp \
-p 21027:21027/udp \
-v ~/.config/syncthing:/var/syncthing/config:Z \
-v ~/SyncedDirs/:/SyncedDirs:Z \
-v ~/SyncedDirs2/:/var/syncthing/SyncedDirs2:Z \
docker.io/syncthing/syncthing:latest
```
_Note: I feel the original guide does *not* explain what the :Z flag does very well, it should at least emphasize unknowing users that it is telling podman to change the SELinux label of a dir to match that of the container._
The notable changes in my arguments is the `--userns keep-id` option and switching from the linuxserver.io version to the syncthing image. The keep-id option from my understanding tells Podman to create a user namespace where the user and container map to the same UID:GID values. Allowing all files the container touches to still be used by me, the user. I had to switch from the linuxserver.io version to the syncthing official one because the former did not allow the `--userns keep-id` option to work (perhaps because it is based on Alpine Linux? I have to investigate more. It failed on running an add-user command if I recall)
_Below is an excerpt from a RedHat article describing the `--userns keep-id` option, square brackets are mine:_
## User namespace modes
I can change this default mapping using the –userns option, which is described in the podman run man page. This list shows the different modes you can pass to the –userns option.
* Key: "" (Unset) [Effectively what the original guide did]
Host user: $UID
Container user: 0 (Default User account mapped to root user in container.) (Default)
* Key: keep-id [What I am doing]
Host user: $UID
Container user: $UID (Map user account to the same UID within the container.)
[(Source)](https://www.redhat.com/sysadmin/rootless-podman-user-namespace-modes)
So far this method seems to work quite well, and has replaced the `syncthing` package I had layered for a while. Is this the best way to run it on an OS like Silverblue / Kinoite, or is there a more sensible route to go? Any feedback is appreciated!
Edit: Clarity and grammar, and some more detail in a few spots.
I think there’s an element of prestige people are missing. At least in my country there were online options prior to the pandemic even, they however lacked the prestige / name recognition that other institutions had. Keeping mandatory in-person classes is another way to maintain this prestige, a differentiating factor, from the other institutions.
I also have to agree with most of the comments here. From an instructional point of view online classes are lacking, they can be less engaging, and pedagogically neutered. And in fields with lots of laboratory work, it’s frankly impossible to get rid of at least part of the in-person educational component. Even for the humanities, having access to a large on-campus library of scholarly resources is integral to research.
In my personal experience I’ve been quite grateful to have access to a large archival collection, items that could not be shipped to remote students because they are too old to leave a temperature & humidity controlled environment. An online experience would prevent someone like me from doing some manuscript / original publication related research.
Now, I do think online options are helpful. ESPECIALLY for summer classes, where students may wish to retake a class while also moving away for summer work. But I do not think they should become the default, they should be an option where possible, but not the new normal.