Add example that runs Caddy in the network namespace of rootless Podman. Use a systemd system service (configured with User=)

[eriksjolund]

Add an example that runs Caddy in a systemd system service that is configured with the systemd directive User=

This makes it possible to use Caddy as an HTTP reverse proxy for a rootless Podman custom network.
Caddy as well as the containers running in the custome network will be running rootless.
Systemd system manager (which runs as root) creates a socket for Caddy so there is no need to lower
the kernel parameter ip_unprivileged_port_start to use port 80 and 443.

Caddy should run in the network namespace of rootless Podman.

It looks like there are three possible alternative implementation ideas

• Alternative 1. use

  ExecStart=podman unshare --rootless-netns ...
  

• Alternative 2. use

   ExecStart=bash -c "exec nsenter \
      --preserve-credentials \
      --net=/proc/$(cat $XDG_RUNTIME_DIR/containers/networks/aardvark-dns/aardvark.pid)/ns/net \
      --user=/proc/$(cat $XDG_RUNTIME_DIR/libpod/tmp/pause.pid)/ns/user \
      --mount=/proc/$(cat $XDG_RUNTIME_DIR/libpod/tmp/pause.pid)/ns/mnt \
      /usr/local/bin/caddy run --environ --config /srv/caddy/Caddyfile"
  

• Alternative 3. use

  ExecStart=podman run --rm ...
  

  For details, see support User= in systemd for running rootless services containers/podman#20573
  Not officially supported by the Podman project.

Reference:

• How to set up a systemd system service (with `User=`) that runs a caddy executable without conmon and the OCI runtime  in the rootless podman network namespace? containers/podman#24626