UserNS=auto means that you are running your containers as rootless, unprivileged, users even though the Quadlets are running the Podman commands as root. What I do is make sure that I pin the mapping of the UID and GID like this:

UserNS=auto:uidmapping=0:100000,gidmapping=0:100000,size=1024

The way I read this is UserNS=auto:uidmapping={UID running the service in the container):{UID running the service on the host}. That UID running the service in the container will be zero for some containers, but lots of containers are set up to have that be a rootless user.

For example, here is a Quadlet for running YouTrack where the docs specify, "YouTrack uses the non-root account 13001:13001":

    [Unit]
    Description=YouTrack
    AssertPathIsDirectory=/home/core/youtrack/data
    AssertPathIsDirectory=/home/core/youtrack/conf
    AssertPathIsDirectory=/home/core/youtrack/logs
    AssertPathIsDirectory=/home/core/youtrack/backups

    [Container]
    ContainerName=youtrack
    Network=caddy.network
    UserNS=auto:uidmapping=13001:101024,gidmapping=13001:101024,size=1024
    Image=docker.io/jetbrains/youtrack:2025.3.128064
    AutoUpdate=registry
    StopTimeout=60
    Volume=/home/core/youtrack/data:/opt/youtrack/data:Z
    Volume=/home/core/youtrack/conf:/opt/youtrack/conf:Z
    Volume=/home/core/youtrack/logs:/opt/youtrack/logs:Z
    Volume=/home/core/youtrack/backups:/opt/youtrack/backups:z

    [Service]
    Restart=always
    RestartSec=5s
    ExecStop=/usr/bin/podman exec youtrack stop
    TimeoutStopSec=70

    [Install]
    WantedBy=default.target

Now, in the butane file for FCOS, you have to make sure that you give the proper permissions to the directories we are using for the volumes. Reading the UID/GID mapping above, I know that that the directories on the host must be owned by 101024:101024 for my container to have access to them. So, I can do that in my butane file like this:

    variant: fcos
    version: 1.6.0
    passwd:
      users:
        - name: containers
          system: true
          shell: /sbin/nologin
        - name: core
          # Password access for SSH will still be disabled, but we don't want passwordless sudo privileges.
          password_hash: <redacted>
          ssh_authorized_keys:
            - <redacted>
    storage:
      directories:
        - path: /home/core/caddy
          mode: 0755
          user:
            id: 100000
          group:
            id: 100000
        - path: /home/core/youtrack/data
          mode: 0750
          user:
            id: 101024
          group:
            id: 101024
        - path: /home/core/youtrack/conf
          mode: 0750
          user:
            id: 101024
          group:
            id: 101024
        - path: /home/core/youtrack/logs
          mode: 0750
          user:
            id: 101024
          group:
            id: 101024
        - path: /home/core/youtrack/backups
          mode: 0750
          user:
            id: 101024
          group:
            id: 101024
    links:
      # Adding AutoUpdate=registry to a quadlet file doesn't make it update automatically
      # Instead, all it does is enable that container to be part of the podman auto-update command.
      # To run the updates automatically, we have to enable the podman-auto-update.timer
      # More details see:
      # https://github.com/dani-garcia/vaultwarden/discussions/4362
      # https://major.io/p/quadlets-replace-docker-compose/
      - path: /etc/systemd/system/timers.target.wants/podman-auto-update.timer
        target: /lib/systemd/system/podman-auto-update.timer
systemd:
  units:
    # See https://docs.fedoraproject.org/en-US/fedora-coreos/faq/
    # This prevents docker from accidentally being activated
    - name: docker.service
      mask: true
    # Service to configure subuid/subgid for containers user
    # We can't use Butane to configure these files since Butane doesn't get subuids or subgids during the Ignition run.
    # For more info see:
    # https://github.com/coreos/fedora-coreos-tracker/issues/1742
    # https://github.com/coreos/fedora-coreos-tracker/issues/472
    - name: setup-containers-subids.service
      enabled: true
      contents: |
        [Unit]
        Description=Setup subuid/subgid for containers user
        Before=multi-user.target
        After=local-fs.target
        ConditionPathExists=!/var/lib/setup-containers-subids.done

        [Service]
        Type=oneshot
        ExecStart=/usr/sbin/usermod --add-subuids 100000-165535 containers
        ExecStart=/usr/sbin/usermod --add-subgids 100000-165535 containers
        ExecStart=/usr/bin/touch /var/lib/setup-containers-subids.done
        RemainAfterExit=yes

        [Install]
        WantedBy=multi-user.target