float
Not necessarily. For networking, I wrote a bash script with just a few lines that creates and assigns a private networking namespace to a pod and sets up the default routes. That script is run by a systemd user instance and has the suid flag set. One could argue that it’s not rootless because of that but that’s just the moment when it’s starting. No performance impact and very robust. A lot better than the docker network bridges imho.
Even the root user has to use syscalls at the userspace/kernel boundary so there’s really no difference here. The slow part would be the userspace networking implementation (slirp4netns) which can be avoided. Btw, docker also supports rootless containers now. Personally I haven’t tried them yet but maybe that’s also an option if you prefer docker over podman.
No, but you can buy blocks (eg. 200GB) instead of time based subscription if you’re planning to download small amounts occasionally. There are good deals multiple times a year and they (usually) don’t expire.