A Traefik 3 hardened nonroot image is workable on Podman when the process never assumes it can bind privileged ports or write wherever the rootful Docker path wrote. Map the websecure entrypoint to an unprivileged high port on the container, publish 443→that port on the host (or put a rootful redirector in front), and keep ACME storage plus dynamic config on volumes the nonroot uid can actually create and renew into. Socket-based providers need the API socket readable by that same uid; a root-owned Podman socket with 600 perms is a silent “no routers discovered” failure that looks like a Traefik bug until you check the mount and group.

Ops prove-out after the image or uid change: confirm the container user is nonroot, that the cert store path is writable from inside the container, that Host rules still match the public names clients dial, and that a deliberate upstream stop yields a clean 502 from Traefik rather than a hung dial. If routers vanish only under the hardened image, check socket ownership and the entrypoint port map before retuning middleware — most “nonroot broke Traefik” incidents are still capability, volume mode, or provider socket reachability, not the router DSL itself.