What I personally do is User=per-service-user ExecStart=!podman-wrapper ... where podman-wrapper passes `--user=1000:1000 --userns=auto:uidmapping=100

What I personally do is User=per-service-user ExecStart=!podman-wrapper ... where podman-wrapper passes `--user=1000:1000 --userns=auto:uidmapping=1000:$SERVICE_UID:1,gidmapping=1000:$SERVICE_GID:1` (where the UID/GID are set based on the $USER environment variable). Each container runs as 1000:1000 inside the container, which is mapped to the correct user on the host.