Passing hw to rootless is hard. I think you’d need to match the groups inside the container to the host or make sure that the user can access the needed stuff from uid alone, as the group might not exist in the container and you end up groupless inside