Range-diff !304

back to !304 deploy: NoNewPrivileges=no so rootless podman can start