diff --git a/Dockerfile b/Dockerfile
index 8359067..aa9ed16 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,13 +26,15 @@ RUN groupadd -r socks && useradd -r -g socks socks
 
 COPY ["./build-scripts/install-vpn-gui.sh", "./build-scripts/mk-qemu-wrapper.sh", "/tmp/build-scripts/"]
 
+COPY ./docker-root-preinst /
+
 ARG VPN_URL ELECTRON_URL USE_VPN_ELECTRON VPN_DEB_PATH
 
 RUN /tmp/build-scripts/install-vpn-gui.sh
 
 COPY ./docker-root /
 
-COPY --from=hagb/docker-easyconnect:build /results/fake-hwaddr/ /results/tinyproxy-ws/ /results/novnc/ /
+COPY --from=hagb/docker-easyconnect:build /results/fake-hwaddr/ /results/fake-getlogin/ /results/tinyproxy-ws/ /results/novnc/ /
 
 #ENV TYPE="" PASSWORD="" LOOP=""
 #ENV DISPLAY
diff --git a/Dockerfile.build b/Dockerfile.build
index f7363b4..30200d1 100644
--- a/Dockerfile.build
+++ b/Dockerfile.build
@@ -14,12 +14,14 @@ RUN . /tmp/build-scripts/config-apt.sh && \
     apt-get install -y --no-install-recommends --no-install-suggests ca-certificates \
                     busybox libssl-dev automake $go $ecgccpkg build-essential
 
-RUN mkdir results && cd results && mkdir fake-hwaddr tinyproxy-ws novnc
+RUN mkdir results && cd results && mkdir fake-hwaddr tinyproxy-ws novnc fake-getlogin && mkdir /tmp/src -p
 
 COPY fake-hwaddr /tmp/src/fake-hwaddr/
+COPY fake-getlogin /tmp/src/fake-getlogin/
 
 RUN . /tmp/build-scripts/get-echost-names.sh && \
-    cd /tmp/src/fake-hwaddr && CC=${ec_cc} make clean all && install -D fake-hwaddr.so /results/fake-hwaddr/usr/local/lib/fake-hwaddr.so
+    cd /tmp/src/fake-hwaddr && CC=${ec_cc} make clean all && install -D fake-hwaddr.so /results/fake-hwaddr/usr/local/lib/fake-hwaddr.so && \
+    cd /tmp/src/fake-getlogin && CC=${ec_cc} make clean all && install -D fake-getlogin.so /results/fake-getlogin/usr/local/lib/fake-getlogin.so
 
 # https://github.com/tinyproxy/tinyproxy/pull/211#issue-382736027
 ARG TINYPROXY_COMMIT=991e47d8ebd4b12710828b2b486535e4c25ba26c
diff --git a/build-scripts/install-vpn-gui.sh b/build-scripts/install-vpn-gui.sh
index 132818e..415d6fe 100755
--- a/build-scripts/install-vpn-gui.sh
+++ b/build-scripts/install-vpn-gui.sh
@@ -14,10 +14,18 @@ package_name=$(echo $(grep -Po '(?<=Package:).*' /DEBIAN/control)) &&
 { /DEBIAN/preinst || true ; } &&
 mkdir /var/lib/dpkg/info/$package_name &&
 for file in /DEBIAN/*; do
-	mv $file /var/lib/dpkg/info/$package_name.$(basename $file)
+	cp "$file" /var/lib/dpkg/info/"$package_name.$(basename $file)" &&
+	# workaround for aTrust scripts
+	cp "$file" /var/lib/dpkg/info/"$(basename $file)"
 done &&
 /var/lib/dpkg/info/$package_name.postinst &&
+for file in /DEBIAN/*; do
+	rm /var/lib/dpkg/info/"$(basename $file)"
+done &&
 rm -r /DEBIAN VPN.deb &&
+if [ -e /home/sangfor/ ]; then
+	chown sangfor:sangfor -R /home/sangfor/
+fi &&
 
 ln -fs /bin/false /usr/sbin/dmidecode &&
 
diff --git a/docker-root/usr/bin/loginctl b/docker-root-preinst/usr/bin/loginctl
similarity index 100%
rename from docker-root/usr/bin/loginctl
rename to docker-root-preinst/usr/bin/loginctl
diff --git a/docker-root/usr/local/bin/vpn-config.sh b/docker-root/usr/local/bin/vpn-config.sh
index 06c419e..5c010e1 100755
--- a/docker-root/usr/local/bin/vpn-config.sh
+++ b/docker-root/usr/local/bin/vpn-config.sh
@@ -71,7 +71,12 @@ case "$_VPN_TYPE" in
 		FORCE_OPEN_PORTS=54631
 		VPN_PROCS=aTrustAgent
 		vpn_daemon() {
-			fake-hwaddr-run $VPN_BIN/aTrustAgent --plugin plugin-daemon --plugin-cmd \| >/dev/null &
+			# aTrust 用 getlogin_r 或者 loginctl 来获取用于运行 54531 http 服务的非 root 用户：
+			# - 先尝试 getlogin_r，若获取到 root 则失败，服务无法启动（这是 podman 上无法启动服务的原因）；
+			# - 若获取不到则，使用 loginctl 等工具（已经过 hook，可以提供普通用户供 aTrust 使用，此为原本 docker 上的行为）。
+			# 此处使用 LD_PRELOAD 来让 getlogin_r 直接返回该普通用户，从而使 podman 也能够正常启动服务。
+			FAKE_LOGIN=sangfor LD_PRELOAD=/usr/local/lib/fake-getlogin.so LD_LIBRARY_PATH="$VPN_ROOT:$VPN_BIN:${LD_LIBRARY_PATH}" \
+				fake-hwaddr-run $VPN_BIN/aTrustAgent --plugin plugin-daemon --plugin-cmd \| >/dev/null &
 		}
 		vpn_ui() {
 			$VPN_UI --no-sandbox
diff --git a/fake-getlogin/Makefile b/fake-getlogin/Makefile
new file mode 100644
index 0000000..802ab95
--- /dev/null
+++ b/fake-getlogin/Makefile
@@ -0,0 +1,9 @@
+.PHONY: all clean
+
+all: fake-getlogin.so
+
+fake-getlogin.so: fake-getlogin.c
+	${CC} --shared -o fake-getlogin.so fake-getlogin.c -ldl -fPIC
+
+clean:
+	-rm fake-getlogin.so
diff --git a/fake-getlogin/fake-getlogin.c b/fake-getlogin/fake-getlogin.c
new file mode 100644
index 0000000..1650bd2
--- /dev/null
+++ b/fake-getlogin/fake-getlogin.c
@@ -0,0 +1,22 @@
+#define _GNU_SOURCE
+#include <string.h>
+#include <stdlib.h>
+#include <errno.h>
+
+int getlogin_r(char *buf, size_t bufsize) {
+  const char *login = getenv("FAKE_LOGIN");
+  if (!login)
+    return ENXIO;
+  size_t len = strlen(login);
+  if (len + 1 > bufsize)
+    return ERANGE;
+  strcpy(buf, login);
+  return 0;
+}
+
+const char *getlogin() {
+  const char *login = getenv("FAKE_LOGIN");
+  if (!login)
+    return 0;
+  return login;
+}