CODEWITHSUNDEEP
linuxdockerfilecontainerspodman
19090gvaohda0
19090gvaohda0

Reputation: 11

podman inside podman: works only with "privileged" while it works without for the official podman image

I am trying to create a podman image that allows me to run rootless podman inside rootless podman. I have read https://www.redhat.com/sysadmin/podman-inside-container and tried to build an image analogous to quay.io/podman/stable:latest based on top of docker.io/python:3.10-slim-bullseye or docker.io/ubuntu:22.04, but somehow my images require --privileged which the quay.io/podman fedora-based image does not.

For reference, here what does work for quay.io/podman/stable:latest:

$ podman run --rm \
    --security-opt label=disable \
    --device /dev/fuse \
    --user podman \
    quay.io/podman/stable:latest podman info

prints the podman info and no warning/errors, also podman run hellow-world works inside the container as expected.

I have created a dockerfile for a debian/ubuntu-based image that allows running rootless podman inside. The dockerfile closely follows https://www.redhat.com/sysadmin/podman-inside-container and https://github.com/containers/podman/blob/main/contrib/podmanimage/stable/Containerfile and is shown at the bottom.

However, the resulting image (call it podinpodtest) does not work as expected:

$ podman run --rm \
    --security-opt label=disable \
    --device /dev/fuse \
    --user podman \
    podinpodtest podman info

results in Error: cannot setup namespace using newuidmap: exit status 1.

Adding --privileged makes the image work:

$ podman run --rm \
    --security-opt label=disable \
    --device /dev/fuse \
    --user podman \
    --privileged \
    podinpodtest podman info

correctly prints the podman info.

  1. Why does the debian/ubuntu based image require --privileged for running rootless podman inside of it?
  2. I do not want to run the image with --privileged – can the debian/ubuntu based image be fixed to work similarly to the quay.io/podman image?
#FROM docker.io/python:3.10-slim-bullseye
FROM docker.io/ubuntu:22.04

RUN apt-get update && apt-get install -y \
    containers-storage \
    fuse-overlayfs \
    libvshadow-utils \
    podman \
 && rm -rf /var/lib/apt/lists/*

RUN useradd podman; \
echo "podman:1:999\npodman:1001:64535" > /etc/subuid; \
echo "podman:1:999\npodman:1001:64535" > /etc/subgid;

ARG _REPO_URL="https://raw.githubusercontent.com/containers/podman/main/contrib/podmanimage/stable"
ADD $_REPO_URL/containers.conf /etc/containers/containers.conf
ADD $_REPO_URL/podman-containers.conf /home/podman/.config/containers/containers.conf

RUN mkdir -p /home/podman/.local/share/containers && \
    chown podman:podman -R /home/podman && \
    chmod 644 /etc/containers/containers.conf

# Copy & modify the defaults to provide reference if runtime changes needed.
# Changes here are required for running with fuse-overlay storage inside container.
RUN sed -e 's|^#mount_program|mount_program|g' \
           -e '/additionalimage.*/a "/var/lib/shared",' \
           -e 's|^mountopt[[:space:]]*=.*$|mountopt = "nodev,fsync=0"|g' \
           /usr/share/containers/storage.conf \
           > /etc/containers/storage.conf

# Note VOLUME options must always happen after the chown call above
# RUN commands can not modify existing volumes
VOLUME /var/lib/containers
VOLUME /home/podman/.local/share/containers

RUN mkdir -p /var/lib/shared/overlay-images \
             /var/lib/shared/overlay-layers \
             /var/lib/shared/vfs-images \
             /var/lib/shared/vfs-layers && \
    touch /var/lib/shared/overlay-images/images.lock && \
    touch /var/lib/shared/overlay-layers/layers.lock && \
    touch /var/lib/shared/vfs-images/images.lock && \
    touch /var/lib/shared/vfs-layers/layers.lock

ENV _CONTAINERS_USERNS_CONFIGURED=""

Upvotes: 1

Views: 1425

Answers (1)

ricardo martinez
ricardo martinez

Reputation: 91

I had the same issue. While installing docker I ran the following commands

grep "$USER" /etc/subuid >> /dev/null 2&>1 || (echo "$USER:100000:65536" | sudo tee -a /etc/subuid)
grep "$USER" /etc/subgid >> /dev/null 2&>1 || (echo "$USER:100000:65536" | sudo tee -a /etc/subgid)

This is taken from the docker documentation this for some reason added duplicate entries for my user in the files /etc/subgid and /etc/subuid. Once I got rid of the duplicate values both docker and podman were able to run in rootles mode

Upvotes: 0

Related Questions