Open PedroRegisPOAR opened 2 years ago
Creating an environment to play inside:
cat > Containerfile << 'EOF'
FROM alpine:3.16.1
RUN apk add --no-cache \
ca-certificates \
curl \
shadow \
tar \
xz \
&& mkdir -m 0777 /nix
EOF
podman \
build \
--file=Containerfile \
--tag=unprivileged-alpine3161 .
VOLUME_DIR=code
rm -frv "$VOLUME_DIR"; test -d "$VOLUME_DIR" || mkdir -pv "$VOLUME_DIR"
echo
nix run nixpkgs#xorg.xhost -- +
podman \
run \
--annotation run.oci.keep_original_groups=1 \
--device=/dev/fuse:rw \
--device=/dev/kvm:rw \
--env="DISPLAY=${DISPLAY:-:0.0}" \
--env="HOME=${HOME:-:/home/someuser}" \
--env="PATH=/home/$USER/.nix-profile/bin:/home/$USER/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \
--env="TMPDIR=${HOME}" \
--env="USER=${USER:-:someuser}" \
--group-add=keep-groups \
--hostname=alpine-container \
--interactive=true \
--name=conteiner-unprivileged-alpine \
--privileged=true \
--tty=true \
--userns=keep-id \
--rm=true \
--volume="$(pwd)"/"$VOLUME_DIR":/home/"${USER}":U \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
--workdir=/home/"${USER}" \
localhost/unprivileged-alpine3161:latest \
sh \
-c \
'
id
echo
groups
echo
echo abcdefg > foo.txt
stat -c %u .
stat -c %u /home/"${USER}"
' \
&& stat -c %u "$VOLUME_DIR"/foo.txt
VOLUME_DIR=data
rm -frv "$VOLUME_DIR"; test -d "$VOLUME_DIR" || mkdir -pv "$VOLUME_DIR"
echo
# nix run nixpkgs#xorg.xhost -- +
podman \
run \
--annotation run.oci.keep_original_groups=1 \
--device=/dev/fuse:rw \
--device=/dev/kvm:rw \
--env="DISPLAY=${DISPLAY:-:0.0}" \
--env="HOME=${HOME:-:/home/someuser}" \
--env="PATH=/home/$USER/.nix-profile/bin:/home/$USER/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \
--env="TMPDIR=${HOME}" \
--env="USER=${USER:-:someuser}" \
--group-add=keep-groups \
--hostname=alpine-container \
--interactive=true \
--name=conteiner-unprivileged-alpine \
--privileged=true \
--tty=true \
--userns=keep-id \
--rm=true \
--volume="$(pwd)"/"$VOLUME_DIR":/home/"${USER}":U \
--volume=/tmp/.X11-unix:/tmp/.X11-unix:ro \
--workdir=/home/"${USER}" \
localhost/unprivileged-alpine3161:latest \
sh \
-c \
'
id
echo
groups
echo
echo abcdefg > foo.txt
stat -c %u .
stat -c %u /home/"${USER}"
' \
&& stat -c %u "$VOLUME_DIR"/foo.txt
'! [ "$(stat -c %u .)" = 0 ]; echo "$?"'
podman \
exec \
--interactive=true \
--tty=true \
--user=0 \
conteiner-alpine \
sh<<COMMANDS
apk add --no-cache \
ca-certificates \
curl \
shadow \
tar \
xz \
&& mkdir /nix && chmod 1777 /nix
COMMANDS
podman \
exec \
--interactive=true \
--tty=false \
--user=0 \
conteiner-alpine \
sh<<COMMANDS
ls -al /nix
mkdir -m 777 /nix
COMMANDS
Abstratc
It is an issue devoted to collect links/documentation about "volumes".
--uidmap
https://stackoverflow.com/a/65960072Details
WIP: