podman machine init fails if name collides with existing user ssh key

[tmoschou]

Issue Description

On MacOS M1, creating a QEMU machine with podman machine init <name> will fail if user generated key ~/.ssh/<name> already exists.

Although the default name is fairly specific (podman-machine-default) and unlikely to clash with other keys, others may not be (E.g. test).

Podman should not be creating keys in ~/.ssh/* anyway but should be saving them in its config directory ~/.config/containers/podman/... as users should be using podman machine ssh <name> to ssh into the box and not invoking ssh command directly.

For comparison, minikube when using the qemu driver, writes SSH keys to ~/.minikube/machines/<name>/id_rsa{,.pub}. Vagrant also does something similar if I recall.

Ideally all per-machine configuration and data (json config, ignition file) should be written to a folder with the name of the machine, i.e.

~/.config/containers/podman/machines/<name>/`
~/.local/share/containers/podman/machines/<name>/`

but I note this is not currently the case (for qemu VMs at least) using a mixture of both prefix naming and directory naming.

~/.ssh/<name>
~/.ssh/<name>.pub
~/.config/containers/podman/machine/qemu/<name>.ign
~/.config/containers/podman/machine/qemu/<name>.json
~/.local/share/containers/podman/machine/qemu/<name>_fedora-coreos-37.20230205.2.0-qemu.aarch64.qcow2
~/.local/share/containers/podman/machine/qemu/<name>_ovmf_vars.fd
~/.local/share/containers/podman/machine/<name>/podman.sock

Is this a problem if <name> is qemu ?

Also note that deleting the machine doesn't actually delete the ~/.local/share/containers/podman/machine/<name> directory.

Steps to reproduce the issue

Steps to reproduce the issue

1. pre-create ssh public/private key ssh-keygen -N "" -t ed25519 -C 'Manually created' -f ~/.ssh/test
2. init machine podman machine init test

Describe the results you received

❯ podman machine init test
Extracting compressed file
Error: key generation failed, unable to read from stderr: exit status 1

Describe the results you expected

Machine created successfully. And ssh key generation does not pollute ~/.ssh folder

podman info output

❯ podman version
Client:       Podman Engine
Version:      4.4.1
API Version:  4.4.1
Go Version:   go1.19.5
Git Commit:   34e8f3933242f2e566bbbbf343cf69b7d506c1cf
Built:        Thu Feb  9 05:33:18 2023
OS/Arch:      darwin/arm64

Server:       Podman Engine
Version:      4.3.1
API Version:  4.3.1
Go Version:   go1.19.2
Built:        Sat Nov 12 01:30:31 2022
OS/Arch:      linux/arm64

❯ podman info
host:
  arch: arm64
  buildahVersion: 1.28.0
  cgroupControllers:
  - cpu
  - io
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.5-1.fc37.aarch64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.5, commit: '
  cpuUtilization:
    idlePercent: 70.55
    systemPercent: 19.48
    userPercent: 9.97
  cpus: 1
  distribution:
    distribution: fedora
    variant: coreos
    version: "37"
  eventLogger: journald
  hostname: localhost.localdomain
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 1000000
    uidmap:
    - container_id: 0
      host_id: 503
      size: 1
    - container_id: 1
      host_id: 100000
      size: 1000000
  kernel: 6.1.9-200.fc37.aarch64
  linkmode: dynamic
  logDriver: journald
  memFree: 1242480640
  memTotal: 2050191360
  networkBackend: netavark
  ociRuntime:
    name: crun
    package: crun-1.7.2-3.fc37.aarch64
    path: /usr/bin/crun
    version: |-
      crun version 1.7.2
      commit: 0356bf4aff9a133d655dc13b1d9ac9424706cac4
      rundir: /run/user/503/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  remoteSocket:
    exists: true
    path: /run/user/503/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_AUDIT_WRITE,CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_MKNOD,CAP_NET_BIND_SERVICE,CAP_NET_RAW,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: true
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.0-8.fc37.aarch64
    version: |-
      slirp4netns version 1.2.0
      commit: 656041d45cfca7a4176f6b7eed9e4fe6c11e8383
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.3
  swapFree: 0
  swapTotal: 0
  uptime: 0h 1m 3.00s
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  volume:
  - local
registries:
  search:
  - docker.io
store:
  configFile: /var/home/core/.config/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /var/home/core/.local/share/containers/storage
  graphRootAllocated: 106769133568
  graphRootUsed: 2274807808
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 0
  runRoot: /run/user/503/containers
  transientStore: false
  volumePath: /var/home/core/.local/share/containers/storage/volumes
version:
  APIVersion: 4.3.1
  Built: 1668178831
  BuiltTime: Sat Nov 12 01:30:31 2022
  GitCommit: ""
  GoVersion: go1.19.2
  Os: linux
  OsArch: linux/arm64
  Version: 4.3.1

### Podman in a container

No

### Privileged Or Rootless

Rootless

### Upstream Latest Release

Yes

### Additional environment details

_No response_

### Additional information

_No response_

[arixmkii]

Not fully covered, but partially related to https://github.com/containers/podman/issues/16710

May be it will be possible to design a solution, which fixes both.

[github-actions[bot]]

A friendly reminder that this issue had no activity for 30 days.

[arixmkii]

Documented my vision on how this (together with another issue) could be fixed in this comment: https://github.com/containers/podman/issues/16710#issuecomment-1475263567

[github-actions[bot]]

A friendly reminder that this issue had no activity for 30 days.

[Nezteb]

I can confirm that this is still an issue with Podman Desktop 1.4.0 (Podman 4.6.2).

The fix for me was to run podman machine rm first, which will delete the conflicting files:

The following files will be deleted:

~/.ssh/podman-machine-default
~/.ssh/podman-machine-default.pub
~/.config/containers/podman/machine/qemu/podman-machine-default.ign
~/.local/share/containers/podman/machine/qemu/podman-machine-default_fedora-coreos-38.20231002.2.2-qemu.aarch64.qcow2
~/.local/share/containers/podman/machine/qemu/podman.sock
~/.local/share/containers/podman/machine/qemu/podman-machine-default_ovmf_vars.fd
~/.config/containers/podman/machine/qemu/podman-machine-default.json

Then podman machine init will work and recreate those files.

[arixmkii]

I did some work on this. I can revisit the topic, when I receive feedback from the Podman development team in https://github.com/containers/podman/pull/18487

[Luap99]

I think this was fixed in 5.0 as we no longer use .ssh to write the key there