Closed iskunk closed 1 year ago
@giuseppe PTAL
Looks like all options except ignore_chown_errors
are ignored here: https://github.com/containers/storage/blob/b1216421c44b5383756ea3b29d6693c41f05d812/types/options.go#L298-L305
I have no idea why?
we cherry-pick some settings from the global file under /etc/containers
, because that file is really meant for root not as a base for rootless users.
I don't remember why we did that for ignore_chown_errors
, maybe because it was not possible to hit this issue with root anyway?
If you set the storage driver there, I expect root containers to be affected, not rootless. You need to copy the configuration for each rootless user
If you set the storage driver there, I expect root containers to be affected, not rootless. You need to copy the configuration for each rootless user
The user configuration has the disadvantage that it is the same regardless of what host the user is running Podman on. The rootless_storage_path
setting can naturally vary by host (by virtue of varying disk configurations), and in principle, the same could be true of mount_program
.
This is on top of the administrative overhead of requiring a large number of users to set up a config file in their home directories, especially when the settings are admin-provided (i.e. there is no point to the user setting their own values), and Docker proper imposes no such burden.
If /etc/containers/storage.conf
is meant for rootful Podman, then we need some other place to put system-scoped rootless settings. The system-related dependencies involved in running even rootless containers are too great to be relegated to per-user configurations alone.
Unless I'm mistaken, I think you can effectively have rootless podman make use of all the settings in /etc/containers/storage.conf
by using the CONTAINERS_STORAGE_CONF
environment variable. For example, adding an entry into /etc/profile.d
with export CONTAINERS_STORAGE_CONF=/etc/containers/storage.conf
should by default have rootless users making use of all the settings in that config.
Good catch, @kpansky. That appears to do the trick with 4.4.x, but is ineffectual with Ubuntu 22.04's 3.4.x. (I still see Native Overlay Diff: "true"
there, and this remains the case even if I use a different filename.)
Of course, this prevents the user config file from being referenced at all, so it's not a general solution. But it does provide a less-invasive workaround for those using newer versions of Podman.
A friendly reminder that this issue had no activity for 30 days.
Since you have a solution, I am going to close this issue.
@rhatdan, where is the root-cause bug of the mount_program
keyword scope not matching rootless_storage_path
being tracked?
No idea, @giuseppe do you know?
The mount program specified in the global configuration file applies to the root configuration, not rootless
@giuseppe, as far as I know there is currently no way to specify a default mount program for rootless in the global config. Making the global mount_program
directive cover rootless in addition to rootful would be the simplest solution, but if it really should remain rootful-only, then perhaps e.g. a new rootless_mount_program
parameter would be the way to go.
In general, it should be possible for the global config to specify the default for any user-level rootless parameter, which the user config can then override---i.e. standard administrative hierarchy. When a parameter only works in the user config, it makes things difficult for the sysadmin, who now has to reach into the user configs in some way to set that parameter (if it's one that is needed to get the installation working). The above issue is a specific instance of this more general problem of rootless config scope.
Is there an existing issue tracking the general problem? I can create one if needed.
Issue Description
I am unable to configure Podman to use fuse-overlayfs, instead of the native overlay driver, via the system-wide configuration in
/etc/containers/storage.conf
.This issue occurs identically in Podman versions 3.4.4 (as shipped in Ubuntu 22.04) as well as 4.4.3 (using the Kubic packages).
I am using a rootless-only configuration. Even though my system can run the native overlay storage driver, I want Podman to use fuse-overlayfs instead. The FUSE option may normally be slower, but the current lack of idmap support for rootless native overlays makes the native driver significantly slower when using
--userns=keep-id
. The following references explain the situation:https://github.com/containers/podman/issues/16541#issuecomment-1350793182
https://github.com/containers/podman/issues/16541#issuecomment-1351195823
https://github.com/containers/podman/issues/16541#issuecomment-1352790422
https://github.com/containers/podman/issues/16830
Steps to reproduce the issue
I set the following configuration in
/etc/containers/storage.conf
:The last line is, as I understand, the correct way of forcing the use of fuse-overlayfs despite the native driver being available.
Describe the results you received
podman info
, run as a user, shows this:Native Overlay Diff = "true" directly contradicts the aforementioned
mount_program = "/usr/bin/fuse-overlayfs"
setting, even though therootless_storage_path
setting was respected. If I start a container withpodman container run ... --userns=keep-id
in this state, it takes an unreasonably long time to initialize due to storage-chown-by-maps.Describe the results you expected
and thus no storage-chown-by-maps slowdown at container start.
podman info output
Podman in a container
No
Privileged Or Rootless
Rootless
Upstream Latest Release
Yes
Additional environment details
Running on Ubuntu 22.04 / amd64.
Additional information
I am able to configure the use of fuse-overlayfs via
~/.config/containers/storage.conf
, but cannot rely on per-user configurations at my site.