containers / podman

Podman: A tool for managing OCI containers and pods.
https://podman.io
Apache License 2.0
23.27k stars 2.37k forks source link

regression: 0.12.1.1-1 breaks mount as nonroot #1964

Closed edsantiago closed 5 years ago

edsantiago commented 5 years ago
$ podman run --name foo alpine touch /foo
$ mp=$(podman mount foo)
$ ls -la $mp
total 8
drwx------. 2 fedora fedora 4096 Dec 10 16:18 .
drwx------. 5 fedora fedora 4096 Dec 10 16:18 ..

Podman does think the mount is active:

$ podman mount
b7606e45a71f /home/fedora/.local/share/containers/storage/overlay/7b75b16d989db5b3fded290dc195ebeb383e0c1342cb680fa9d5ed6c76bcb929/merged
$ echo $mp
/home/fedora/.local/share/containers/storage/overlay/7b75b16d989db5b3fded290dc195ebeb383e0c1342cb680fa9d5ed6c76bcb929/merged

podman-0.12.1.1-1.git66d3499.fc29

mheon commented 5 years ago

@giuseppe PTAL

We had some c/storage revendors - possible one of them broke it?

giuseppe commented 5 years ago

is it the same issue as https://github.com/containers/buildah/issues/1225 ?

giuseppe commented 5 years ago

fuse-overlayfs runs in a new mount namespace and that cannot be propagated to the host. vfs works as it doesn't create any new mount, it just explodes the container so it is still accessible from the host.

What we can do is to show a warning for mount. Buildah will need the same fix

mheon commented 5 years ago

Hm. We might want to look into a podman copy then, that could successfully join the user namespace and copy a file into it

rhatdan commented 5 years ago

Also we might be able to do some stuff with buildah unshare, which puts you into the user namespace and you could interact with the mount point then.

rhatdan commented 5 years ago

And I think we definitely need podman cp command now, as much as I hate to admit it.

giuseppe commented 5 years ago

PR here: https://github.com/containers/libpod/pull/1994

giuseppe commented 5 years ago

I've created two PR, one for Buildah and one for Podman.

I've verified that it is possible to use "podman mount" and "buildah mount" even with fuse-overlayfs when in the environment created with "buildah unshare"