Open jiridanek opened 2 months ago
Might this be the same issue (this is with force_mask = "shared"
, though)? Permissions inside build container get reset to root
when switching user on rootless build:
$ sudo getenforce
Disabled
$ cat ~/.config/containers/storage.conf
[storage]
driver = "overlay"
[storage.options.overlay]
force_mask = "shared"
mount_program = "/usr/bin/fuse-overlayfs"
$ cat Containerfile.testperms
FROM alpine:3.19
RUN mkdir -p /foo && chmod 777 /foo && chown 1234:1234 /foo && ls -la /foo
USER 1234
RUN ls -la /foo && touch /foo/bar
$ podman build --no-cache -t testperms -f Containerfile.testperms
STEP 1/4: FROM alpine:3.19
STEP 2/4: RUN mkdir -p /foo && chmod 777 /foo && chown 1234:1234 /foo && ls -la /foo
total 12
drwxrwxrwx 2 1234 1234 4096 Jun 12 05:19 .
drwxr-xr-x 20 root root 4096 Jun 12 05:19 ..
--> 8da48daca6ea
STEP 3/4: USER 1234
--> b6088de82f9c
STEP 4/4: RUN ls -la /foo && touch /foo/bar
total 8
drwxr-xr-x 2 root root 4096 Jun 12 05:19 .
drwxr-xr-x 20 root root 4096 Jun 12 05:19 ..
touch: /foo/bar: Permission denied
Error: building at STEP "RUN ls -la /foo && touch /foo/bar": while running runtime: exit status 1
It's quite likely the same issue. I decided to report problems about a single configuration to make the bug report simpler, but I'm convinced that any force_mask that is less restrictive than 0777 will cause problems.
might be addressed by https://github.com/containers/fuse-overlayfs/pull/422
The tests in the PR do look promising!
My issue is resolved after a system package upgrade (so might be different, given https://github.com/containers/fuse-overlayfs/pull/422 is not yet released).
$ sudo dnf list --installed | grep -E 'podman|container|overlay'
container-selinux.noarch 2:2.232.1-1.fc40 @updates
containerd.io.x86_64 1.6.33-3.1.fc40 @docker-ce-stable
containers-common.noarch 5:0.59.1-2.fc40 @updates
containers-common-extra.noarch 5:0.59.1-2.fc40 @updates
fuse-overlayfs.x86_64 1.13-1.fc40 @fedora
overlayfs-tools.x86_64 0-0.9.20200817git77bf3f7.fc40 @fedora
podman.x86_64 5:5.1.1-1.fc40 @updates
My issue is resolved after a system package upgrade (so might be different, given https://github.com/containers/fuse-overlayfs/pull/422 is not yet released).
@legobeat Did you do podman system reset
after changing force_mask
?
Initially, I just edited config to put force_mask
back in, tried the reproducer command, and was about to celebrate, when I realized that it does not come into effect unless container storage is reset! So I did that, and bug started manifesting again.
jdanek@fedora:~$ vim ~/.config/containers/storage.conf
jdanek@fedora:~$ podman run --rm -it registry.fedoraproject.org/fedora bash -c 'useradd pepa; ls -AlFd /home/pepa; chown pepa /home/pepa; ls -AlFd /home/pepa; sudo -u pepa ls /home'
drwx------. 2 root root 104 Jun 20 13:28 /home/pepa/
drwx------. 2 pepa nobody 104 Jun 20 13:28 /home/pepa/
pepa
jdanek@fedora:~$ podman system reset
WARNING! This will remove:
- all containers
- all pods
- all images
- all networks
- all build cache
- all machines
- all volumes
- the graphRoot directory: "/home/jdanek/.local/share/containers/storage"
- the runRoot directory: "/run/user/1000/containers"
Are you sure you want to continue? [y/N] y
A "/home/jdanek/.config/containers/storage.conf" config file exists.
Remove this file if you did not modify the configuration.
jdanek@fedora:~$ podman run --rm -it registry.fedoraproject.org/fedora bash -c 'useradd pepa; ls -AlFd /home/pepa; chown pepa /home/pepa; ls -AlFd /home/pepa; sudo -u pepa ls /home'
Trying to pull registry.fedoraproject.org/fedora:latest...
Getting image source signatures
Copying blob 0eb6f43df594 done |
Copying config 5c521474f1 done |
Writing manifest to image destination
drwx------. 2 root root 104 Jun 20 13:30 /home/pepa/
drwx------. 2 pepa nobody 104 Jun 20 13:30 /home/pepa/
sudo: unable to execute /usr/bin/ls: Permission denied
jdanek@fedora:~$
Issue Description
Steps to reproduce the issue
Steps to reproduce the issue
Describe the results you received
Describe the results you expected
After I comment out the
force_mask = "0700"
, or delete storage.conf alltogether, I getpodman info output
Podman in a container
No
Privileged Or Rootless
Rootless
Upstream Latest Release
Yes
Additional environment details
I use btrfs on Fedora 40.
I discovered this when exploring around
In the issue I am reporting now, I deliberately did not use any networked filesystem but still got weird permissions/ownership errors.
Additional information
Article https://www.redhat.com/sysadmin/podman-rootless-overlay suggests that
fuse-overlayfs
is supposed to preserve permissions and ownership in file xattrs.This issue seems to be similar to a several previous issues
And it might be related to