search

mgoltzsche / podman-static

static podman binaries and container image
Apache License 2.0
253 stars 60 forks source link

User IDs instead of user names in subuid/subgid doesn't work in AD environment #95

Open jfath opened 4 months ago

jfath commented 4 months ago

Tested v4.7.2, v4.9.5, and v5.1.1 in rhel7.

Using username in /etc/subuid /etc/subguid works as expected. Using userid in those files, rootless 'podman image ls' fails with: cannot find UID/GID for user {username}: no subuid ranges found for user "{username}" It works without error in a non-AD environment using local user IDs.

I also tested rhel8 v4.9.4 release from the redhat standard repos and it works as expected in an AD environment with userids.

I see there was a related issue a couple of years ago which was solved by an idtools PR - maybe not helpfule, but thought it was worth mentioning: https://github.com/containers/storage/issues/1264

mgoltzsche commented 3 months ago

What's do you mean by AD environment? Active Directory? As I understand the username is used in the /etc/subuid file to make rootless podman work, no? Do you want to change that just for the sake of your environment, accepting to break it for others? Or maybe I misunderstood your request. Please clarify that.

I also tested rhel8 v4.9.4 release from the redhat standard repos and it works as expected in an AD environment with userids.

What did you test? The official podman installation on rhel8 or the podman container image produced by this repo on rhel8 or the binary archive distribution attached to the release within this repo?

The /etc/{subuid,subgid} files within the container image produced by this repo are aligned with the official quay.io/podman/stable image and I am trying to keep it that way. Thus, when you want to diverge from the official image, please consider creating a corresponding issue within the upstream podman project. In case you think the configuration within this repo is not aligned with the corresponding image, I am inclined to change that but then please be clear about it.

jfath commented 3 months ago

Yes, Active Directory, non-local users. I'm using the non-container installation from your release.

Current official Podman supports using either usernames or user IDs in the /etc/subuid file. I tested with the official rhel8 installation.

The bug I linked points to an official podman release component that was broken in the same way at one point (usernames only, no user IDs) and was then fixed. That's why I thought it might be relevant.