Replies: 6 comments 8 replies
-
|
First could you give /sys and /proc ownership is correct since they are owned by root which is not mapped into the user namespace. |
Beta Was this translation helpful? Give feedback.
2 replies
-
Can I know why? doesn't this violate the whole purpose of being rootless where the parent unprivileged user becomes the root of everything inside the new user namespace? |
Beta Was this translation helpful? Give feedback.
-
|
Because the Kernel does not allow it, probbaly because of Security risk. We attempt to make your statement correct, within the limits of what we can do as a rootless user. |
Beta Was this translation helpful? Give feedback.
-
|
What command are you using to create the rootless podman? |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
@rhatdan I deeply apologize about the late response. host:
arch: amd64
buildahVersion: 1.28.0
cgroupControllers:
- cpuset
- cpu
- io
- memory
- hugetlb
- pids
- rdma
- misc
cgroupManager: cgroupfs
cgroupVersion: v2
conmon:
package: conmon-2.1.5-r0
path: /usr/bin/conmon
version: "conmon version 2.1.5, commit: unknown"
cpuUtilization:
idlePercent: 77.06
systemPercent: 8.86
userPercent: 14.08
cpus: 2
distribution:
distribution: alpine
version: 3.17.0
eventLogger: file
hostname: myhostname
idMappings:
gidmap:
- container_id: 0
host_id: 14902
size: 1
- container_id: 1
host_id: 114902
size: 65536
uidmap:
- container_id: 0
host_id: 14902
size: 1
- container_id: 1
host_id: 114902
size: 65536
kernel: 5.15.0-56-generic
linkmode: dynamic
logDriver: k8s-file
memFree: 130424832
memTotal: 4013912064
networkBackend: netavark
ociRuntime:
name: crun
package: crun-1.7.2-r0
path: /usr/bin/crun
version: |-
crun version 1.7.2
commit: 0356bf4aff9a133d655dc13b1d9ac9424706cac4
rundir: /tmp/podman-run-14902/crun
spec: 1.0.0
+SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL
os: linux
remoteSocket:
path: /tmp/podman-run-14902/podman/podman.sock
security:
apparmorEnabled: false
capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
rootless: true
seccompEnabled: true
seccompProfilePath: /etc/containers/seccomp.json
selinuxEnabled: false
serviceIsRemote: false
slirp4netns:
executable: /usr/bin/slirp4netns
package: slirp4netns-1.2.0-r0
version: |-
slirp4netns version 1.2.0
commit: 656041d45cfca7a4176f6b7eed9e4fe6c11e8383
libslirp: 4.7.0
SLIRP_CONFIG_VERSION_MAX: 4
libseccomp: 2.5.4
swapFree: 0
swapTotal: 0
uptime: 1h 8m 14.00s (Approximately 0.04 days)
plugins:
authorization: null
log:
- k8s-file
- none
- passthrough
network:
- bridge
- macvlan
volume:
- local
registries:
search:
- docker.io
store:
configFile: /home/myhostname/.config/containers/storage.conf
containerStore:
number: 1
paused: 0
running: 1
stopped: 0
graphDriverName: overlay
graphOptions: {}
graphRoot: /home/myhostname/.local/share/containers/storage
graphRootAllocated: 39973924864
graphRootUsed: 12601896960
graphStatus:
Backing Filesystem: extfs
Native Overlay Diff: "true"
Supports d_type: "true"
Using metacopy: "false"
imageCopyTmpDir: /var/tmp
imageStore:
number: 1
runRoot: /tmp/podman-run-14902/containers
volumePath: /home/myhostname/.local/share/containers/storage/volumes
version:
APIVersion: 4.3.1
Built: 1670896833
BuiltTime: Tue Dec 13 02:00:33 2022
GitCommit: ""
GoVersion: go1.19.4
Os: linux
OsArch: linux/amd64
Version: 4.3.1
And here is the response of the inner (i.e. rootful) host:
arch: amd64
buildahVersion: 1.23.1
cgroupControllers:
- cpuset
- cpu
- io
- memory
- hugetlb
- pids
- rdma
- misc
cgroupManager: cgroupfs
cgroupVersion: v2
conmon:
package: "conmon: /usr/bin/conmon"
path: /usr/bin/conmon
version: "conmon version 2.1.3, commit: unknown"
cpus: 2
distribution:
codename: kinetic
distribution: ubuntu
version: "22.10"
eventLogger: file
hostname: myhostname2
idMappings:
gidmap: null
uidmap: null
kernel: 5.15.0-56-generic
linkmode: dynamic
logDriver: k8s-file
memFree: 125763584
memTotal: 4013912064
ociRuntime:
name: crun
package: "crun: /usr/bin/crun"
path: /usr/bin/crun
version: |-
crun version 1.5
commit: 54ebb8ca8bf7e6ddae2eb919f5b82d1d96863dea
spec: 1.0.0
+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL
os: linux
remoteSocket:
path: /run/podman/podman.sock
security:
apparmorEnabled: false
capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
rootless: false
seccompEnabled: true
seccompProfilePath: /usr/share/containers/seccomp.json
selinuxEnabled: false
serviceIsRemote: false
slirp4netns:
executable: /usr/bin/slirp4netns
package: "slirp4netns: /usr/bin/slirp4netns"
version: |-
slirp4netns version 1.2.0
commit: 656041d45cfca7a4176f6b7eed9e4fe6c11e8383
libslirp: 4.7.0
SLIRP_CONFIG_VERSION_MAX: 4
libseccomp: 2.5.4
swapFree: 0
swapTotal: 0
uptime: 1h 13m 48.07s (Approximately 0.04 days)
plugins:
log:
- k8s-file
- none
- journald
network:
- bridge
- macvlan
volume:
- local
registries: {}
store:
configFile: /etc/containers/storage.conf
containerStore:
number: 1
paused: 0
running: 0
stopped: 1
graphDriverName: overlay
graphOptions: {}
graphRoot: /var/lib/containers/storage
graphStatus:
Backing Filesystem: extfs
Native Overlay Diff: "false"
Supports d_type: "true"
Using metacopy: "false"
imageStore:
number: 1
runRoot: /run/containers/storage
volumePath: /var/lib/containers/storage/volumes
version:
APIVersion: 3.4.4
Built: 0
BuiltTime: Thu Jan 1 00:00:00 1970
GitCommit: ""
GoVersion: go1.17.3
OsArch: linux/amd64
Version: 3.4.4And here is the output of |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
@giuseppe PTAL |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
you need to have a writeable cgroup. I don't think we have a way to set it writeable, but we do it when the systemd mode is used. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
@giuseppe Thanks. I did try set |
Beta Was this translation helpful? Give feedback.
6 replies
-
cgroups2 nodes
What do you mean by cgroup config? k8s API doesn't expose cgoups directly afaik (see container API if you're intrested). I am just using |
Beta Was this translation helpful? Give feedback.
-
|
Also
Yes. |
Beta Was this translation helpful? Give feedback.
-
so the cgroup must be writeable. Is the cgroup file system writeable inside the k8s privileged pod? |
Beta Was this translation helpful? Give feedback.
-
|
@giuseppe I don't understand, if the inner rootful podman cannot run because the cgroup fs is read only in the k8s container, how did the outer rootless podman run without an issue in the first place? wouldn't this error occur in the outer rootless podman also since it is running inside the k8s container? |
Beta Was this translation helpful? Give feedback.
-
|
not really sure what is going on, I've never tried running Podman in such a configuration with two nested containers. |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Hi all and happy new year. I am trying to run podman (currently rootful e.g.
sudo podman run -it alpine sh) inside rootless podman. However I am getting the following errorI am already using a volume for
/var/lib/containers. Interestingly enough most files in/sys/and/proc/are owned bynobody:nogroup, does that have to do anything with the above error? Also the parent (i.e. rootless) container is running with privileged flag so I don't think there are any more permissions to give to the parent containerBeta Was this translation helpful? Give feedback.
All reactions