Rootless Podman-inside-Podman: XDG_RUNTIME_DIR directory "/run/user/0" is not owned by the current user

[stellarpower]

Am guessing this may be a configuration issue and not a bug, so am opening as a discussion.

I'm running rootless podman and trying to do podman-in-podman.

Following guides here and here:

🍑❯ podman run --security-opt label=disable --user podman --device /dev/fuse quay.io/podman/stable podman run alpine echo hello
time="2023-12-14T17:18:35Z" level=error msg="XDG_RUNTIME_DIR directory \"/run/user/0\" is not owned by the current user"

1 ❯ podman run --security-opt label=disable --user podman quay.io/podman/stable podman run ubi8-micro echo hi
time="2023-12-14T17:23:38Z" level=error msg="XDG_RUNTIME_DIR directory \"/run/user/0\" is not owned by the current user"

🍑❯ podman system info
host:
  arch: amd64
  buildahVersion: 1.31.0
  cgroupControllers:
  - cpu
  - memory
  - pids
  cgroupManager: cgroupfs
  cgroupVersion: v2
  conmon:
    package: conmon_100:2.1.2~0_amd64
    path: /usr/libexec/podman/conmon
    version: 'conmon version 2.1.2, commit: '
  cpuUtilization:
    idlePercent: 90.21
    systemPercent: 2.54
    userPercent: 7.25
  cpus: 32
  databaseBackend: boltdb
  distribution:
    codename: lunar
    distribution: ubuntu
    version: "23.04"
  eventLogger: file
  freeLocks: 1919
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 6.2.0-27-generic
  linkmode: dynamic
  logDriver: journald
  memFree: 2779308032
  memTotal: 134862561280
  networkBackend: cni
  networkBackendInfo:
    backend: cni
    dns:
      package: podman-plugins_100:1.2.0-1_amd64
      path: /usr/libexec/cni/dnsname
      version: CNI dnsname plugin version unknown
    package: podman-plugins_100:1.2.0-1_amd64
    path: /usr/libexec/cni
  ociRuntime:
    name: crun
    package: crun_101:1.8.6-0ubuntu22.04+obs57.8_amd64
    path: /usr/bin/crun
    version: |-
      crun version 1.8.6
      commit: 73f759f4a39769f60990e7d225f561b4f4f06bcf
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL
  os: linux
  pasta:
    executable: ""
    package: ""
    version: ""
  remoteSocket:
    path: /run/user/1000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/local/bin/slirp4netns
    package: Unknown
    version: |-
      slirp4netns version 1.2.0
      commit: 656041d45cfca7a4176f6b7eed9e4fe6c11e8383
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.4
  swapFree: 0
  swapTotal: 0
  uptime: 2943h 18m 54.00s (Approximately 122.62 days)
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - docker.io
  - quay.io
store:
  configFile: /home/user/.config/containers/storage.conf
  containerStore:
    number: 42
    paused: 0
    running: 3
    stopped: 39
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/user/.local/share/containers/storage
  graphRootAllocated: 10475882635264
  graphRootUsed: 4715491905536
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 1294
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /home/user/.local/share/containers/storage/volumes
version:
  APIVersion: 4.6.0
  Built: 0
  BuiltTime: Thu Jan  1 01:00:00 1970
  GitCommit: ""
  GoVersion: go1.18.1
  Os: linux
  OsArch: linux/amd64
  Version: 4.6.0

Podman installed from the Kubic PPA.

Any thing I might be missing?

Cheers

[rhatdan]

Strange it works for me, did you run this in rootless mode?

[stellarpower]

In terms of a systemd socket? I'm not sure if that's set up on this system, I'm usually just launching through the CLI, there's no podman machine stuff in the mix.

[rhatdan]

It looks like XDG_RUNTIME_DIR is set within the container and it points to /run/user/0 within the container, meaning podman is checking Podman user UID with the owner of /run/user/0?

[stellarpower]

I assumed this was by design as being root on the inside makes sense normally. Should it be owned by my real host UID?

I also see we can update to 4.6.2, but as a shared machine I wanna check with colleagues before I do that.

[TGoodpasture]

May be resurrecting a dead thread but I received this same user when I was logged into the none-root user using su. It was fixed by SSH-in using @localhost and then running the rootless container from that session. Not sure if intended rootless behavior or a bug.

[eriksjolund]

I was logged into the none-root user using su.

Use machinectl instead of su.

(An alternative is to log in with SSH to localhost as you already found out)

For details, see

Podman run fails with ERRO[0000] XDG_RUNTIME_DIR directory "/run/user/0" is not owned by the current user or Error: creating tmpdir: mkdir /run/user/1000: permission denied.
https://github.com/containers/podman/blob/main/troubleshooting.md#31-podman-run-fails-with-erro0000-xdg_runtime_dir-directory-runuser0-is-not-owned-by-the-current-user-or-error-creating-tmpdir-mkdir-runuser1000-permission-denied

Why can't I run rootless Podman containers when I log into a user via sudo or su? https://www.redhat.com/sysadmin/sudo-rootless-podman