Podman inside podman throwing permission error

[alphakilo7]

Issue Description

I am trying to run containers using Podman in Rootless Mode. Below is my command,

podman run -itd \
    --network ecosystem-net \
    --name network-test-1 \
    --hostname network-test-1 \
    --network-alias network-test-1 \
    -v /run/user/1000/podman/podman.sock:/root/podman/podman.sock:Z \
    docker.io/library/ubuntu:jammy bash

After connecting to the container, I am trying to access the podman inside podman on the mounted socket file using python podman package. But it throws below error.

---------------------------------------------------------------------------
PermissionError                           Traceback (most recent call last)
File /usr/local/lib/python3.10/dist-packages/podman/api/uds.py:41, in UDSSocket.connect(self, **kwargs)
     40 try:
---> 41     super().connect(netloc)
     42 except Exception as e:

PermissionError: [Errno 13] Permission denied

Also, cannot connect using curl command.

root@network-test-1:~# curl -v --unix-socket /root/podman/podman.sock http://localhost/version
*   Trying /root/podman/podman.sock:0...
* Immediate connect fail for /root/podman/podman.sock: Permission denied
* Closing connection 0
curl: (7) Couldn't connect to server

Permission for podman.sock
0 srwxrwxrwx. 1 root root 0 Feb 12 10:05 podman.sock

---

Podman Version

Client:       Podman Engine
Version:      4.4.1
API Version:  4.4.1
Go Version:   go1.19.10
Built:        Thu Aug 17 13:30:33 2023
OS/Arch:      linux/amd64

Podman Info

host:
  arch: amd64
  buildahVersion: 1.29.0
  cgroupControllers:
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.8-1.el9.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.8, commit: aadb7c890ac6283eb4666d92690238e5fbdec5c7'
  cpuUtilization:
    idlePercent: 99.56
    systemPercent: 0.12
    userPercent: 0.33
  cpus: 1
  distribution:
    distribution: '"rhel"'
    version: "9.3"
  eventLogger: journald
  hostname: ip-172-31-1-15.ap-south-1.compute.internal
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 5.14.0-362.18.1.el9_3.x86_64
  linkmode: dynamic
  logDriver: journald
  memFree: 71233536
  memTotal: 790601728
  networkBackend: netavark
  ociRuntime:
    name: crun
    package: crun-1.8.7-1.el9.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.8.7
      commit: 53a9996ce82d1ee818349bdcc64797a1fa0433c4
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.1-1.el9.x86_64
    version: |-
      slirp4netns version 1.2.1
      commit: 09e31e92fa3d2a1d3ca261adaeb012c8d75a8194
      libslirp: 4.4.0
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.5.2
  swapFree: 0
  swapTotal: 0
  uptime: 92h 17m 46.00s (Approximately 3.83 days)
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  volume:
  - local
registries:
  search:
  - registry.access.redhat.com
  - registry.redhat.io
  - docker.io
store:
  configFile: /home/ec2-user/.config/containers/storage.conf
  containerStore:
    number: 1
    paused: 0
    running: 1
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/ec2-user/.local/share/containers/storage
  graphRootAllocated: 20566749184
  graphRootUsed: 4284616704
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 1
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /home/ec2-user/.local/share/containers/storage/volumes
version:
  APIVersion: 4.4.1
  Built: 1692279033
  BuiltTime: Thu Aug 17 13:30:33 2023
  GitCommit: ""
  GoVersion: go1.19.10
  Os: linux
  OsArch: linux/amd64
  Version: 4.4.1

RPM -q podman

podman-4.4.1-13.el9_2.x86_64

Steps to reproduce the issue

Install python3 and install package podman.

pip install podman

Python Code:

from podman import PodmanClient

url = "unix:///root/podman/podman.sock"

Describe the results you received

Describe the results you received

Describe the results you expected

Describe the results you expected

podman info output

If you are unable to run podman info for any reason, please provide the podman version, operating system and its version and the architecture you are running.

Podman in a container

Yes

Privileged Or Rootless

Rootless

Upstream Latest Release

Yes

Additional environment details

AWS

Additional information

Additional information like issue happens only occasionally or issue happens with a particular architecture or on a particular setting

[Luap99]

you need to use --security-opt label=disable when you create the container

[alphakilo7]

Thank you. Adding this parameter worked!