Running podman as a non-login user is possible? #10308
Comments
openshift-ci
bot
added
the
kind/feature
|
Podman requires a full login session. This means it cannot be used from
within a sudo or su shell, unless the user in question has lingering
enabled with the ‘loginctl enable-linger’ command. It also looks like
you’re using a system user who may not have entries in /etc/subuid and
/etc/subgid.
…On Tue, May 11, 2021 at 07:37 Osqui LittleRiver ***@***.***> wrote:
*Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)*
/kind feature
*Description*
I want a web page can run Podman container simply clicking in a button.
This web page is done in PHP, so I'm using its system("podman command...")
function to achieve this. But it does nothing (I've tried exec(),
shell_exec() and passthru() function too with the same effect). Nothing:
any output in web, any error in error.log file. I suspect, though, it's
something related to "apache" user, as you will see in next pharagraphs.
*Steps to reproduce the issue:*
1.For instance, if you run *php -r "system('podman version');*" in a
shell having logged with your regular user, it works perfectly. But if you
run *sudo -u apache php -r "system('podman version');"* I get this error
messages:
WARN[0000] The cgroupv2 manager is set to systemd but there is no systemd
user session available
WARN[0000] For using systemd, you may need to login using an user session
WARN[0000] Alternatively, you can enable lingering with: loginctl
enable-linger 48 (possibly as root)
WARN[0000] Falling back to --cgroup-manager=cgroupfs
Error: error creating runtime static files directory: mkdir
/usr/share/httpd/.local: permission denied
*Describe the results you received:*
I get the same error shown above having an entry in /etc/subuid and
/etc/subgid related to host's "apache" user, so I'm not sure if this is
important or not. It seems it's related to the fact that "apache" user
have'nt logged in system so Systemd doesn't recognize as a valid user for
running podman (I don't know the inners to understand why is this).
*Describe the results you expected:*
I want to run podman commands via apache user as any standard regular user
*Output of podman version:*
Version: 3.1.2
API Version: 3.1.2
Go Version: go1.16
Built: Thu Apr 22 15:11:28 2021
OS/Arch: linux/amd64
*Output of podman info --debug:*
host:
arch: amd64
buildahVersion: 1.20.1
cgroupManager: systemd
cgroupVersion: v2
conmon:
package: conmon-2.0.27-2.fc34.x86_64
path: /usr/bin/conmon
version: 'conmon version 2.0.27, commit: '
cpus: 8
distribution:
distribution: fedora
version: "34"
eventLogger: journald
hostname: pepito
idMappings:
gidmap:
- container_id: 0
host_id: 1000
size: 1
- container_id: 1
host_id: 100000
size: 65536
uidmap:
- container_id: 0
host_id: 1000
size: 1
- container_id: 1
host_id: 100000
size: 65536
kernel: 5.11.17-300.fc34.x86_64
linkmode: dynamic
memFree: 12440694784
memTotal: 16647036928
ociRuntime:
name: crun
package: crun-0.19.1-2.fc34.x86_64
path: /usr/bin/crun
version: |-
crun version 0.19.1
commit: 1535fedf0b83fb898d449f9680000f729ba719f5
spec: 1.0.0
+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
os: linux
remoteSocket:
path: /run/user/1000/podman/podman.sock
security:
apparmorEnabled: false
capabilities:
CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
rootless: true
seccompEnabled: true
selinuxEnabled: false
slirp4netns:
executable: /usr/bin/slirp4netns
package: slirp4netns-1.1.9-1.fc34.x86_64
version: |-
slirp4netns version 1.1.8+dev
commit: 6dc0186e020232ae1a6fcc1f7afbc3ea02fd3876
libslirp: 4.4.0
SLIRP_CONFIG_VERSION_MAX: 3
libseccomp: 2.5.0
swapFree: 8589930496
swapTotal: 8589930496
uptime: 4h 13m 50.52s (Approximately 0.17 days)
registries:
search:
- registry.fedoraproject.org
- registry.access.redhat.com
- docker.io
- quay.io
store:
configFile: /home/q2dg/.config/containers/storage.conf
containerStore:
number: 0
paused: 0
running: 0
stopped: 0
graphDriverName: overlay
graphOptions: {}
graphRoot: /home/q2dg/.local/share/containers/storage
graphStatus:
Backing Filesystem: extfs
Native Overlay Diff: "false"
Supports d_type: "true"
Using metacopy: "false"
imageStore:
number: 2
runRoot: /run/user/1000/containers
volumePath: /home/q2dg/.local/share/containers/storage/volumes
version:
APIVersion: 3.1.2
Built: 1619097088
BuiltTime: Thu Apr 22 15:11:28 2021
GitCommit: ""
GoVersion: go1.16
OsArch: linux/amd64
Version: 3.1.2
*Package info (e.g. output of rpm -q podman or apt list podman):*
podman-3.1.2-1.fc34.x86_64
*Have you tested with the latest version of Podman and have you checked
the Podman Troubleshooting Guide?
(https://github.com/containers/podman/blob/master/troubleshooting.md
<https://github.com/containers/podman/blob/master/troubleshooting.md>)*
Yes
*Additional environment details (AWS, VirtualBox, physical, etc.):*
A physical Fedora 33 system
Thanks!!
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#10308>, or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AB3AOCC6VJ5BY5YRDB3MCULTNEJIRANCNFSM44VGXMGA>
.
|
|
Thanks! q2dg:100000:65536 I wanted to see how Cockpit-podman works but my coding skills are very poor. |
|
Oh, some progress! If I do loginctl enable-linger apache, I only get this error: Error: error creating runtime static files directory: mkdir /usr/share/httpd/.local: permission denied |
|
Well, if I do sudo chown -R apache:apache /usr/share/httpd I get this error: If I do sudo chmod -R o+rwx /usr/share/httpd I get this error ("48" is the apache's user UID): |
|
We do require the user have a writable home directory by default, but paths
can be adjusted via configuration file to point to any directory the user
has write access to.
…On Tue, May 11, 2021 at 08:01 Osqui LittleRiver ***@***.***> wrote:
Well, if I do *sudo chown -R apache:apache /usr/share/httpd* I get this
error:
Error: chown /usr/share/httpd/.local/share/containers/storage/overlay/l:
operation not permitted
If I do *sudo chmod -R o+rwx /usr/share/httpd* I get this error ("48" is
the apache's user UID):
Error: chown /run/user/48/containers/overlay: operation not permitted
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
<#10308 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AB3AOCCNKHRT24JA55LMQPLTNEMB5ANCNFSM44VGXMGA>
.
|
|
Oooh, yeah, I've seen! It's rootless_storage_path = "$HOME/.local/share/containers/storage" line in "/etc/containers/storage.conf" file. I'll try to mess things and I'll inform you back soon (and, hopefully, close this issue). Thanks a lot! |
|
Well, there's no good news.I've put rootless_storage_path="/opt/apache" line in "/etc/container/storage.conf" file and I've created this folder with owner/group "apache" and 777 permissions. Then, when I execute sudo -u apache php -r "system('podman version');" I get the error: If I change storage driver from "overlay" to "vfs", I get the same error: What's going on with this problematic "chown"? |
|
Are you on an SELinux enabled distribution? SELinux is the next thing I’d
recommend you check if so.
…On Wed, May 12, 2021 at 05:56 Osqui LittleRiver ***@***.***> wrote:
Well, there's no good news.I've put *rootless_storage_path="/opt/apache"*
and I've create this folder with owner/group "apache" and 777 permissions.
When I execute *sudo -u apache php -r "system('podman version');"* I get
the error:
Error: chown /opt/apache/overlay/l: operation not permitted
If I change storage driver from "overlay" to "vfs", I get the same error:
Error: chown /opt/apache/vfs: operation not permitted
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
<#10308 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AB3AOCH6ZD5SLPTT4NE232LTNJGEBANCNFSM44VGXMGA>
.
|
|
Hello! |
|
Hello! In an ubuntu server 20.04.1, I've put rootless_storage_path="/opt/apache" line in "/etc/container/storage.conf", file and I've created this folder with owner/group "apache" and 777 permissions and it works for me, but only with simple commands like "podman version", "podman container ls" ... etc If I do sudo -u www-data php -r "system('podman version');" command output appears correctly but if I do sudo -u www-data php -r "system('podman pull docker.io/library/mariadb');" I get this error goroutine 1 [running]: podman version: ubuntu version: |
|
Does podman info show the correct data? Show? Lastly what is your goal here? Why do you want to run rootless podman instead of rootfull podman with a --user apache? |
|
If you want to run in a user namespace you can use --userns=auto. |
|
Thanks a lot for your interest. Whatever I do you say (sudo -u apache podman info show ; sudo -u apache podman /proc/self/uid_map; sudo -u apache podman run --userns=auto whatever) I get the same error message: What I want to achieve is simply running direct comands like podman pull or podman run from a webpage using PHP's system()/exec()/shell_exec()...whatever functions. I want to offer a simple webform so that the user could create and run simple containers on a remote server with some characteristics put in the inputs of the webform (passed as POST variables to the arguments of the podman command). I remind you that I've done these steps in a Fedora 34 with SELinux disabled: Thanks a lot again and sorry for my stubbornness PD: Error from @sbravor64 is a bit diferent from mine...and it seems more serious... |
|
I have a feeling something is going wrong with the user namespace. sudo -u apache podman info |
|
Yes. Both commands say ("q2dg" is my username): "cannot chdir to /home/q2dg: Permission denied "/opt/apache" is owned by apache:apache user/group, it has 777 permissions and my system has SELinux disabled. Moreover, I've made "/opt/apache" the home folder of apache user inside "/etc/passwd" file. Thanks |
|
sudo -u apache id |
|
uid=48(apache) gid=48(apache) groups=48(apache) COLORTERM=truecolor Thanks! |
|
Podman requires the XDG_RUNTIME_DIR to be set, to run correctly. |
|
Thanks. cannot chdir to /home/q2dg: Permission denied If this variable is required, maybe this misbehaviour is somewhat related to the access by apache user to some (session) DBus channel? |
|
Well, maybe this comment could have the clue...: https://stackoverflow.com/a/57303690 |
|
Not sure if this is causing issues? BTW what is the permissions on /opt directory? I just went through the process, and set up my apache account to work, without a problem. |
|
Well, there must be something weird in my system that I can't see because doing the same as you (I mean, using "/home" folder instead of "/opt") I keep getting the same error...: cannot chdir to /home/q2dg: Permission denied ...even when I do sudo -u apache USERNAME=apache podman version In fact, my "/home" and "/opt" folders are equivalent in terms of permissions and owners: [q2dg@pepito ~]$ ls -ld /home Thanks a lot for your interest and sorry for disturbing you. |
|
Well, summarizing... I've done explained steps below in a fresh new Fedora 34 Workstation system (with any configuration changes from default settings and with all packages upgraded till today: kernel is 5.11.21-300 and podman is 3.1.2) and in a fresh new Ubuntu 21.04 Desktop system too (with kernel is 5.11.0-17 and podman is 3.0.1 and no configuration changes neither). *In Fedora: 1.-I've disabled SELinux putting the SELINUX=disabled line in "/etc/selinux/config" and I've rebooted the system Whatever I do, I always get the same error: *In Ubuntu (it's the same as above, only changing Apache user's name, ID and paths): 1.-I've installed the following packages: podman apache2 libapache2-mod-php Whatever I do, I always get the same error: In conclusion: Both systems fails in the same manner and I don't know what else to do. Thanks a lot for your patiente. |
|
We could set up a joint debugging session, where I can look at your setup via a shared screen. In Google Meet. |
|
Oh, my English is very poor and I also don't listen very well, so maybe we have some communication problems, but if you don't mind "wasting your time", it's an honor for me! I live in Spain, so we have 7 hours difference: when it is 3:00 pm here, there it is 9:00 am ... knowing this, if you choose the time that suits you best, I can adapt to it. Anyway, if you want to try it for your convenience, you will find the problems that I have been reporting simply by installing (in a virtual machine; I use VirtualBox) a Fedora Workstation 34 using standard options. Thank you very much for your time and for your kindness!! |
|
That is the thing, I have tried and it worked for me. Send your email address to [email protected] and I will setup a meetup. |
|
Well, thanks to the splendid help of @rhatdan and @vrothberg I've got podman running as the apache user. Waiting for definitive solution in containers/common#580 , I'd want to summarize the (provisional) steps I've done. Specifically, in a Fedora Workstation 34 system...: 1.-I've disabled SELinux putting the SELINUX=disabled line in "/etc/selinux/config" and I've rebooted the system (maybe this step not necessary but I've not tried) That's all. Since then, I can execute any podman command through a php interpreter run by Apache user simply writting this: sudo -i -u apache php -r "system('podman version');" I've also tried running "podman run ..." commands and it works too!! The best part is that if I put some code like this ("< html >< body >< ?php system('podman version'); ? >< /body >< /html >") in a php file located inside my host's "/var/www/html" folder (suppose it's called "index.php") and then I open a browser and I go to http://127.0.0.1/index.php , it works too!!! So I can finally run podman containers through a web page. |
|
I would just say, I am sure you could get this working with SELinux fairly easily. |
github-actions
bot
added
the
locked - please file new issue/PR
Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)
/kind feature
Description
I want a web page can run Podman container simply clicking in a button. This web page is done in PHP, so I'm using its system("podman command...") function to achieve this. But it does nothing (I've tried exec(), shell_exec() and passthru() function too with the same effect). Nothing: any output in web, any error in error.log file. I suspect, though, it's something related to "apache" user, as you will see in next pharagraphs.
Steps to reproduce the issue:
1.For instance, if you run php -r "system('podman version');" in a shell having logged with your regular user, it works perfectly. But if you run sudo -u apache php -r "system('podman version');" I get this error messages:
WARN[0000] The cgroupv2 manager is set to systemd but there is no systemd user session available
WARN[0000] For using systemd, you may need to login using an user session
WARN[0000] Alternatively, you can enable lingering with:
loginctl enable-linger 48(possibly as root)WARN[0000] Falling back to --cgroup-manager=cgroupfs
Error: error creating runtime static files directory: mkdir /usr/share/httpd/.local: permission denied
Describe the results you received:
I get the same error shown above having an entry in /etc/subuid and /etc/subgid related to host's "apache" user, so I'm not sure if this is important or not. It seems it's related to the fact that "apache" user have'nt logged in system so Systemd doesn't recognize as a valid user for running podman (I don't know the inners to understand why is this).
Describe the results you expected:
I want to run podman commands via apache user as any standard regular user
Output of
podman version:Version: 3.1.2
API Version: 3.1.2
Go Version: go1.16
Built: Thu Apr 22 15:11:28 2021
OS/Arch: linux/amd64
Output of
podman info --debug:host:
arch: amd64
buildahVersion: 1.20.1
cgroupManager: systemd
cgroupVersion: v2
conmon:
package: conmon-2.0.27-2.fc34.x86_64
path: /usr/bin/conmon
version: 'conmon version 2.0.27, commit: '
cpus: 8
distribution:
distribution: fedora
version: "34"
eventLogger: journald
hostname: pepito
idMappings:
gidmap:
- container_id: 0
host_id: 1000
size: 1
- container_id: 1
host_id: 100000
size: 65536
uidmap:
- container_id: 0
host_id: 1000
size: 1
- container_id: 1
host_id: 100000
size: 65536
kernel: 5.11.17-300.fc34.x86_64
linkmode: dynamic
memFree: 12440694784
memTotal: 16647036928
ociRuntime:
name: crun
package: crun-0.19.1-2.fc34.x86_64
path: /usr/bin/crun
version: |-
crun version 0.19.1
commit: 1535fedf0b83fb898d449f9680000f729ba719f5
spec: 1.0.0
+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
os: linux
remoteSocket:
path: /run/user/1000/podman/podman.sock
security:
apparmorEnabled: false
capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
rootless: true
seccompEnabled: true
selinuxEnabled: false
slirp4netns:
executable: /usr/bin/slirp4netns
package: slirp4netns-1.1.9-1.fc34.x86_64
version: |-
slirp4netns version 1.1.8+dev
commit: 6dc0186e020232ae1a6fcc1f7afbc3ea02fd3876
libslirp: 4.4.0
SLIRP_CONFIG_VERSION_MAX: 3
libseccomp: 2.5.0
swapFree: 8589930496
swapTotal: 8589930496
uptime: 4h 13m 50.52s (Approximately 0.17 days)
registries:
search:
store:
configFile: /home/q2dg/.config/containers/storage.conf
containerStore:
number: 0
paused: 0
running: 0
stopped: 0
graphDriverName: overlay
graphOptions: {}
graphRoot: /home/q2dg/.local/share/containers/storage
graphStatus:
Backing Filesystem: extfs
Native Overlay Diff: "false"
Supports d_type: "true"
Using metacopy: "false"
imageStore:
number: 2
runRoot: /run/user/1000/containers
volumePath: /home/q2dg/.local/share/containers/storage/volumes
version:
APIVersion: 3.1.2
Built: 1619097088
BuiltTime: Thu Apr 22 15:11:28 2021
GitCommit: ""
GoVersion: go1.16
OsArch: linux/amd64
Version: 3.1.2
Package info (e.g. output of
rpm -q podmanorapt list podman):podman-3.1.2-1.fc34.x86_64
Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/master/troubleshooting.md)
Yes
Additional environment details (AWS, VirtualBox, physical, etc.):
A physical Fedora 33 system
Thanks!!
The text was updated successfully, but these errors were encountered: