podman: does not honor TMPDIR when executing run sub-command

[flyn-org]

/kind bug

Description

I am working with podman on OpenWrt, a light-weight distribution that aims to support network devices. The default OpenWrt environment does not allow non-root users to write to /var/tmp, and thus the TMPDIR environment variable is necessary to allow podman to work. However, it seems that the run sub-command might ignore TMPDIR for one of its operations.

I do see references to TMPDIR in root.go, but I have not yet found why the run sub-command deviates from this

Steps to reproduce the issue:

1. Install the podman package on OpenWrt.

2. Build or install a container image.

3. Run TMPDIR=/tmp podman run IMAGE-NAME

Describe the results you received:

Podman failed with Error: open /var/tmp/353770848: permission denied. The presence of /var/tmp makes me think podman ignored TMPDIR.

Describe the results you expected:

Podman should use /tmp rather than /var/tmp`.

Additional information you deem important (e.g. issue happens only occasionally):

Output of podman version:

Version:      3.1.2
API Version:  3.1.2
Go Version:   go1.16
Built:        Wed Dec 31 18:00:00 1969
OS/Arch:      linux/amd64

I also tested with 3.2.0.

Output of podman info --debug:

host:
  arch: amd64
  buildahVersion: 1.20.1
  cgroupManager: cgroupfs
  cgroupVersion: v2
  conmon:
    package: Unknown
    path: /usr/bin/conmon
    version: 'conmon version 2.0.27, commit: '
  cpus: 1
  distribution:
    distribution: '"openwrt"'
    version: snapshot
  eventLogger: file
  hostname: aquinas-user
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1152
      size: 1
    uidmap:
    - container_id: 0
      host_id: 1152
      size: 1
  kernel: 5.4.117
  linkmode: dynamic
  memFree: 1601785856
  memTotal: 2074664960
  ociRuntime:
    name: /usr/bin/crun
    package: Unknown
    path: /usr/bin/crun
    version: |-
      crun version 0.19.1
      commit: f9c405d3cd8727f98ac4cdf0d98722684ee5f0bb
      spec: 1.0.0
      +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL
  os: linux
  remoteSocket:
    path: /tmp/podman-run-1152/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_AUDIT_WRITE,CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_MKNOD,CAP_NET_BIND_SERVICE,CAP_NET_RAW,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    selinuxEnabled: false
  slirp4netns:
    executable: ""
    package: ""
    version: ""
  swapFree: 0
  swapTotal: 0
  uptime: 172h 3m 39.72s (Approximately 7.17 days)
registries:
  search:
  - docker.io
  - registry.fedoraproject.org
  - registry.access.redhat.com
store:
  configFile: /home/[...]/.config/containers/storage.conf
  containerStore:
    number: 1
    paused: 0
    running: 0
    stopped: 1
  graphDriverName: vfs
  graphOptions: {}
  graphRoot: /home/[...]/.local/share/containers/storage
  graphStatus: {}
  imageStore:
    number: 16
  runRoot: /tmp/podman-run-1152/containers
  volumePath: /home/[...]/.local/share/containers/storage/volumes
version:
  APIVersion: 3.1.2
  Built: 0
  BuiltTime: Wed Dec 31 18:00:00 1969
  GitCommit: ""
  GoVersion: go1.16
  OsArch: linux/amd64
  Version: 3.1.2

Package info (e.g. output of rpm -q podman or apt list podman):

opkg list-installed | grep podman

podman - 3.1.2-3

Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/master/troubleshooting.md)

Yes/Yes

Additional environment details (AWS, VirtualBox, physical, etc.):

[rhatdan]

Fix is in containers/common#628, once it is merged, we will revendor into Podman.

[mheon]

@rhatdan You sure? He's on 3.1.x per his report - that regression was from the new image code from Valentin, so it should only have appeared in 3.2.0 and above?

[flyn-org]

@rhatdan and @mheon, I tried manually applying the changes in containers/common#628 to my podman 3.2.0 build, but the problem remained. Might this be a different issue?

[rhatdan]

It could be that some other component in podman is attempting to write to /var/tmp/ The change I made is just going to fix the pulling of images.

I setup my /var/tmp read/only, and with this patch I got it to work.

diff.patch

[rhatdan]

@vrothberg PTAL

[vrothberg]

A reproducer would help.