Error when importing a checkpoint of a container with --ipc host

[carlhoerberg]

/kind bug

Description

Importing a checkpoint of a container with --ipc host causes an error. Somehow related to #10635?

Steps to reproduce the issue:

podman run -d --ipc host docker.io/alpine sleep 3600
podman container checkpoint --latest --export dump.tarz
podman rm --latest
podman container restore --import dump.tarz

Describe the results you received:

Error: error creating container storage: ProcessLabel and Mountlabel must either not be specified or both specified

Additional information you deem important (e.g. issue happens only occasionally):

Only problem when exported and then imported, if restored in place it works.

Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/master/troubleshooting.md)

Yes

Additional environment details (AWS, VirtualBox, physical, etc.):

Fedora 34

[mheon]

@adrianreber @rhatdan PTAL, this definitely does look similar to #10635

[adrianreber]

Yes, #10635 was the same error message. Looking at podman inspect I see:

        "Driver": "overlay",
        "MountLabel": "system_u:object_r:container_file_t:s0:c1022,c1023",
        "ProcessLabel": "",
        "AppArmorProfile": "",

which is the same as running with --privileged. Which means the fix in #10635 is not totally correct. I will provide a fix.

Checking if a container is --privileged during restore is not enough. I need to do it differently.