Podman container image contains too many host namespaces

[Luap99]

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

IMO the podman container image should behave as much as possible like a normal podman on the actual host.
Currently most namespaces are set to host via container.conf in the image:

podman/contrib/podmanimage/stable/containers.conf

Lines 2 to 6 in ff8834f

	netns="host"
	userns="host"
	ipcns="host"
	utsns="host"
	cgroupns="host"

I understand that some namespaces do not work as well when they are nested, for example the network namespace.

However I do not see reason why uts or ipc is set to host. The list does not specify pid namespace so this is already private.

The discussion come up when testing new images in the upgrade test: #13697

Steps ns to reproduce the issue:

$ sudo bin/podman run --rm --privileged --net=host quay.io/podman/stable:v3.4.0 podman pod create --name foo
Error: invalid config provided: cannot set hostname when running in the host UTS namespace: invalid configuration

Describe the results you received:
Podman pod create does not work out of the box. User have to change containers.conf manually since there is not --uts option for podman pod create.

Describe the results you expected:
It should work.

Additional information you deem important (e.g. issue happens only occasionally):

#11969

[rhatdan]

The basic idea of podman and buildah inside of a container, is you already have separate namespaces from the parent container, so use them. Rather then add the complexity of multiple different namespaces.

[rhatdan]

Uts should match up with what we decide for network though.

[Luap99]

Sure but then podman should be working with a host uts namespace.

Also buildah ignores most containers.conf settings, see containers/buildah#3836

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[rhatdan]

@Luap99 any movement on this?

[Luap99]

No I think it is not a good idea to have many host namespaces in the container. This will result in vastly different behaviour between podman in a container and on the host.

Anyway the current state is that podman pod create is broken when you have uts set to host (not relevant if container or not) so we should fix this.

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[rhatdan]

@cdoern PTAL

[cdoern]

@Luap99 would this be satisfied by adding the --uts flag to pod create? I can wire that up today