fix --init with /dev bind mount

[vrothberg]

The init binary until now has been bind-mounted to /dev/init which
breaks when bind-mounting to /dev. Instead mount the init to
/run/podman-init. The reasoning for using /run is that it is already
used for other runtime data such as secrets.

Fixes: #14251
Signed-off-by: Valentin Rothberg [email protected]

Does this PR introduce a user-facing change?

Fix a bug where bind-mounting /dev in conjunction with using --init failed to start the container.

[flouthoc]

LGTM just one non-blocking nit above.

[Luap99]

Not sure why /sbin is any better other than this should be used less often as bind mount?
I think using /run might be better since this is already broken apparently (I will file a separate bug):

$ bin/podman run --init -v /run:/run alpine:latest ls /run
Error: crun: open `/home/pholzing/.local/share/containers/storage/overlay/db6f9c100a5e9598d271afaff4f83ca5658d1637c452a4f9e33edc9b931f24b8/merged/.containerenv`: No such file or directory: OCI runtime attempted to invoke a command that was not found

Either way I think you have to add this to the podman diff exclude list:

$ bin/podman diff lucid_elgamal
C /etc
C /sbin
A /sbin/podman-init

podman/libpod/diff.go

Line 10 in 9915b8f

var initInodes = map[string]bool{

Also make sure to document this known limitation in the man page.

[rhatdan]

I agree lets move it to /run/

[vrothberg]

I think using /run might be better since this is already broken apparently (I will file a separate bug):

Good idea. This should be documented for --volume/--mount etc.

[vrothberg]

@kolyshkin FYI

[vrothberg]

@Luap99 @rhatdan PTanotherL

[Luap99]

Can we move this into libpod/define and use it in libpod/diff.go as well.

[vrothberg]

Done ✔️

[TomSweeneyRedHat]

LGTM
once @Luap99 comment is settled.

[fruch]

LGTM

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: flouthoc, fruch, vrothberg

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [flouthoc,vrothberg]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Luap99]

/lgtm
/hold

[vrothberg]

/hold cancel

[kolyshkin]

In moby/moby#37665 I put it to /sbin as chances are very low that someone would want container's /sbin as a destination for a bind mount (or any other mount). Not quite sure about /run -- maybe some people have an explicit tmpfs mount over it. Hope they don't.